Refrigeration & Cold Storage
Refrigeration Cybersecurity: Who Can Change Your Temperatures?
Review refrigeration remote access, contractor accounts, and controller support. Use practical cybersecurity checks for cold storage and connected facilities.
Published
A refrigeration contractor can change a controller remotely, often without interrupting service. That helps keep a cold room, production facility, or supermarket operating.
Before the next service visit, establish which accounts can change setpoints, who approves a remote session, and who can revoke access. Your team also needs a way to recognize an unexpected change.
The recent attacks on French supermarkets show why those questions belong in an operations meeting.
What happened in France?
Refrigeration disruption was reported following attacks overnight on October 11-12, 2026. On October 13, France's finance minister said about 700 supermarkets were affected, according to Associated Press reporting. That figure counts affected stores, rather than separate attacks.
CERT-FR's advisory, updated October 13, identifies compromises involving Danfoss AK-SM and AK-SC series controllers, alongside Copeland xweb and Dixell xweb systems. It warns against exposing equipment management interfaces directly to the internet.
Reuters reported that refrigeration temperatures were overridden and spoiled food discarded. Danfoss said many affected units were unsupported or running outdated firmware. The precise intrusion mechanism had not been publicly disclosed, and no group had publicly claimed responsibility at the time of that reporting.
Separately, Claroty Team82's Danfoss research documented management-interface weaknesses that Danfoss addressed in a firmware release. Those findings provide technical context; they do not establish which vulnerabilities were used in the French attacks.
You can review access to your own controls now; you do not need to wait for the incident's final attribution.
How refrigeration systems become reachable
A connected controller may support local monitoring, remote maintenance, or cloud services. Being connected does not automatically mean it is publicly reachable, and public reachability alone does not prove a vulnerability or compromise.
For example, Claroty describes the Danfoss AK-SM 800A as a central management platform with a browser interface for monitoring circuits, configuring thresholds, reviewing alarms, and administering users. Access to such an interface can therefore carry operational permissions.
Review these possible routes at your own facility:
| Access route | What to establish |
|---|---|
| Controller web interface | Where it can be reached, which users can sign in, and whether external access passes through an approved gateway. |
| Contractor VPN or remote-support service | Who owns the accounts, which equipment they can reach, and whether sessions require approval. |
| Cellular modem or router | Who installed it, how connectivity is restricted, and whether it bypasses the documented network boundary. |
| Cloud monitoring or management portal | Whether it only reports readings or can send commands, who administers it, and what happens if the connection fails. |
| Local maintenance computer | Whether remote software on that computer provides another route to controllers. |
These are review scenarios, not a finding that every route was involved in France.
Map the complete path from the contractor's account to the equipment. A secure-looking login page says little about how much access exists behind it.
Why ordinary IT checks can miss refrigeration equipment
Refrigeration can sit between several owners. IT manages the business network; facilities maintains the equipment; a contractor administers the controller; another supplier manages a cellular connection.
Illustrative example: a cold-storage facility replaces its business firewall, but an older supplier-installed cellular router still provides maintenance access. The new firewall does not control that separate connection.
This is a documented class of OT visibility problem. In its July 2026 water-sector warning, CISA highlighted cellular modems installed by operators, vendors, or integrators that may be undocumented and absent from routine exposure scans. That warning concerns water systems; the same inventory question is useful when reviewing refrigeration.
Ask IT and your contractor to reconcile their records. Include controllers, gateways, support computers, cloud accounts, and their operational functions.
The joint OT asset-inventory guidance led by CISA recommends documenting assets and dependencies and classifying equipment by function and criticality. For refrigeration, the useful record explains which controller serves which cold room, who supports it, and what depends on its readings or commands.
A public scan can help identify an exposed interface. It cannot, by itself, prove that every connection has been found or that internal permissions are appropriate.
Ask your refrigeration contractor
Use this checklist in your next maintenance conversation. Ask for supporting records through an agreed secure channel.
- Who has access? Request a current list of supplier accounts, subcontractors, and access owners. Identify shared and former-user accounts.
- What can each account change? Separate viewing temperatures from changing setpoints, defrost schedules, alarms, or user permissions.
- How is remote access protected? Confirm the approved connection route and whether individual accounts and multifactor authentication are available at the access gateway.
- Can we investigate a session? Establish which login and configuration-change records exist, how long they are retained, and who reviews unusual activity.
- Can access be revoked promptly? Identify who disables an account or connection and how essential monitoring would continue.
- Is the controller still supported? Record the exact model, installed firmware, manufacturer guidance, and replacement plan for unsupported equipment.
- How would we recover? Locate configuration backups, local operating procedures, and an escalation contact.
Where a controller lacks a capability, document the limitation and ask which supported gateway or other compensating control can address it.
The NCSC's secure-connectivity guidance for OT provides a useful framework: limit exposure, control connections, monitor their use, and establish an isolation plan.
What to review first
1. Trace the access routes
Start with drawings, service records, account lists, and a walkthrough with the contractor. Identify undocumented connections before considering technical testing. Keep any scanning within an explicitly authorized, equipment-appropriate scope.
2. Assign ownership and verify permissions
Name the facility owner and supplier contact for each route. Record which users can change settings and who removes their access. Have the contractor demonstrate or provide evidence of permissions without changing live operating values.
3. Address exposure alongside operational dependencies
For affected equipment, CERT-FR recommends removing direct internet exposure and restoring necessary access through a secure VPN or protected network. It also calls for checking configurations, including defrost schedules.
Coordinate those changes with operations and the contractor. Establish how alarms, temperature reporting, and emergency maintenance will function during and after the change.
4. Plan supported updates and replacement
Before scheduling an update, have the contractor explain model-specific requirements, backup steps, expected downtime, and post-change checks.
Danfoss's AK-SM 800A release guidance illustrates why this requires planning: the R5.1 release changes the database structure and does not support downgrading to earlier versions. Its instructions call for a backup and checks of correct operation after installation.
For unsupported controllers, agree on interim protections and a replacement plan. CERT-FR warns that resetting an exposed, unsupported device without addressing its vulnerability leaves it open to renewed compromise.
5. Verify detection and recovery
Agree on which access events and setting changes should trigger investigation and who receives the alerts. Where feasible, staff should check actual temperatures using an approved method independent of the management screen.
Document an isolation procedure with the contractor and operations team. If unexpected changes suggest compromise, escalate promptly and preserve available logs while protecting the physical process. Recovery decisions should account for evidence, equipment configuration, and safe operation.
For equipment manufacturers and integrators, these checks also become design questions: can customers assign permissions, retain useful logs, update securely, and recover their configuration? These are part of the broader product cybersecurity lifecycle.
Turn the questions into a documented access review
An OT Remote Access and Exposure Review brings together the access routes, supporting evidence, unanswered questions, and corrective actions for the equipment your operations depend on.
If you cannot confidently explain who can reach your refrigeration controls, explore Product Cybersecurity's OT Remote Access and Exposure Review. Start with a defined equipment list and the people who operate and support it.