Refrigeration controller attacks: who owns the facility devices that keep essential services running

On 10 and 11 October 2026, coordinated attacks hit supermarket refrigeration systems in France. On 12 October, CERT-FR published an alert (CERTFR-2026-ALE-012) about “numerous compromises” of remote controllers for refrigeration installations: Danfoss AK-SM and AK-SC, and Copeland and Dixell xweb. Three weeks later, a second wave reached stores in several European countries. On 5 November, the FBI, CISA and other US federal agencies issued an advisory asking critical infrastructure operators to protect their cooling systems.

On the surface, this is a retail story about freezers. Underneath, it is a governance story. The compromised devices are facility equipment. They regulate temperature, log readings and manage defrost cycles. In many organisations they sit outside the IT asset register, outside the security team’s scope and outside the executive committee’s line of sight. Yet when someone else controls them, the result is spoiled stock, closed aisles and, in sectors such as healthcare, a direct threat to the continuity of an essential service.

This article does not revisit the general problem of unmanaged network connections. It focuses on three questions that boards and security leaders now need to answer. Who owns facility and installer-managed controllers? What evidence of exposure should the board demand? How do these assets enter continuity and third-party governance?

What the facts show so far

The timeline is short and well documented.

• 10–11 October: coordinated attacks on supermarket refrigeration in France, according to Censys.
• 12 October: CERT-FR publishes its alert. It extends the alert on 13 October to add other targeted equipment, and updates its recommendations on 16 October. The alert names Danfoss and Copeland as manufacturers but cites no CVE.
• Early November: a second wave hits European stores. Censys dates it to 2 November. Infosecurity Magazine reports an incident on 1 November affecting supermarkets in at least nine European countries.
• 5 November: the FBI, CISA, HHS, USDA and DOT publish a joint advisory.

The scale depends on who is counting. BleepingComputer reports that more than 115 stores were affected in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Based on chain statements, these include about 40 Ahold Delhaize locations in Belgium and Luxembourg, 15 Carrefour stores in Belgium, 13 SuperValu stores in Ireland, 7 Coop stores in Sweden (out of more than 800) and at least 4 ICA stores in Sweden. The Register gives a different picture: since mid-October, it says, “unknown miscreants” have hacked thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg and Sweden. The two counts measure different things and should not be merged into a single total.

The attackers changed temperature settings remotely. According to Infosecurity Magazine, they reportedly programmed some systems to reach temperatures as high as 50 °C. The Record reports that freezers and refrigeration units at several US military commissaries also changed modes unexpectedly.

No one has claimed responsibility. The Record notes that European authorities are on alert for hybrid threats to infrastructure amid tensions with Russia. That is context, not an attribution, and it should not be treated as one.

Key point: The targeted systems were not exotic. Censys identifies Danfoss StoreView controllers with internet-exposed management interfaces as the main target. The entry point was ordinary remote management, reachable from the internet.

Why this matters for security leadership

The US advisory states that healthcare, transportation, food and chemicals organisations “widely” use cooling systems with automated and remote temperature monitoring, logging and defrost-cycle management. These functions are what make the equipment useful, and they are also what make it attractive to an attacker. A controller that can schedule defrost cycles and adjust setpoints remotely can also be told to warm up a cold room.

Chris Butera of CISA said every organisation that depends on refrigeration and monitoring systems “should assume it could be a target”. Brett Leatherman of the FBI Cyber Branch said: “We are seeing these systems targeted across critical infrastructure sectors globally.”

For regulated organisations, the consequence is clear. Cold storage is part of the service, not a building detail. A pharmacy chain, a hospital, a food distributor or a chemicals site that loses temperature control may lose products, fail regulatory quality requirements, or stop serving customers. Yet the device that controls this process is often bought by facilities management, installed by a refrigeration contractor and maintained remotely by that contractor. In that arrangement, the security function may never see it.

Executive takeaway: When a facility device can stop an essential activity, it is a business-critical asset, whoever bought it and whoever maintains it. Its risk belongs on the same register as the systems the executive committee already oversees.

The ownership gap behind facility controllers

The weakness is less technical than organisational. Three patterns tend to combine.

First, procurement sits outside IT. Refrigeration, HVAC and building management are often bought as part of a facilities or property contract. The purchase is assessed on cooling performance, energy use and maintenance cost. Remote access is a feature of the service, not a risk to be assessed.

Second, maintenance sits with the installer. When a contractor configures a controller and keeps remote access to troubleshoot it, the organisation may not know which interface is exposed, which credentials are in use, or whether firmware has ever been updated. CERT-FR’s recommendations point directly at these gaps: update the firmware, set the Danfoss security level to Strict, and make sure default passwords have been changed. These are basic hygiene measures. They only happen if someone is responsible for them.

Third, lifecycle ends without a decision. Facility equipment often stays in service for many years. A controller that no longer receives updates, or whose vendor support has ended, can remain connected long after anyone has reviewed it. Nothing in the notes on this campaign says the targeted units were end-of-life. But any organisation reviewing its own estate should expect to find older controllers that no one has formally accepted, replaced or isolated.

The result is an asset with an operator, a vendor and a user, but no accountable owner. The facilities team runs it, the contractor maintains it, the business depends on it, and the CISO does not know it exists.

Security implication: An unowned asset is an unpatched asset. Exposure persists not because the fix is hard, but because no one is mandated to apply it.

How fast exposure fell, and what remained

The Censys data is the most useful evidence for boards, because it measures the response rather than the attack.

Between 9 October and 5 November, the global exposure of the two product families named in the CERT-FR alert fell 53%, from 6,695 to 3,124 distinct hosts. Danfoss StoreView exposure fell 76%, from 3,004 to 708 hosts. Copeland and Dixell XWEB exposure fell 35%, from 3,708 to 2,420 hosts.

Two lessons follow.

The first is encouraging. A public alert from a national authority, followed by press coverage and vendor communication, can cut exposure sharply in less than a month. Where owners existed and could act, they acted.

The second is sobering. More than 3,100 hosts were still exposed on 5 November, after a national alert, two attack waves and wide media coverage. The second wave came while that remaining exposure was still in place. The gap between the two product families also suggests that the response depends heavily on how each vendor, installer base and customer community reacts.

For a board, the question is not whether the organisation can react. It is whether it can prove, within days of an alert, that none of its own devices are among those still exposed.

Decision point: Set an internal target for responding to an authority alert on facility or OT equipment, for example identification of affected assets within a set number of days, and require a report against it.

Business, regulatory and third-party implications

The incident touches several governance areas at once.

Continuity. Business impact analyses often treat cold storage as a facilities issue covered by maintenance contracts and backup power. They rarely consider deliberate remote manipulation. A continuity plan should state what happens if temperature control is lost or tampered with at several sites at once: who notices, how fast, how products are protected, and when the activity stops.

Third parties. The refrigeration contractor with remote access is a third party with privileged access to an operational system. It should be assessed as such. That means contractual clauses on remote access methods, credential management, firmware updates, incident notification and response to authority alerts. It also means knowing whether the contractor uses the same access method for many customers, which would turn one weakness into many incidents.

Regulation. For organisations within the scope of European cybersecurity obligations for essential and important entities, the security of systems supporting the service, including supplier relationships, is a management responsibility. Facility controllers that support an essential activity are hard to leave outside that scope.

Reputation. Ahold Delhaize described its problem as an “IT incident”. Customers do not distinguish between IT, OT and facilities. A warm freezer aisle is a visible failure of the brand.

What security leaders should prioritize

1. Name an owner for every facility controller. The executive committee should assign accountability for refrigeration, HVAC and building controllers that support critical activities. The owner may sit in operations or facilities, but must report risk through the same channel as IT assets.

2. Bring facility and installer-managed devices into the asset register. The CISO and the facilities manager should jointly list controllers, their location, vendor, firmware version, remote access method and maintaining contractor. Devices that cannot be updated or are out of support should be flagged for a documented decision.

3. Demand external evidence of exposure. Security teams should check, from the internet side, whether any management interface belonging to the organisation is reachable, and report the result to the board. This addresses the advisory’s request to identify internet-accessible systems.

4. Remove or broker remote access. Operations and IT should disconnect controllers from the internet where possible, remove unnecessary remote access, and route necessary access through a controlled, authenticated path, as the US agencies recommend.

5. Apply the authority’s hardening steps now. Facilities and contractors should update firmware, set Danfoss controllers to the Strict security level, change default passwords and, for compromised Danfoss units, restart or factory-reset them, as CERT-FR advises. The CISO should require written confirmation of each step.

6. Rewrite contractor obligations. Procurement and legal should add clauses covering remote access, credential rotation, update timelines, incident notification and a fixed response time to authority alerts. Existing contracts should be reviewed at renewal or earlier for critical sites.

7. Add tampering scenarios to continuity plans. The business continuity manager should test a multi-site loss of temperature control, including alarm handling, manual monitoring and product protection.

8. Measure alert-to-closure time. The CISO should track how long it takes, after a CERT-FR or equivalent alert, to identify affected assets and reduce exposure. This metric shows the board whether ownership works in practice.

A broader lesson for operational resilience

The refrigeration attacks did not rely on a sophisticated chain. CERT-FR named no CVE. The recommended fixes are firmware updates, stricter settings and changed passwords. What made the campaign effective was the distance between the device and anyone accountable for it.

That distance exists far beyond cold storage. Lighting, access control, building management, lifts and environmental monitoring often follow the same path: bought as a service, maintained by an installer, connected for convenience and forgotten. Each can become a continuity risk the day someone outside the organisation decides to use it.

The response figures show that organisations can move fast when an alert gives them a reason to act. The remaining exposure shows that speed depends on ownership. Boards should not wait for the next alert to find out which category they belong to.

Practical takeaway: Treat facility controllers that support essential activities as business-critical assets. Give each one a named owner, list it in the asset register, require evidence that it is not exposed to the internet, bind its contractor to clear security obligations, and include its failure in continuity plans. Then measure how fast the organisation closes exposure when the next authority alert arrives.