Not just refrigerators: the security challenges of connected operational technology (OT)

On November 5, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) and four other US federal agencies issued a joint advisory urging organizations to harden industrial refrigeration and cold-chain monitoring systems. The agencies warned of malicious cyberactivity targeting these systems globally, including in the healthcare, chemical, food and agriculture, and transportation sectors.

The warning followed a series of recent attacks in which threat actors altered refrigeration settings at hundreds of supermarkets across Europe and three cold-storage sites operated by France's national blood service.

In the supermarket attacks, adversaries accessed the supervisory systems that manage refrigeration equipment and repeatedly triggered defrost cycles, with some freezers reaching 50°C. At the blood service, they reportedly changed freezer setpoints for plasma storage from approximately −30°C to 110°C. The changes were made through standard functions available to any authenticated technician.

The refrigeration equipment itself worked as designed. What the attackers reached was the layer that manages it: supervisory controllers that allow technicians to monitor and adjust refrigeration from outside the building.

The Computer Emergency Response Team of France (CERT-FR) confirmed compromises of four families of these controllers:

• Danfoss AK-SM

• Danfoss AK-SC

• Copeland XWEB

• Dixell XWEB

Retailers and suppliers in several countries described access paths that ran through remote management connections and the service providers that use them. Understanding how these systems are managed, who can access them, and what security controls govern that access, helps explain a risk well beyond just refrigeration systems.

These incidents exposed security challenges that are common across operational technology (OT) environments. Similar remotely managed systems are used to operate heating, ventilation, and air conditioning (HVAC), power distribution, pumps, data center cooling, building automation, and cold-storage infrastructure across many industries. While the equipment serves different purposes, many of these environments rely on the same remote-access models, third-party support arrangements, and long-lived operational systems. 

The conditions that enabled these attacks are also familiar. Public reporting and government advisories point to issues such as incomplete asset inventories, externally accessible management systems, weak or shared credentials, delayed remediation, insufficient network segmentation, and unmanaged third-party access. These are well-established cybersecurity challenges with well-understood security controls, yet they are often applied less consistently in OT environments than in traditional information technology networks.

What is a remotely managed equipment controller?

Equipment controllers are embedded computers that monitor sensors and operate physical equipment within defined parameters. In OT environments, meaning the systems that control physical processes rather than business data, these controllers are typically organized in two tiers:

1. Field controllers, which sit at the equipment level. In a refrigeration system, each display case, cold room, or compressor rack has its own controller that reads temperature probes, opens expansion valves, and runs defrost cycles. These devices usually communicate over serial or building automation protocols such as Modbus RTU, LonWorks, or BACnet.
2. Supervisory controllers, which sit above field controllers and coordinate them across a site. Take the Danfoss AK-SM system manager as an example. It aggregates data from field controllers, stores alarm and temperature history, and applies schedules site-wide. Depending on configuration, a single AK-SM unit can manage refrigeration, HVAC, and lighting for an entire store. Comparable supervisors include Copeland E2 and E3, Copeland and Dixell XWEB, and Carel boss and PlantVisorPRO.

The management interface

Most supervisory controllers today include an embedded web server that provides a browser-based management console. On the Danfoss AK-SM 800A, the console, branded StoreView, runs behind an Nginx reverse proxy that forwards requests through a common gateway interface (CGI) layer to the controller's main application.

This interface lets an authenticated user:

• View live temperatures
• Acknowledge alarms
• Change setpoints
• Modify defrost schedules
• Configure email alarm notifications
• Manage user accounts

Controller vendors also supply desktop management software, such as Danfoss StoreView Desktop and the Remote Management Tool (RMT), and cloud monitoring platforms that collect data from many sites. Each of these represents an additional path to the controller.

Beyond refrigeration

Although media coverage of the incidents has centered on refrigerators, the underlying exposure is considerably broader. Danfoss, for example, supplies refrigeration controls alongside:

• HVAC and district heating controllers
• Variable-speed drives that run pumps and fans in commercial buildings and water utilities
• Hydraulic and power systems for industrial and mobile machinery

Data centers depend on networked chillers, computer room air handlers, and power distribution units. Hospitals, laboratories, and pharmacies rely on monitored cold storage. Commercial buildings tie HVAC, lighting, and access control together through building management systems.

In each case, a supervisory device with a web interface and a remote maintenance arrangement creates the same category of exposure.

Why organizations adopt remote management

Remote access reduces response time, travel cost, and product loss. For example, a refrigeration system failure at 2:00 a.m. can result in destroyed inventory before anyone arrives on site. A failed HVAC unit can affect manufacturing operations, office buildings, or healthcare facilities.

Centralized monitoring allows operators to detect issues quickly and respond before they become emergencies. Organizations commonly use these systems to:

• Detect equipment failures outside business hours
• Maintain operational and compliance records
• Diagnose problems remotely
• Reduce response times and maintenance costs

These are legitimate benefits, and remote management is often necessary.

However, remote monitoring and remote control are not the same. Organizations often need broad visibility into temperatures, alarms, and equipment status, but far fewer people need the ability to change operational settings. Many environments expose both capabilities through the same management platform, creating unnecessary risk.

Rental and leased equipment extend this model. Providers may equip units with their own remote monitoring platform, and to manage a unit without depending on the customer’s network, they will sometimes connect it over a cellular gateway. The customer gains a fully managed service, but it also accepts a connection that can sit outside its own security controls.

The security risks

Supervisory controllers are often installed and maintained by external contractors, and several retailers affected by the attacks reported that threat actors may have reached them through those providers.

Equipment managed this way can sit outside the security processes that govern servers and endpoints: affected stores in Sweden had connections running outside the central network or over mobile links, and many compromised units were end-of-life models still in service.

The initial access method has not been confirmed, but the conditions visible in the reporting point to gaps across several core areas of security practice.

Asset management

A controller installed by a refrigeration or HVAC contractor is often missing from the IT asset inventory. Devices connected through a vendor-managed cellular gateway never traverse the corporate network, so internal network discovery and vulnerability scanning do not detect them.

Swedish retailer ICA reported that its affected stores had connections running outside its central network, and Swedish Coop reported that its affected stores were connected over 4G mobile links. An organization cannot assess, patch, or monitor a device it has not identified.

External exposure

Some supervisory controllers are published directly to the internet through port forwarding or a public IP address to simplify remote support.

Researchers have recently identified 2,765 Danfoss AK-SM 800A management interfaces reachable online in August 2026, many displaying the distinctive StoreView page title. A broader scan identified more than 13,000 internet-accessible refrigeration controllers from vendors including Danfoss, Copeland, Dixell, Eliwell, and Carel. Separate research identified 6,330 exposed industrial devices within one kilometer of documented US data center locations, including BACnet controllers and Niagara Framework instances.

Exposed interfaces are routinely enumerated. Between October 20 and October 30, 2026, the researchers recorded 256 attempts from 91 sources against its simulated Danfoss systems, with a clear peak on October 26, about one week before the second wave of attacks.

Vulnerability management

The software running on equipment controllers is no different from software running elsewhere in the environment, but organizations routinely prioritize operating system and application updates on servers and endpoints.

As an example, Danfoss AK-SM 8xxA series has had several vulnerabilities fixed, including:

• CVE-2025-41450 (CVSS 8.2), an authentication bypass in the xml.cgi login handler, fixed in version 4.2

• CVE-2025-41451 (CVSS 7.6), a command injection in alarm-to-mail configuration fields that allows remote code execution after authentication, fixed in R4.3.1

• CVE-2025-41452 (CVSS 5.4), an Nginx configuration injection that allows a denial-of-service condition, fixed in R4.3.1

Whether they were exploited in the attacks has not been confirmed, but controller updates commonly depend on the maintaining contractor, and some upgrade paths are constrained. Danfoss requires an intermediate move from 3.x to 4.x before the 5.3.x package, which cannot be rolled back.

A larger problem is end-of-life hardware. Danfoss stated that most affected French units were older models with outdated firmware, mainly the AK-SM 800, end of life since May 2021, and the AK-SC 355, phased out in 2016. Refrigeration and HVAC equipment often operates for a decade or more, so controllers can remain in service for years after vendor security support ends.

Whether vulnerabilities contributed directly to the attacks remains unclear, but unsupported equipment creates unnecessary risk regardless.

Password management

Supervisory controllers commonly ship with factory default credentials that are printed in installation guides and user manuals published on vendor websites.

Danfoss, for example, documents the default StoreView login in its publicly available product documentation and recommends changing it during commissioning. If defaults are left in place or replaced with a single password shared across every site a contractor maintains, anyone who knows the credential can access every unit that uses it.

Because these manuals are public, default credentials are among the first combinations attackers attempt against an exposed interface.

Public discussions following the attacks frequently cited the claim that some affected controllers remained accessible with publicly documented factory default credentials. Authorities have yet to confirm the access method, but the principle holds: once an attacker reaches the management interface with valid credentials, changing setpoints requires only a few clicks.

An even harder problem arises when a maintenance login is built into the product itself. Vendors include these logins so support staff can access a unit, but customers often cannot see or change them, and anyone who learns how one works can use it on every unpatched unit of that model.

In August 2026, researchers found that the Danfoss AK-SM 800A accepted a hidden "code of the day" password generated solely from the device's current date. Once the algorithm was reconstructed, it produced a valid administrative session on any unpatched unit.

A similar issue was disclosed in Copeland E3 supervisors: a default administrator account named ONEDAY with a daily generated password. In both cases, the password could be predicted rather than guessed, which removes the protection password-based authentication is meant to provide. Both issues were fixed through firmware updates.

Third-party access management

A single refrigeration or HVAC service provider may hold standing remote access to hundreds of customer sites, often through shared accounts and remote access tools that the customer neither provisions nor monitors.

In October, E.Leclerc and Intermarché said the attack in France affected a refrigeration supplier or service provider. In November, Intermarché stores in Portugal reported that the attack appeared to target an external provider responsible for managing their refrigeration.

France's national blood service, the Établissement français du sang (EFS), was reportedly compromised through remote monitoring software on equipment rented from Coolworld, which attributed the vulnerability to a component from a third-party supplier. In these cases, the reported access path ran through the provider rather than through the victim's own network.

Public reporting has not described the security practices of the providers involved. However, many refrigeration and HVAC service providers are small, regional businesses whose core expertise is mechanical rather than digital, and it is reasonable to expect that some operate without the security controls of a large enterprise or a managed service provider (MSP). A technician may connect to customer controllers from a personal or shop laptop running an unsupported operating system or hold StoreView Desktop or RMT with saved site credentials, a spreadsheet of customer IP addresses and passwords, and a general-purpose remote access tool such as TeamViewer or AnyDesk, with no endpoint protection, disk encryption, or multi-factor authentication (MFA).

In that situation, the security of every connected customer site depends on the hygiene of one unmanaged device. Malware on the technician's laptop, a stolen device, or a phished email account can give an attacker the same access the technician has. Customers may never see this risk if the provider's equipment and practices are excluded from onboarding review, and the connection is often established by the provider rather than by the customer.

Why these risks are frequently overlooked

These systems fall between organizational responsibilities. Facilities teams own the equipment and the service contract, the vendor manages the software, and IT often has no visibility into either. Most IT and security programs are scoped to the corporate network: user endpoints, servers, cloud tenants, and identity systems. Refrigeration, HVAC, and power controllers are frequently treated as building infrastructure rather than as networked computers, so they are often missing from asset inventories, vulnerability scans, patch cycles, access reviews, and security monitoring.

Equipment purchases and service contracts can bypass IT procurement, and maintenance contractors may be engaged without the security onboarding applied to software vendors.

The result is a category of internet-connected computers that carries the same risks as any server, yet often receives little of the same governance. Threat detection is also difficult. Changing a setpoint or initiating a defrost cycle is a routine maintenance action, so malicious changes are indistinguishable from legitimate activity unless an organization correlates them with maintenance schedules and access records.

In both attack waves, the changes were made overnight, when sites were unstaffed.

Real-world impact

The 2026 campaign unfolded in three documented stages. Each shows how the gaps described above translate into operational consequences.

The October attack on French supermarkets

On the night of October 11, 2026, attackers accessed refrigeration management systems at supermarkets across France and forced fridges and freezers into continuous defrost. The French government put the number of affected stores at about 700 of the country's roughly 10,000 supermarkets, across chains including:

• Intermarché

• Netto

• Coopérative U

• Carrefour

• Monoprix

• E.Leclerc

Stores discarded affected stock, and French authorities examined reports of equipment fires.

On October 12, CERT-FR confirmed numerous compromises of Danfoss AK-SM and AK-SC controllers, and on October 13 it added Copeland XWEB and Dixell XWEB controllers to its alert. Danfoss stated that most affected units were older models running outdated firmware.

E.Leclerc said the attack affected one of its refrigeration equipment suppliers, and Intermarché described an attack affecting a service provider that manages refrigeration systems. Coopérative U reported that quick action by staff and contractors kept the cold chain intact in most of its 80 affected stores.

The reported facts point to three of the gaps described earlier:

• End-of-life equipment still in service

• Management access reachable from outside the store

• An access path running through refrigeration service providers

The November attacks across Europe

Three weeks later, overnight between November 1 and November 2, 2026, a second wave hit retailers across Europe, including Delhaize, Carrefour, Spar, Colruyt, Intermarché, IKEA, ICA, Coop, and SuperValu.

Finnish retailer Kesko investigated irregular temperatures at several stores. In the week before the attacks, security firm Lupovis recorded a spike in activity against its simulated Danfoss systems, consistent with adversaries identifying exposed devices in advance.

Statements from affected organizations highlight two lessons.

First, adversaries exploited the gap between disclosure and remediation. The affected controller models were publicly known after the October incidents, yet Belgian refrigeration firm Sabcobel said some systems awaiting upgrades were affected, and the units hit in Estonia were the same older Danfoss models targeted in France. Systems remain exposed until updates, isolation measures, or replacements are completed.

Second, some affected systems were reachable through connections outside retailers' direct control. ICA said affected stores were connected to an external Danfoss control system, Swedish Coop reported the use of 4G mobile links, and Intermarché stores in Portugal pointed to an external refrigeration provider. These connections operate outside traditional corporate network security controls and can create alternative paths to operational technology environments.

Detection speed also influenced outcomes. Irish wholesaler Musgrave reported receiving monitoring alerts in time to respond, while a Stockholm store did not identify the issue until hours after temperatures began to rise. Belgian federal prosecutors opened an investigation, and the European Commission described the incidents as a deliberate attempt to disrupt the food supply chain.

Blood plasma storage at the French Blood Establishment

On the same November evening, attackers modified refrigeration control settings used to manage blood plasma storage at three sites of the Établissement français du sang (EFS), France's national blood service. 

The attackers reportedly changed freezer setpoints from approximately −30°C to 110°C, a change that, if left in place, would have threatened frozen plasma supplies used for transfusions.

EFS was not attacked directly. The cold-storage equipment was rented from and maintained by the service provider, Coolworld, and the attackers reportedly gained access through remote monitoring software on the provider's units. Coolworld attributed the vulnerability to a component supplied by a third party.

An on-call technician reportedly detected the abnormal temperature changes and responded before operations were affected.

EFS stated that no health impact had been identified and no blood products were lost, and the French Ministry of Health said the incident caused no operational disruption because it was detected in time.

The precise access method has not been published, but the apparent attack path illustrates the broader problem:

1. Refrigeration management systems connected to the internet, in this case through a provider's remote monitoring platform

2. Weak, default, or otherwise compromised credentials, or a vulnerable component, granting access to the management interface

3. Remote modification of control parameters using legitimate functions

4. Potential disruption of a real-world physical process

Business consequences

The financial impact of the 2026 attacks was significant. Les Mousquetaires, which operates Intermarché, estimated losses in the tens of millions of euros across French stores after the October wave. Losses extend beyond inventory to include emergency service costs, lost revenue during restocking, and incident response.

In regulated environments, the consequences are more serious. Compromised cold storage in healthcare affects product integrity and patient safety. In data centers, loss of cooling capacity could trigger thermal alarms and protective shutdowns within minutes, interrupting customer services.

Organizations may also face regulatory reporting obligations, insurance scrutiny regarding the use of internet-exposed or end-of-life equipment, and reputational damage with customers who expect continuity of supply.

When remote management is appropriate

Remote management remains a legitimate and often necessary operating model. For organizations with many sites, limited on-site expertise, or equipment that requires rapid specialist response, it reduces downtime and product loss in ways that on-site support alone cannot match. Continuous remote monitoring also detects mechanical failures that would otherwise go unnoticed until damage occurs.

The relevant question is not whether to permit remote access, but how it is implemented. Remote management is appropriate when access is deliberate, documented, routed through controlled infrastructure, tied to individual identities, restricted to necessary functions, and visible to the security team. The risk arises when access is configured once for convenience and left unmanaged for the life of the equipment.

Mitigation strategies

The incidents did not expose a need for new security controls. They highlighted a gap in applying established security practices to operational technology. Remote management remains a valuable operational capability, but the systems that provide it benefit from the same asset management, access control, vulnerability management, monitoring, and third-party oversight that organizations already apply to IT systems.

Establish a complete asset inventory

Identify every supervisory and field controller across all sites, including contractor-installed equipment, rented units, and devices connected through cellular gateways. Request a device and access inventory from each facilities contractor and rental provider, including make, model, firmware version, network path, and remote access method.

Passive OT discovery tools can supplement this by identifying devices communicating over BACnet, Modbus, and similar protocols. An accurate inventory is the prerequisite for every other control.

Make the inventory durable by adding an IT security review to the procurement and installation process for any networked building or equipment controller, so that new devices are recorded, configured, and connected to approved network segments before they go live.

Eliminate direct internet exposure

Audit external IP ranges for exposed management interfaces using internet scanning services and external attack surface monitoring, searching for vendor-specific page titles such as StoreView and XWEB and for protocols such as:

• BACnet (UDP 47808)
• Modbus TCP (502)
• Niagara Fox (1911 and 4911)

Remove port forwarding and public IP assignments. Route all remote access through a single controlled entry point, such as a virtual private network (VPN) or a privileged access gateway with session logging.

Segment controllers into dedicated network zones, separated from corporate, guest, and payment networks by firewall rules that permit only required traffic. The zones and conduits model in the IEC 62443 standard provides a practical framework for this segmentation.

Where monitoring data needs to leave the site, separate it from control: send temperature readings and alarms to the monitoring platform through a one-way or read-only path, and keep write access to setpoints and schedules behind the VPN or access gateway.

Apply stricter access controls

Limit control functions to the smallest practical group of named users. Use role-based permissions on the controller so that monitoring staff and most technicians hold read-only access, and reserve setpoint, schedule, and user management changes for designated administrators. Restrict remote sessions to approved maintenance windows where operationally feasible, and require approval for out-of-hours access.

Air-gap critical systems where practical

For systems where an unauthorized change carries severe consequences, such as blood, vaccine, or pharmaceutical storage, consider removing remote control capability entirely and isolating the controller from external networks. Local alarms, independent temperature loggers, and on-call notification can provide the monitoring benefit without a remote control path.

Where full isolation is impractical, apply the strictest segmentation and access controls available, and document the residual risk.

Integrate controllers into vulnerability management

Track controller firmware versions alongside other assets, subscribe to vendor security advisories, and include controllers in patch cycles. Establish a funded replacement plan for end-of-life models such as the AK-SM 800, AK-SC 355, and Copeland E2, and apply compensating controls, specifically strict network isolation, until replacement is complete.

Strengthen credential management

Change all factory default credentials at commissioning and verify the change during periodic audits, since vendor manuals that list default logins are publicly available. Replace factory default and shared credentials with unique, individually assigned accounts for each technician. Enforce MFA at the VPN or access gateway, since many controllers lack native support for it. Store service credentials in a privileged access management or password vault solution, rotate them on a defined schedule, and remove access promptly when contractors or staff change roles.

Formalize third-party onboarding, oversight, and offboarding

Apply the same third-party risk management process used for software and IT service providers to refrigeration, HVAC, power, and building maintenance contractors, including small regional firms. Before granting access, require a short security questionnaire and set minimum technical requirements: supported and patched operating systems on any device used to connect, endpoint protection, disk encryption, individual named accounts, MFA, and no storage of customer credentials in plain text.

Require providers to connect only through an access path the organization provides and controls, such as a jump host or privileged access gateway with session recording, rather than through their own remote access tools or direct internet connections. Define in contract who on the provider's side can connect, how activity is logged, and the timeframe for notifying the organization of a security incident. Review provider access at least annually and at each contract renewal, and revoke credentials and access immediately when an engagement ends or a technician leaves the provider.

Treat OT with the same seriousness as IT

Extend existing IT security policies, ownership, and risk reporting to cover building and equipment controllers. Assign a named owner for each class of OT system, define shared responsibilities between IT, security, and facilities teams, and include OT assets and their third-party access paths in the organization's risk register, audit scope, and incident response plan. A refrigeration controller, an HVAC supervisor, or a power management interface is a networked computer with administrative access to physical processes, and it warrants the same governance as a server.

Forward controller audit logs, VPN logs, and access gateway logs to a central monitoring platform where possible. Alert on setpoint changes, defrost schedule changes, new user accounts, and authentication events outside approved maintenance windows. Deploy an independent temperature monitoring system that alerts on-call staff directly, providing detection that does not rely on the potentially compromised controller.

Prepare a recovery procedure

For controllers that were exposed while running vulnerable or end-of-life firmware, follow the recovery sequence published by CERT-FR: restrict access to authorized service providers, perform a factory reset, apply all available updates, rotate passwords and other secrets, review user accounts, and fully reconfigure the device. Modified setpoints, added accounts, and altered configuration files can persist through a firmware update alone.

Remote management: is the risk acceptable?

Some of the questions that can help organizations assess their risk:

• Is every remotely managed controller identified, including contractor-installed and rented equipment?

• Are any management interfaces or building automation protocols reachable from the internet?

• Is remote monitoring separated from remote control, and are critical systems isolated where practical?

• Is controller firmware supported and current, with a replacement plan for end-of-life models?

• Have all factory default credentials been changed, and does every technician authenticate with a unique account protected by MFA at the access gateway?

• Are maintenance contractors onboarded through a security review, required to meet minimum device and access standards, and offboarded promptly?

• Are OT assets included in IT asset management, vulnerability scanning, and security monitoring, with a named owner?

• Would an unauthorized setting change outside business hours generate an alert?

A gap in any of these areas is not necessarily a reason to discontinue remote management. It identifies where controls require attention first.

Security takeaway

The attacks did not reveal a new category of operational technology risk. They demonstrated how familiar security weaknesses can affect systems that manage physical processes. The reporting repeatedly pointed to issues such as incomplete asset inventories, internet-reachable management interfaces, unsupported firmware, shared credentials, limited visibility, and unmanaged third-party access.

These are well-understood cybersecurity challenges with well-established mitigations. The difference is that operational technology environments have often been managed separately from traditional IT security programs and may not receive the same level of oversight.

Organizations can retain the operational benefits of remote management while reducing risk by applying the same fundamentals used elsewhere in the environment: maintaining an accurate inventory, eliminating unnecessary external exposure, controlling and monitoring remote access, managing third-party connections, keeping systems supported and updated, and monitoring for unauthorized changes.

Whether the system controls refrigeration, HVAC, power distribution, building automation, or another physical process, the security principles remain largely the same. The broader lesson from these incidents is that operational technology requires the same security discipline as any other network-connected system.

References

• CERT-FR alert CERTFR-2026-ALE-012

• Claroty Team82 research on Danfoss AK-SM 800A

• Armis Frostbyte10 research on Copeland E2 and E3

• AFP via eNCA, November 3, 2026

• Lupovis findings, VRT NWS, November 4, 2026

• EFS incident, BleepingComputer

• The Hacker News, October 13, 2026

• Coolworld and EFS, Infosecurity Magazine