Cold Chain, Open Control: Exposed Refrigeration Systems Reveal Global Risk

In October 2026, French authorities and incident responders investigated cyber incidents affecting internet-exposed refrigeration management systems across more than 700 supermarkets in the country.

CERT-FR confirmed that compromises involved Danfoss AK-SM and AK-SC systems, as well as Copeland and Dixell XWEB. Public reporting described malicious changes to temperature and defrost controls which caused food losses at affected stores.

The reported manipulation – including rapid successive configuration changes suggestive of automation – involved ordinary supervisory functions. Initial access methods, exploited vulnerabilities, attacker infrastructure, persistence mechanism, and responsible actors in those incidents remain unconfirmed, but a high-level overview of the attack steps is shown below.

This type of attack is not new, even if the scale was much bigger this time. In October 2025, Danfoss published a technical bulletin describing hacktivist attacks that occurred in 2022 and affected 16 Russian supermarkets and 40 Israeli stores using AK-SM 800 devices. According to the bulletin, the Israeli installations lacked adequate firewall or VPN protection.

Since January 2026, our tracking of hacktivist groups identified over 20 claimed attacks against refrigeration systems. The most active actors behind these attacks were pro-Russian groups Z-Pentest Alliance and NoName057(16). The most common targets were fruit storage facilities, wineries, supermarkets, and other agricultural or food processing facilities in Spain, Italy, and other European countries. The most common attack methods were changing temperature and defrost settings via internet-exposed human machine interfaces (HMI). On a single day, April 26, Z-Pentest claimed 10 separate attacks.

This history of recurring threats and the recent exploitation of multiple product families point to a broader risk for remotely operated refrigeration supervisory equipment that goes beyond refrigeration in food retailers to include cooling equipment used in hospitals, agricultural facilities, and others.

To measure the broader attack surface, we analyzed data about internet-exposed assets containing 12,976 service observations across ten product groups and 6,017 distinct public IP addresses in 99 countries and territories.

The French refrigeration attacks demonstrated how legitimate supervisory functions could be used to cause serious physical impact. Our analysis of global internet-exposure data shows that management interfaces for refrigeration systems remain publicly discoverable across multiple manufacturers and countries enabling at least two attack paths:

• Known authentication or code execution vulnerabilities, as documented in vendor advisories.
• Stolen or shared maintainer credentials, since third parties routinely maintain this type of system and shared remote maintenance may span several locations.

These paths can lead to opportunistic exploitation, deliberate disruption and preparation for extortion. Therefore, we share risk mitigation recommendations for organizations that rely on these systems for their daily operations.

Global Exposure of Refrigeration Systems

We identified 10 product families commonly used in refrigeration systems and queried their internet exposure using the Shodan search engine. Some of those products – such as CAREL pCOWeb, CAREL boss and Copeland Site Supervisor – support HVAC and other automation applications in addition to refrigeration.

The results show 12,976 service observations across 6,017 distinct public IP addresses. Service and IP counts are separated because each IP address may present the same interface on several ports and one management interface may represent multiple downstream systems.

The figures below show the distribution of exposed systems per product and geography. The systems recently attacked are by far the most prevalent. Internet-exposed refrigeration systems are popular in several European countries beyond France, which could become the next targets of similar attacks.

These exposed systems reveal two possible attack paths:

• Missing or weak authentication. While nearly every XWEB page included a password field, only 287 of 513 pCOWeb services returned HTTP 401 (‘unauthorized’) responses. Even in the cases where authentication is required, the required credentials may be weak or purchased from other attackers, as shown in the image below from our hacktivist tracking.
  
• Known vulnerabilities. Several of the identified product families have a history of known vulnerabilities, including critical issues discovered as recently as 2025 and 2026. Additionally, some models are end-of-life and cannot be patched, including the Danfoss AK-SM 800 targeted in France. The table below summarizes the known issues for the products we saw exposed. We could not confirm what vulnerabilities applies to each exposed service because firmware versions are not always shown. However, specifically for Danfoss AK-SM 800A, we could see that 3,762 StoreView service observations (80% of the total) run firmware older than 4.3.1, which is affected by CVE-2025-41451 and CVE-2025-41452.

 

The Need for Remote Access and An Effective Security Boundary

Publicly reachable refrigeration systems are not necessarily due to accidental customer configuration. Manufacturer documentation shows that internet connectivity was a supported option for installation, diagnostics, and maintenance for some devices:

• Danfoss AK-SM 800 installation documentation describes configuring routers to accept incoming connections and using port forwarding for WAN access with HTTP port 80 identified as the default. Danfoss AK-SM 800A documentation also describes backward-compatible session support for older third-party XML connections, illustrating how legacy integration may remain embedded in the service model.
• Copeland/Dixell XWEB documentation similarly describes obtaining a public static IP address, configuring router network address translation, and enabling remote access to management services. XWEB Pro documentation identifies HTTPS on port 443 and SSH on port 22, while documentation for earlier XWEB products describes HTTP access and router NAT configuration.

These options address a practical operational requirement. Remote connectivity allows refrigeration contractors to diagnose faults, perform authorized configuration work, and support equipment without dispatching technicians to every store.

Unfortunately, this operating model often makes security ownership unclear. A contractor may manage the refrigeration platform, a facilities team may own the equipment, and an IT or network team may manage the remote connection. Unless responsibilities are explicitly assigned, no single party may have complete visibility into the exposed service, network path, contractor identities, and underlying controller lifecycle.

When this kind of access reaches systems capable of changing defrost schedules, temperature setpoints, and alarms, a maintenance connection can also become a path to physical disruption. Beyond setpoints and schedules, some of these devices – such as CAREL pCOWeb and XWEB Pro – expose other variables that can be read and written using Modbus in the case of XWEB Pro.

Validating an effective security boundary then requires three separate checks:

• Who can gain access to a device
• What the assigned role can change
• Whether the resulting action can be audited

A supervisor may retain temperature data without identifying the account behind a change or a remote-access gateway may record a session without recording the modified setpoint. Effective security depends on correlating access sessions, controller changes, alarms, and independent process measurements.

Recommended Mitigation

The recent attacks in France demonstrate how ordinary refrigeration supervisory functions available for remote operation can be used to create physical and financial consequences.

The dataset of exposed systems shows that this risk is not contained to France or supermarkets. It is a global problem for several industries that rely on cold storage, including agriculture and healthcare.

The obvious immediate recommendations are to remove these management interfaces from the public internet, patch devices that can be patched, and replace those that can’t.

However, these steps are not as easy as they sound. Remote connectivity is operationally valuable, so much so that it was supported in manufacturer deployment documentation.

Moreover, because the exploited management functions are legitimate, malicious changes can resemble routine activity and provide cover for disruption.

Reducing risk requires more than patching, it requires enabling secure remote access and IoT/OT-aware network monitoring. Operators need explicit ownership of remote access, validated permissions, auditable changes, and independent visibility into the physical process.

This can be achieved with the step-by-step recommendations below:

1. Inventory the complete control path in your network: public endpoints, firewalls or routers, VPNs or gateways, supervisory platforms, downstream controllers, sites, contractors and accountable owners.
2. Review public-IP assignments, port-forwarding rules, NAT configurations and internet-accessible management services against current operational requirements.
3. Remove direct public access to refrigeration management interfaces. Restore remote maintenance through a secure remote access gateway.
4. Replace unsupported supervisory systems and patch those that can be patched.
5. Eliminate shared or stale contractor credentials. Require named identities, multifactor authentication, least privilege, and session logging.
6. Document which roles can change setpoints, initiate defrost, suppress alarms, modify users, enable gateways, or override downstream points.
7. Correlate remote-access sessions with changes to defrost schedules, alarms, setpoints, users and network configuration detected via network monitoring, and investigate those that seem anomalous.
8. Review repeated configurations across contractor-managed sites to identify shared exposure patterns or common access dependencies.