Cybersecurity experts at Forescout have raised alarm over the significant risks associated with exposed refrigeration control systems, highlighting the vulnerabilities within operational technology (OT) that could severely impact food supply chains, business continuity, and other operations reliant on precise temperature regulation. This warning surfaces in the wake of cyberattacks targeting French supermarkets in October 2026, which allegedly compromised refrigeration systems across hundreds of outlets. The attackers successfully disrupted cooling operations, leading to irregular temperature fluctuations and significant spoilage of perishable stocks, spotlighting the widespread implications of cybersecurity weaknesses in this critical sector.
The recent incidents have intensified scrutiny of the security protocols governing internet-connected refrigeration equipment, especially concerning older systems that may have inadequate management interfaces and access controls. Such vulnerabilities expose operational technology to potentially malicious interference, challenging the integrity of not just refrigerated retail outlets, but also various essential sectors, including healthcare and pharmaceuticals, where precise temperature management is paramount.
### The Real-World Implications of Cyberattacks
Unlike traditional IT attacks, which predominantly focus on the theft of data or the disruption of digital services, incursions targeting refrigeration controllers represent a unique threat by directly influencing physical processes. These controllers are essential for maintaining the correct temperatures in supermarkets, food storage facilities, and similar environments, making their security vital.
If cyber adversaries gain unauthorized access, they can potentially alter temperature settings, disrupt defrost cycles, or interfere with equipment operations entirely. The ramifications of such actions extend beyond mere IT downtime, leading to compromised food safety, considerable financial loss, and even public health risks—illustrating that the consequences of cyberattacks can manifest in highly tangible ways.
Moreover, the implications do not stop at food retail. Industries ranging from healthcare to pharmaceuticals, manufacturing, and logistics depend heavily on reliable refrigeration and temperature-control systems, underscoring the urgent need for robust security measures in these operational domains.
### Internet Accessibility: A Double-Edged Sword for Operational Technology
A pressing issue identified by Forescout relates to the inherent vulnerabilities introduced by operational technology systems not originally designed for internet exposure. The capability for remote management allows engineers and maintenance providers to manage refrigeration equipment without needing to be physically present. However, this convenience can become a security liability when connections are inadequately safeguarded or improperly configured.
Forescout’s research has pinpointed several critical issues within industrial control systems, including publicly accessible management interfaces, outdated firmware, and weak authentication practices. In many instances, organizations lack complete visibility over the equipment integrated with their networks, particularly when systems are maintained by external contractors, leaving them vulnerable to cyber threats.
### Global Vulnerabilities Highlighted by Research
In their extensive research, Forescout’s Vedere Labs identified a staggering 12,976 instances of internet-exposed refrigeration services distributed across ten distinct product groups, connected to 6,017 unique public IP addresses across 99 countries and territories. These findings indicate that the vulnerabilities illustrated by the attacks on French supermarkets are indicative of a broader, systemic issue on a global scale.
Among these exposed services, the greatest number involved Copeland/Dixell XWEB services, tallying 7,075 recorded instances, followed by 4,697 instances of Danfoss StoreView services. Additionally, researchers noted 551 instances of Copeland Site Supervisor services, 513 Carel pCOWeb services, and 140 instances across six other product categories. Importantly, these figures reflect exposed services rather than conclusively compromised devices, as a single IP address may host multiple services, and one management interface could control several downstream systems.
Notably, many of the Danfoss StoreView services, which constituted 80% of the total observations, were operating on outdated firmware older than version 4.3.1. This raises critical concerns regarding their vulnerability to known security flaws that could be exploited by cybercriminals.
### A History of Cyberattacks on Refrigeration Systems
Forescout’s findings also hint that malicious attacks against refrigeration systems are not an isolated phenomenon. According to a technical bulletin released by Danfoss, there have been hacktivist attacks in 2022 that impacted 16 supermarkets in Russia and 40 stores in Israel. Furthermore, Forescout has tracked over 20 reported cyberattacks on refrigeration systems since January 2026, with pro-Russian hacktivist groups like Z-Pentest Alliance and NoName057(16) reportedly being among the most active offenders. These attacks have targeted various segments, including supermarkets, wineries, fruit storage facilities, and farms across Europe.
However, it is critical to note that while Forescout has documented these trends, the methods of initial access and the identities of the perpetrators behind the recent French supermarket attacks remain unconfirmed.
### Recommendations for Securing Refrigeration Systems
In response to these alarming vulnerabilities, Forescout is advising organizations to reevaluate the manner in which refrigeration management systems interface with the internet and to scrutinize who holds access privileges to these critical systems. Key recommendations encompass eliminating publicly accessible management interfaces, replacing outdated equipment, and ensuring timely security updates are applied.
Furthermore, implementing secure remote access for maintenance providers, adopting multifactor authentication, consolidating user accounts, and instituting continuous monitoring practices can significantly bolster the security posture of these systems. The latter is particularly crucial, as attackers may not always employ malware to disrupt operations; simply misusing legitimate management functions may allow them to mask their activities as routine maintenance.
The salient point raised by this research is the essential need for organizations to maintain visibility over not just connected devices, but also who can access them and the nature of changes they are authorized to execute.
As the IT landscape continues to evolve, operational technology security must be a critical priority, particularly for systems that have physical implications tied to public safety and operational integrity.
For further insights, readers can explore the full research on Forescout’s website.