Refrigeration Controllers Under Attack: Keep Them Off the Open Internet

If your business keeps food, medicine or other products cold, such as a restaurant, grocery or convenience store, pharmacy, clinic, or cold-storage warehouse, check how your refrigeration controllers are connected. On November 5, 2026, CISA, the FBI and three other U.S. agencies warned that attackers are targeting commercial refrigeration and cold-chain monitoring systems worldwide. On November 9, France said a state-linked group was behind October attacks that changed refrigeration settings at about 700 of its supermarkets.

The short version: refrigeration controllers should not be reachable from the open internet. If your refrigeration contractor needs remote access, it should go through a firewall or VPN, with default passwords changed and firmware up to date.

What is happening

Many commercial refrigeration systems have a small web-based controller that manages temperatures and defrost cycles, and some can be reached over the internet so a service company can monitor them. According to the U.S. fact sheet, attackers are using authentication bypasses, code injection and weak settings on unpatched or internet-reachable controllers to change settings and force units into continuous heating and defrost cycles. The agencies say that can spoil inventory, create a fire hazard, and hide the real temperatures from staff.

In France, the national cybersecurity agency's CERT-FR team reported many compromised controllers from the Danfoss AK-SM and AK-SC series and Copeland and Dixell xweb supervisors after attacks on October 11 and 12. The Associated Press reported that the attacks affected about 700 of the country's 10,000 supermarkets, and that French authorities attributed them to a cyber unit linked to Iran's Revolutionary Guard. CERT-FR warns that attack campaigns against these devices are probably still under way.

Who is at risk

Any business with refrigeration or temperature-monitoring controllers that can be reached from the internet, especially older models that no longer get security updates. CERT-FR says that leaving an unsupported device exposed to the internet carries a very high chance of compromise, and that a factory reset alone will not fix a device that stays exposed.

What to do this week

1. Find your controllers. Ask your refrigeration contractor what controllers and monitoring systems you have, the make and model, and how they connect to the internet.
2. Take them off the open internet. If remote access is needed, put it behind your firewall or a VPN, or at minimum allow only your contractor's IP addresses. CERT-FR suggests checking your service or insurance contract before cutting off remote monitoring.
3. Change default passwords and update firmware. Follow the manufacturer's security guidance, and plan to replace controllers that no longer get updates.
4. Keep them separate from your business network. The agencies recommend a separate network segment (VLAN) for equipment like this.
5. Check the settings and set alerts. Review temperature and defrost settings for anything unexpected, keep safe limits, and set up alerts for temperatures outside the normal range.

Questions to ask your IT provider or refrigeration contractor

1. Can any of our refrigeration or temperature controllers be reached from the internet?
2. How does the contractor connect remotely, and is it limited to them?
3. Are the controllers on current firmware, with default passwords changed?
4. Would we get an alert if a setting or temperature changed unexpectedly overnight?