Refrigeration Cyberattack: What Food Businesses Should Check

Blog post – By Securing Your Biz

A controller can be easy to overlook when the refrigeration contractor handles it. After a reported attack changed settings at French supermarkets, here are the practical questions food and agriculture businesses can put to their own providers.

What happened at French supermarkets?

On October 12, 2026, France's national cyber incident response team, CERT-FR, reported compromises involving remote refrigeration controllers. Its alert initially named Danfoss AK-SM and AK-SC systems; an update the following day added Copeland and Dixell XWEB systems.

Reuters reported that attackers manually changed refrigeration settings at stores operated by several supermarket groups. At least 350 locations were affected, with spoiled food discarded and fires reported to French authorities. Danfoss told Reuters that many affected units were end-of-life or running outdated software.

The incident matters to more than supermarkets. Food processors, cold-storage operators, dairies, meat businesses, agricultural suppliers, and warehouses may also depend on refrigeration that a contractor can manage remotely.

What the incident does—and doesn't—tell us

CERT-FR advised operators to remove affected equipment—and similar equipment using a public IP address—from direct internet exposure. The alert and reporting make outdated and unsupported equipment an urgent issue to check.

They do not establish that every listed product was affected, that one particular vulnerability caused every compromise, or that the same campaign reached U.S. refrigeration systems. Earlier security research on Danfoss equipment described vulnerabilities in a specific product line; that research is relevant background, but it does not prove which route the attackers used in France.

Keep the distinction in view when you assess your own equipment. A visible login page is not proof of compromise, and a system that is not directly exposed may still need a review of its vendor connections, accounts, and software support.

Claroty Team82's research on Danfoss refrigeration controllers

Why remote refrigeration access deserves attention

Remote access can help a technician diagnose an alarm or make an adjustment without traveling to the site. It also means there is a connection, an account, and a person or service responsible for controlling that access.

If someone changes a setpoint, alarm threshold, or defrost schedule, the consequences can reach beyond the controller: staff may have to assess product, stop work, bring in emergency service, or explain a disruption to customers. The exact impact depends on the equipment, the product, and how the site monitors conditions.

Treat this as an operational question shared by the business owner, facilities or operations staff, refrigeration contractor, and IT provider. “The contractor takes care of it” is a useful starting point for responsibility, not evidence of how the system is configured.

Check the controller, its connection, and its support status

Ask your refrigeration provider to walk through the following for each location. Request dated records—an equipment list, configuration export, service ticket, or access review—where they are available. Avoid making an unplanned network or controller change yourself; remote monitoring and alarms may support daily operations.

List each controller's manufacturer, exact model, serial number, location, installed firmware, support status, and responsible service provider.
Ask whether an administrative interface is directly reachable from the public internet. Have the provider explain any public IP address, port forwarding, internet-facing web console, vendor gateway, or remote-support tool in the access path.
Confirm how technicians connect. A protected VPN or properly secured vendor service is different from exposing an administration page directly, but either approach should have a named owner, limited access, and a way to review or remove accounts.
Review the people and accounts with access. Remove unused and former-provider accounts, replace default credentials, and ask about individual accounts, encrypted connections, session controls, and multifactor authentication where the equipment supports them.
Ask the manufacturer or authorized provider which firmware is current and supported for the exact model. Record the recommended update, dependencies, owner, and completion date; plan replacement for equipment that is no longer supported.

Make sure there is a fallback for the physical process

Remote dashboards are not a substitute for a plan employees can use if the controller, connection, alarms, or contractor service is unavailable. Work with people responsible for food safety and refrigeration operations to document who checks temperatures, how often, how readings are recorded, and who decides what to do with affected product.

Ask the provider whether there is a known-good configuration backup and a tested restoration procedure. Confirm how alarms and temperatures will be monitored if remote connectivity is removed, and make sure the business has an independently verified emergency contact for the contractor.

The wider readiness questions are similar for other farm systems: who owns access, who can make changes, and what happens during an outage. Our agriculture guides cover vendor access and remote connections, as well as harvest continuity planning.

If you suspect settings were changed

Protect people, food, and equipment first. Follow your site's food-safety procedures and involve qualified operations and refrigeration personnel. Do not assume that a controller display alone is enough to establish product condition.

If it is safe to do so, note actual temperatures using an independent method and record the time. Photograph or export suspicious settings, alarms, accounts, and timestamps. Preserve available controller, firewall, VPN, and remote-access logs before routine cleanup removes them.

Call the refrigeration contractor using a number already on file, and coordinate with your IT provider, incident-response contact, and insurer as appropriate. Agree how to restrict remote access while retaining necessary operational monitoring. Do not rely on a factory reset alone: first preserve evidence, identify the cause as far as possible, and plan supported updates or replacement before restoring access.

Questions to send your refrigeration provider

A short written request can make it easier to compare answers across locations. Ask for the model and firmware at each site, whether any management interface is directly internet-accessible, how technicians connect, who has accounts, and whether the equipment is still supported.

Then ask what evidence is available: a current access list, recent login or configuration-change records, the last update date, a backed-up known-good configuration, and the tested process for restoring service. Ask who owns each follow-up and when it will be completed.

If the response is “we handle that,” ask what was checked and when. The goal is not to turn the business owner into a refrigeration technician; it is to make sure an accountable person can show how access and recovery are managed.

Where this fits in a business security review

Small food and agriculture businesses often rely on outside providers for refrigeration, irrigation, grain handling, environmental controls, cameras, and other connected equipment. Keeping a list of those systems, their providers, and their access paths is part of knowing how the business would respond to a disruption.

The free Zero-Access Business Exposure Review uses public information to review signals around business domains, email, websites, and internet-facing services. It does not log in to, test, or change refrigeration equipment; public visibility does not establish exploitability or compromise. Internal safeguard verification belongs to a separately agreed review, and controller testing or operational-technology work requires an expressly defined scope and qualified operational support.

Sources

The incident details above reflect the official alert, cited reporting, and vendor guidance available as of October 14, 2026. Product status and recommended software can change; confirm current instructions for your exact equipment with its manufacturer or authorized service provider.

Start with what can be checked safely

The free review covers public business signals only. It does not test or verify refrigeration controllers, internal configurations, or operational technology.

See what the free review covers Read agriculture cybersecurity guidance