When hackers target the cold chain: five defences for connected refrigeration

The first sign of a cyber incident might not be a locked laptop. It could be a freezer alarm, an unexpected temperature change or a refrigeration dashboard that suddenly stops responding. For a shop, supermarket or cold-storage business, that can quickly become a stock, food-safety and continuity problem.

The cold chain is the temperature-controlled storage and movement of products. Connected refrigeration makes it easier for staff and contractors to monitor equipment remotely, but it also creates access that needs protecting. This guide is for business owners, operations managers and IT teams working with refrigeration suppliers — you do not need to be a controller specialist to ask the right questions.

What has happened — and what remains unknown

Associated Press reporting on the events of 2 November 2026 described apparent cyberattacks affecting supermarket refrigeration in Sweden, Belgium, Luxembourg, Ireland and Estonia. In Ireland, Musgrave said systems at 13 SuperValu stores were affected and chilled and frozen products were removed from sale as a precaution. These reports followed incidents in French supermarkets in October. See the Associated Press report.

There is also official confirmation of compromised equipment. France’s national cyber response team, CERT-FR, issued an alert on 12 October, updated on 16 October, identifying compromises involving Danfoss AK-SM and AK-SC controllers and Copeland/Dixell XWEB systems. The CERT-FR alert provides protection and recovery recommendations.

These reports do not establish that the same people caused every incident, or that every affected system was accessed in the same way. Avoid turning claims about motives, attribution or a particular vulnerability into confirmed facts.

Why refrigeration belongs in your security plan

Refrigeration management systems can control temperature targets, operating and defrost schedules, alarms and user permissions. They are operational technology, or OT: systems that monitor or control physical equipment. An unauthorised change can have a physical consequence, not just an effect on business data.

In research published in August 2026, Claroty’s Team82 documented authentication and software vulnerabilities in the Danfoss AK-SM 800A platform, addressed by Danfoss through firmware updates. That research demonstrates possible attack routes; it does not establish how each reported supermarket incident happened. Ask your supplier to check the exact model and current manufacturer advisory rather than assuming every controller has the same issue. See Claroty’s original research.

Start here: five questions to ask this week

1. Can anyone reach our controller directly from the internet? Ask for a verified answer, not “it should be behind the router”.
2. Which devices still receive security fixes? Know each model, software version, support status and responsible supplier.
3. Who can change the settings? Check staff accounts, supplier access and multi-factor authentication at the remote-access gateway.
4. Would we notice an unexpected change overnight? Test the alarm route and the backup contact.
5. Can we recover without losing safe operation? Agree isolation, configuration recovery and stock decisions before an emergency.

1. Remove direct internet access and separate the networks

Ask your IT provider and refrigeration contractor to confirm whether any controller or management interface is directly reachable from the public internet. Include router port-forwarding rules, supplier gateways and any separate mobile connection. Arrange authorised exposure checks with the provider; do not experiment on live refrigeration systems.

Remove direct public exposure and provide necessary remote access through a properly secured, maintained gateway or VPN. A VPN provides a protected network connection, but still needs updates, strong authentication and access restrictions. CERT-FR recommends restoring access only through a secure VPN or protected network. Agree the change with operations and the contractor so that cooling, alarm delivery and essential supplier monitoring remain accounted for.

Put refrigeration equipment on a dedicated network, separated from office computers, payment systems and guest Wi-Fi. Enforce firewall rules that allow only necessary communications, then have your provider verify the restrictions. A network label or separate Wi-Fi name is not proof of separation. Copeland’s XWEB security bulletin (PDF) specifically recommends a dedicated network segment.

2. Update controllers and plan for unsupported equipment

Build an inventory with the controller model, installed software or firmware version, support status, site, operational purpose and responsible supplier. Include the management system and remote-access equipment, not just the individual refrigeration units. Use the inventory to identify missing updates and agree a replacement timetable.

Copeland’s October bulletin states that XWEB EVO has reached end of service and no longer receives security patches. It recommends moving to a supported platform, while making clear that the replacement must not be exposed directly to the internet either. Working equipment is not necessarily supported equipment.

• Obtain the correct update and instructions from the manufacturer or authorised supplier; do not install firmware intended for a different model.
• Back up the relevant controller configuration and operating parameters before an approved change. Confirm what the export includes: a supervisor backup may not include device settings or historical records.
• Agree a maintenance window, rollback or recovery procedure, on-site support and checks for cooling, defrost schedules and alarms afterwards.
• Where replacement takes time, restrict connectivity, strengthen monitoring and record the residual risk with an owner and replacement deadline. These controls reduce exposure; they do not make an unsupported device patched.

The NCSC’s guidance on limiting OT exposure explains how network separation, restricted access and monitoring can help manage older systems while replacement is arranged.

3. Secure every supplier and administrator login

Replace default passwords, give each person an identifiable account where supported and grant only the permissions needed for their work. Remove access when someone leaves or a maintenance contract ends. Avoid a shared administrator login that nobody can confidently account for.

Require multi-factor authentication for remote access, preferably using phishing-resistant methods such as security keys where supported. If the controller cannot support MFA, enforce it at the secure remote-access gateway and ensure that there is no direct route around it. A password on the controller alone does not protect an exposed or vulnerable management interface.

• Agree named supplier contacts, access approval and an emergency support route.
• Enable contractor access only when needed wherever practical, and review permissions after the work.
• Keep approved records of supplier sessions and configuration changes, with reliable timestamps.
• Document any unavoidable shared or emergency access, restrict who can use it and arrange review or credential changes after use.

Make these expectations part of routine servicing and supplier agreements, not just the incident plan. The NCSC’s OT access-control guidance covers MFA, limited permissions and identifiable user activity.

4. Monitor temperatures, setting changes and unexpected access

Learn what normal operation looks like and investigate changes that do not match approved work. Useful signals include unusual logins, altered temperature targets, changed defrost schedules, new administrator accounts and disabled or redirected alarms. A temperature problem is not automatically a cyberattack — equipment faults, sensors, power and maintenance can also be involved.

Test that an alarm reaches the responsible person, including outside opening hours. Check the recipient list, escalation route and fallback if the first person does not answer. Copeland specifically recommends checking notification settings and triggering a test alarm; plan that test with the contractor so that it does not create unsafe operating conditions.

The NCSC’s monitoring guidance recommends detecting unauthorised activity and departures from normal behaviour. For product handling, follow your food-safety plan, manufacturer requirements and applicable local rules. The government’s chilling and freezing guidance is a useful starting point for food businesses; a cyber checklist is not a stock-release decision.

5. Rehearse safe isolation and recovery

Agree who can restrict remote access, who will attend the site and how refrigeration will keep operating during an incident. Include operations, IT and the refrigeration contractor in the plan. Keep a contact list available even if the normal email account or online dashboard cannot be used.

Maintain protected backups of controller configurations and operating parameters, keep copies separate from the equipment and test recovery safely. Confirm which backup predates suspected unauthorised changes; restoring the latest copy is not helpful if it contains altered settings. NIST’s OT Backup Quick Start Guide emphasises regular backups, testing and recovery exercises.

Follow the manufacturer’s recovery procedure for the exact model. Have qualified staff verify accounts, connectivity, temperature targets, defrost schedules, alarms and actual temperatures before approving normal service. CERT-FR warns that a factory reset alone is insufficient if a device remains exposed and vulnerable: it may be compromised again.

Practise your isolation arrangements alongside business continuity and supplier dependencies. The NCSC’s isolation-planning guidance explains why these arrangements should be tested, not just written down.

If you suspect an incident: what to do first

1. Protect people and products. Activate your operational and food-safety procedures. Hold affected stock from sale or use where required by those procedures while qualified staff assess it.
2. Bring the right people together. Name a coordinator and contact operations, the refrigeration contractor, IT and your insurer as applicable through trusted routes.
3. Check the physical situation. Record independent temperature readings, affected units, times and observed symptoms. Do not assume every unit or site is affected.
4. Limit further unauthorised access safely. Have authorised staff agree targeted restrictions while maintaining safe local operation and accounting for alarm delivery.
5. Keep evidence where safe. Preserve available access logs, configuration changes, alarms and supplier-session records with timestamps. Do not delay urgent safety action to collect perfect evidence.
6. Recover with approval. Follow model-specific guidance, remove the access route or underlying weakness and verify safe operation. Let the responsible food-safety lead decide the status of products; restored cooling does not establish that previously affected stock is safe.

Avoid intrusive scans, ad hoc security agents or unapproved commands on live controllers. Tools suitable for an office laptop can disrupt operational equipment. Have the supplier and an OT-qualified responder agree any technical investigation.

Try a short exercise with your team

Discuss this scenario without changing live equipment: at 02:00 an alarm reports a rising temperature. The dashboard still shows normal operation, the usual contractor cannot be reached and a supplier account has signed in unexpectedly. These are clues to investigate, not proof of an attack. What would each person do?

A practical first step for your business

Bring your IT provider, refrigeration contractor and operations lead together. Ask them to demonstrate which systems are exposed, which still receive security updates, who can change their settings and what happens when an alarm arrives overnight. Assign an owner and deadline to every gap. You do not need to solve everything in one meeting, but you do need clear responsibility.

Use the KoshCyber resources below to structure an incident record, find general response guidance or practise decisions with your team. They complement specialist refrigeration and OT support; they do not replace manufacturer procedures or food-safety expertise.