A department store in Norway lost its freezer room to a remote attack in early November. The owner said the rest of the site sat behind the company firewall. The freezer did not. It had its own 4G transmitter, fitted by the equipment supplier for remote control, and the business had not known that link was unsecured, E24 reported, citing NRK.
It was one of hundreds of refrigeration sites hit across Europe this autumn. We covered the timeline and the authorities' advice on ixt.io/news. This edition is about that 4G box, because the same box sits next to EV chargers, pump stations, lifts and building controllers.
Unattended equipment needs to send alarms when nobody is on site, and the people who maintain it need to reach it without driving out. The quickest fix is a small cellular router, supplied by the manufacturer or the service contractor, with a SIM they buy and manage.
For the contractor, that is good service. For the owner, it is a connection that never went through IT. It is not in the firewall rules or the asset register. Nobody on the owner's side holds the login. Nobody gets an alert when a setting changes at 3am.
Three companies sit around one device. One owns it, one connects it, one maintains it. Security falls into the gaps between their contracts.
Most of these links were never a decision. They came bundled with a maintenance agreement, which makes the renewal the cheapest moment to fix them. Four points cover most of it.
Start with ownership. Find out who supplied the connection and whose name is on the SIM contract. If the answer is "the contractor", you have a network link you do not control.
Then the address. Equipment with a remote service link should have no public IP address and no management interface reachable from the internet. That applies to a cellular link as much as a fixed line, and it is the first step France's cybersecurity agency CERT-FR told operators to take this autumn.
Access comes next. CERT-FR's minimum is a secure VPN or a protected network. Go one step further with the contractor: named people, one device per session, every session logged and the logs yours on request.
Last, change and end of life. Configuration and firmware changes get reported to you, not only recorded by the contractor. And the contract says who replaces a controller once the manufacturer stops shipping security updates.
None of this stops the contractor doing the job. It makes the job visible to the person carrying the risk.
Plenty of our readers sit on the other side of that contract. You build the charger, the controller or the monitoring service, and the 4G router is yours.
Your customers will start asking these questions, and their auditors will ask them too. A supplier with good answers on day one wins the renewal. A supplier who says "it has a password" is the next headline.
Henning Solberg, CTO and Co-founder of IXT, on the refrigeration controllers hit this autumn:
"Most of this equipment needs a technician to reach it. The mistake is connecting it so that anyone can. We keep devices like these on a private mobile network with no public address, and contractors get access to 1 device at a time, with every session recorded. A regular SIM just gives you unprotected Internet access."
The same set-up works for chargers, pumps and building controllers. IXT SecureNet runs the private network. IXT Zero Trust gives your technicians that one-device, recorded access through a browser, inside a set time window. IXT CMP shows every SIM in your fleet and whether it is online, which gives you something concrete to show the customer.
A private connection does not fix the device. Factory passwords still need changing and old controllers still need replacing. What it controls is the path to the device and who gets to use it.
Want to see it on one site first? Request a test SIM.
This article is also published as part of Secure SIM Insights, IXT's weekly newsletter on LinkedIn. Subscribe on LinkedIn to get each edition when it comes out.
This guidance is based on real IoT and OT deployments in regulated industries including energy, utilities, and industrial environments.
IXT designs and operates secure connectivity architectures where:
The patterns described here reflect how these environments are secured in practice, not theoretical models.
This article was written by the IXT Connectivity and Security team.
IXT operates a full MVNO core network and delivers secure IoT connectivity across 190+ countries and 600+ mobile networks. The team works directly with industrial, utilities, and infrastructure operators to design and secure large-scale IoT and OT deployments.
Their focus is on network-level Zero Trust architecture, SIM-based identity, and secure device communication without relying on VPNs or endpoint agents.