We take your refrigeration controls off the public internet.
Hawthorn OT Security secures the networks behind building and industrial controls: the controllers that run refrigeration, building automation, boilers, HVAC, lighting and EV chargers. We work with independent grocers, restaurants, cold storage, pharmacies and other commercial buildings in northern New Jersey.
Start with a free Exposure Check
A one-page report on what an outsider can see of your controls from the internet. It costs nothing.
The problem
In October and November 2026, attackers remotely raised temperatures at hundreds of European supermarkets. They got in through Danfoss and Copeland/Dixell refrigeration controllers that could be reached from the public internet.
On November 5, 2026, CISA, the FBI, HHS, USDA and DOT issued a joint fact sheet telling U.S. operators to take these controllers off the public internet.
Controllers usually end up exposed for an ordinary reason. Someone opened a port so the service company could log in remotely, and it was never closed. Some owners don’t know their equipment is online at all.
Refrigeration made the news, but the same open door sits in front of building automation systems, HVAC and lighting controls, EV chargers, and the remote logins equipment vendors leave behind. We close it the same way for all of them.
Services and prices
| Service | What you get | Price |
|---|---|---|
| Exposure Check | A one-page report on what an outsider can see of your controls from the internet. | Free |
| Site Assessment | An on-site walk, an inventory of your controllers and network equipment, and written findings ranked by risk. | $1,950 single store · $3,900 larger site Single store: one mechanical room and one network closet, one day. Larger site: several mechanical rooms, a warehouse or cold storage building, two days. We tell you which applies before we visit. $500 credited toward a Lockdown booked within 30 days. |
| Lockdown | Public exposure removed. Secure remote access for your service contractors and equipment vendors. Controls separated from your other computers. Before-and-after proof. | From $3,000 per site Plus hardware at cost. |
| Watch Plan | A quarterly re-check from the outside, a yearly site visit, and an alert when your equipment maker issues a security fix. | $150 per site per month |
| Other work | Anything that doesn’t fit the services above. | $175 per hour |
10% off for five or more sites.
What the Site Assessment covers
We look at the network your controls sit on, and we write down what we find in plain language.
- What’s visible from outside. What a stranger on the internet can see of your site.
- What’s connected, and how. Every controller and piece of network equipment, and how they are wired together: refrigeration, building automation, HVAC, lighting controls and EV chargers.
- Who can log in remotely. Which people, contractors and equipment vendors have remote access, and how they get in.
- Passwords and software versions. Whether the network equipment still uses factory passwords or out-of-date software.
- A written report. Findings ranked by risk, with fixes in priority order.
What we don’t touch
- Controller settings, setpoints and firmware. Those stay with your service contractor.
- Cameras, alarms, door access and locks. If one is reachable from the internet, we report it. Choosing, placing and installing them belongs to a licensed alarm company.
- Anything at all without the owner’s written permission. We never test without it.
The federal guidance we follow
Our work follows published U.S. government guidance. You can read every source yourself.
-
US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems (PDF)
CISA, FBI, HHS, USDA and DOT joint fact sheet, November 5, 2026. It tells operators to:
- Eliminate public internet exposure.
- Secure remote access with a VPN and multi-factor sign-in.
- Change default passwords.
- Update firmware and replace end-of-life devices.
- Separate control networks from business networks.
- Keep tested backups.
- Log access and review the logs.
- Primary Mitigations to Reduce Cyber Threats to Operational Technology CISA’s short list of first steps for any control system: get it off the public internet, change default passwords, secure remote access, and separate control networks from office networks.
- Cross-Sector Cybersecurity Performance Goals A minimum set of security practices that CISA and NIST recommend every organization put in place. The refrigeration fact sheet maps each of its steps to these goals.
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security The federal reference on securing control systems without getting in the way of how they run.
For refrigeration, HVAC and controls contractors
We secure the network so you can keep offering remote service. You keep the customer and you keep the controller. We don’t change settings, setpoints or firmware. We pay a referral fee on work you send our way.
About
Hawthorn OT Security is a one-person firm. The founder is an electrician and controls foreman with more than two decades in the trade, working alongside a network technician. We advise on and secure the network side, and we leave the controllers to the people who service them.