Cybersecurity researchers at Forescout are drawing attention to the risks posed by exposed refrigeration control systems, warning that weaknesses in operational technology (OT) could have serious consequences for food supplies, business continuity and other temperature-sensitive operations.
The warning comes following cyberattacks against French supermarkets in October 2026, which reportedly disrupted refrigeration systems at hundreds of stores. Attackers were able to interfere with cooling operations, resulting in temperature fluctuations, spoiled stock and significant disruption.
The incidents have raised concerns about the security of internet-connected refrigeration equipment, particularly where older systems, exposed management interfaces and inadequate access controls leave operational technology vulnerable to interference.
When Cyberattacks Have Physical Consequences
Unlike conventional IT attacks, which frequently focus on stealing data or disrupting digital services, attacks against refrigeration controllers can directly affect physical processes.
These systems are responsible for maintaining temperatures across supermarkets, food storage facilities and other environments where consistent cooling is essential.
If attackers gain sufficient access, they may be able to manipulate temperature settings, interfere with defrost cycles or disrupt equipment operations. The consequences can extend beyond IT downtime to include damaged stock, financial losses and potential safety risks.
The issue also extends beyond food retail. Refrigeration and temperature-control systems are used in healthcare, pharmaceuticals, manufacturing and logistics, making their security an important consideration across several industries.
Internet Exposure Creates Opportunities for Attackers
One of the central concerns is the accessibility of operational technology that was not originally designed to withstand direct exposure to the internet.
Remote management capabilities allow engineers and third-party maintenance providers to monitor and adjust refrigeration equipment without visiting individual sites. However, these connections can introduce security weaknesses if they are poorly configured or inadequately protected.
Research into industrial control systems has identified publicly accessible management interfaces, outdated firmware and weak authentication as recurring problems.
In some cases, organisations may not have complete visibility of the equipment connected to their networks, particularly where systems have been installed and maintained by external contractors.
Forescout Finds Nearly 13,000 Exposed Refrigeration Services Worldwide
New research from Forescout’s Vedere Labs has identified 12,976 internet-exposed service observations across ten product groups, associated with 6,017 distinct public IP addresses in 99 countries and territories.
The findings suggest that the weaknesses highlighted by the French supermarket attacks are part of a much wider global problem.
The largest number of observations involved Copeland/Dixell XWEB services, with 7,075 recorded, followed by 4,697 Danfoss StoreView services. Researchers also identified 551 Copeland Site Supervisor services, 513 Carel pCOWeb services and 140 observations across six other product groups.
Importantly, these figures represent exposed services rather than confirmed compromised devices. A single IP address may host multiple services, while one management interface may control several downstream systems.
The researchers also found that 3,762 Danfoss StoreView service observations, representing 80% of the total, were running firmware older than version 4.3.1, making them potentially vulnerable to two previously disclosed security flaws.
Hacktivists Have Targeted Refrigeration Before
Forescout’s research suggests that attacks against refrigeration systems are not a new development.
According to a technical bulletin published by Danfoss, hacktivist attacks in 2022 affected 16 Russian supermarkets and 40 stores in Israel.
Forescout has also tracked more than 20 claimed attacks against refrigeration systems since January 2026, with pro-Russian hacktivist groups Z-Pentest Alliance and NoName057(16) among the most active.
Targets have included supermarkets, wineries, fruit storage facilities and agricultural businesses across Europe.
However, the researchers stress that the initial access methods and identities of those responsible for the recent French attacks have not been confirmed.
Securing the Cold Chain
Forescout is urging organisations to review how refrigeration management systems are connected to the internet and who is authorised to access them.
Recommendations include removing publicly accessible management interfaces, replacing unsupported equipment, applying available security updates and introducing secure remote access for maintenance contractors.
The researchers also recommend multifactor authentication, individual user accounts and continuous monitoring to identify suspicious changes to temperature settings, defrost schedules and alarms.
The challenge is that attackers do not necessarily need to deploy malware to cause disruption. Once they gain sufficient access, they may be able to misuse legitimate management functions, making malicious activity harder to distinguish from routine maintenance.
The research highlights a broader issue for operational technology security: organisations need visibility not only of connected devices, but also of who can access them, what changes they can make and how those changes affect physical operations.
Read the full research here: Cold Chain, Open Control: Exposed Refrigeration Systems Reveal Global Risk
