Refrigeration Controller Security: 8 Actions After the Supermarket Attacks

Refrigeration controller security became a food-safety emergency in France this week. On October 13, 2026, Le Monde reported that attackers had moved beyond the Danfoss systems disrupted a day earlier and manipulated Dixell equipment at additional supermarkets, changing defrost and temperature settings at machine speed.

The incident turns an overlooked facilities interface into an urgent business risk. A remote control path can now affect product safety, store availability, insurance claims, and public trust within hours. If your organization depends on connected refrigeration, the right response is not simply to reset a controller. You need to remove unsafe exposure, verify every operating value, preserve evidence, and restore service through a protected path.

Key Takeaway: Treat every internet-reachable refrigeration controller as an active incident until you prove its configuration, access path, firmware, and temperature history are trustworthy.

Why refrigeration controller security matters now

Le Monde reported on October 13 that stores using Dixell equipment were targeted after several hundred stores with Danfoss technology were disrupted. At one location, monitoring detected an abnormal temperature spike around 4 a.m., allowing staff and specialists to intervene before goods were lost.

The reported changes were not subtle. One refrigeration specialist said attackers changed defrost and regulation settings two or three times per second. A frozen-goods target reportedly moved from minus 22 degrees Celsius to 150 degrees Celsius, while another store said it had to discard refrigerated inventory after the cold chain broke.

This wider product scope changes the defensive question. It is no longer enough to search for one manufacturer or one vulnerability. The common risk is an exposed remote management function that can change a physical process.

France's CERT-FR alert lists affected compromises involving Danfoss AK-SC and AK-SM systems plus Copeland and Dixell Xweb products. The agency warns that campaigns are probably still running and that factory-resetting an exposed, unsupported device is insufficient because it may be compromised again.

Key Stat: The first wave affected several hundred stores. The next wave crossed into other controller brands within roughly 24 hours.

How a controller attack becomes a cold-chain crisis

A refrigeration controller sits between digital commands and physical equipment. It may coordinate compressors, fans, defrost cycles, alarms, temperature limits, schedules, and remote maintenance. Compromise can therefore create a real-world consequence without touching a payment system or office laptop.

The loss can spread through four layers:

1. Product integrity: Food may leave its safe temperature range even if packaging looks normal.
2. Operations: Cases must be emptied, isolated, cleaned, inspected, and restocked.
3. Evidence: The same controller may hold the logs needed to prove what happened.
4. Business continuity: A store may reopen while refrigeration remains offline or disconnected.

The responsibility model is often fragmented. Retailers may buy refrigeration as a managed service, while local specialists install equipment and vendors provide remote support. Security teams may not own the devices, and facilities teams may not see them as networked computing systems.

That gap is why our OT asset inventory guide starts with ownership and operational dependencies. In refrigeration, the inventory must connect each controller to its cases, sensors, network path, service provider, support status, food-safety limits, and recovery procedure.

Common Mistake: Assuming the refrigeration contractor owns the cyber risk. A provider may manage the controller, but the retailer still owns the product, continuity, regulatory, and customer consequences.

Eight refrigeration controller security actions

1. Find every remote management path

Build an immediate list of refrigeration controllers, supervisory gateways, remote monitoring appliances, cellular routers, VPNs, vendor jump hosts, and cloud relays. Include systems managed by local stores or contractors, not only assets visible to corporate IT.

Compare internal records with firewall rules, public IP allocations, DNS, vendor documentation, and passive network observations. Do not aggressively scan fragile equipment unless the manufacturer or qualified specialist confirms it is safe.

Record the manufacturer, model, firmware, physical location, owner, service provider, public exposure, supported status, and recovery contact for each unit. Unknown equipment should enter the incident queue rather than a future inventory project.

2. Remove direct internet exposure

Disconnect public management interfaces or block inbound access at the firewall. CERT-FR recommends restoring remote access only through a secured VPN or protected network. Temporary source-IP filtering can reduce exposure, but it should not become the permanent design.

Coordinate the change with refrigeration specialists because remote telemetry may support alarms, maintenance, or insurance requirements. The goal is to preserve necessary monitoring while eliminating unauthenticated or broadly reachable control.

This follows the same boundary principle as office network segmentation: management functions belong on a restricted path with explicit owners, not on a network any internet user can reach.

3. Verify configuration against a known-good baseline

Review more than the current temperature. Attackers may alter defrost schedules, alarm thresholds, notification destinations, time settings, user accounts, network settings, or maintenance parameters that create delayed effects.

Compare the full configuration with a trusted backup, commissioning record, or manufacturer-approved template. Have a refrigeration professional validate safety-critical values before returning equipment to automatic operation.

If no trusted baseline exists, export and preserve the current configuration before making changes. Then document each corrected value and the person who approved it.

4. Preserve evidence before resetting

Capture available logs, configuration exports, firmware versions, account lists, network flows, firewall events, alert histories, photographs, and temperature records. Record who discovered the event, when product was moved, and which commands or resets were performed.

A factory reset can remove persistence, but it can also destroy evidence. If food safety permits, preserve the affected unit or its storage before resetting it. Coordinate with legal counsel, insurers, authorities, and incident responders when the loss is material.

Evidence supports more than attribution. It helps determine whether the cold chain failed, whether other locations share the same exposure, and whether a restored controller is actually clean.

5. Patch supported systems and retire end-of-life units

For supported products, obtain firmware directly from the manufacturer or approved service channel, verify the release and integrity, and follow the vendor's installation sequence. Change default credentials and enable the strongest available security mode after the update.

Claroty's Danfoss research found internet-exposed management interfaces plus authentication bypass, command injection, and configuration manipulation risks in the AK-SM 800A platform. Danfoss addressed the reported issues in updated firmware.

Unsupported controllers need a dated replacement plan, compensating network controls, and an accountable risk owner. Resetting an end-of-life device while leaving it online simply restarts the compromise clock.

6. Rebuild remote access around identity and least privilege

Give each technician an individual account. Require multifactor authentication at the VPN or access broker, limit access to assigned sites and devices, and disable accounts when a contract or maintenance window ends.

Remote sessions should be logged and, where practical, approved for a defined time window. Separate monitoring from control so a service that only needs temperature telemetry cannot also change defrost schedules.

Our vendor access risk guide explains why shared credentials and permanent tunnels weaken accountability. Refrigeration support should use the same identity, review, and offboarding discipline as any privileged vendor.

7. Add independent temperature and change detection

Do not rely on one compromised controller to report its own condition. Use independent sensors or monitoring paths for critical cases, freezers, warehouses, and high-value inventory. Route alarms to people who can act after hours.

Alert on both physical and digital anomalies:

• rapid or implausible setpoint changes
• repeated defrost commands
• alarm suppression or destination changes
• new users, source addresses, or remote sessions
• configuration changes outside maintenance windows
• disagreement between controller readings and independent sensors

Test escalation with a realistic overnight scenario. Detection matters only if someone receives the alert, knows the affected equipment, can contact the right specialist, and has authority to protect the product.

8. Practice a cold-chain cyber recovery

Create a site-level playbook for isolating the control path, moving or quarantining stock, switching to safe local operation, preserving records, validating configuration, and reconnecting remote services. Include food-safety, facilities, security, store operations, communications, legal, and vendor contacts.

Define who decides whether products remain saleable. Cyber responders should supply technical evidence, but qualified food-safety personnel must make product decisions under applicable rules.

Test backups for controller configurations and supporting servers. The principle in our backup and restore checklist applies here with an extra requirement: the restored process must be both cyber-clean and physically safe.

Pro Tip: Run the exercise after normal business hours. The French incidents show that a 4 a.m. alarm can be the difference between a contained event and a store full of discarded food.

What to require from refrigeration vendors

Retailers should turn the incident lessons into contract requirements. Ask providers to disclose every remote access method, supported product version, subcontractor, shared service, and end-of-life device in scope.

Require evidence for:

• named accounts and multifactor authentication
• protected remote access instead of public management interfaces
• security update and vulnerability-notification timelines
• configuration backups and tested restoration procedures
• after-hours monitoring and escalation
• access logs retained for investigation
• prompt credential revocation at staff or supplier changes
• cooperation with evidence preservation and regulatory reporting

Use the manufacturer's security advisory channel and equivalent services for every deployed brand. A general IT vulnerability feed may not reach the facilities team or local contractor that can actually patch the controller.

Contracts should also state who pays for emergency visits, discarded stock, replacement hardware, specialist analysis, and extended monitoring. Ambiguity during an incident slows containment and encourages each party to assume another owns the decision.

A 24-hour response plan for exposed controllers

In the first four hours, identify internet-reachable equipment, block public access, contact site and service owners, verify temperatures through an independent method, and preserve available logs. Escalate any abnormal setting, unexplained session, or unsupported exposed device as a suspected compromise.

Within 12 hours, validate full configurations, review access records, rotate relevant credentials, check peer locations for the same architecture, and decide which systems require reset, reimaging, firmware updates, or replacement. Keep affected equipment disconnected from unsafe remote paths.

Within 24 hours, establish protected temporary access where operations require it, document product-safety decisions, notify insurers or authorities when appropriate, and assign dated remediation owners. Do not declare recovery because temperatures have returned to normal. Confirm alarms, schedules, accounts, network rules, evidence retention, and independent monitoring too.

Key Takeaway: Recovery is complete only when the physical process is safe, the control path is protected, and the organization can explain what changed.

The lasting lesson from the supermarket attacks

The October attacks show how quickly a niche management interface can become a regional operational problem. The most important detail is not one brand, one bug, or one dramatic temperature value. It is that multiple connected products exposed a similar capability to remote manipulation.

Refrigeration controller security therefore belongs in the same program as identity, segmentation, vulnerability management, incident response, vendor governance, and continuity planning. Facilities technology cannot remain outside the security boundary when it can discard inventory, close stores, and affect food safety.

Start today with the highest-value proof: identify every publicly reachable controller and remove that exposure. Then verify settings, create an independent alarm path, and practice restoration with the people who operate the equipment. A cold chain should fail safe, not fail open to the internet.