Cyberattacks affecting more than 700 supermarkets in France in October 2026 involved manipulated refrigeration temperatures and defrost settings, causing food losses. CERT-FR confirmed compromises involving Danfoss AK-SM and AK-SC systems, as well as Copeland and Dixell XWEB equipment. As Hackread.com previously reported, the attackers’ identities and precise method of gaining access remain unconfirmed.
Against this backdrop, cybersecurity researchers at Forescout’s Vedere Labs identified 12,976 internet-exposed refrigeration service observations across 6,017 public IP addresses in 99 countries and territories.
The researchers used Shodan, a search engine for Internet of Things (IoT) devices, to identify exposed services across 10 product groups. The figures represent service observations rather than individual refrigeration systems, as one IP address can expose multiple interfaces or represent several downstream systems.
The report warns that exposed management interfaces and software vulnerabilities can let cybercriminals manipulate refrigeration systems. This indicates a serious risk for industries that depend on temperature-controlled storage such as supermarkets, hospitals, agricultural facilities and pharmaceutical supply chains.
Supermarket Attacks Highlight the Risks
Forescout also tracked more than 20 claimed attacks against refrigeration systems since January 2026, with pro-Russian hacktivist groups Z-Pentest Alliance and NoName057(16) among the most active. Targets included wineries, fruit storage facilities, supermarkets and food-processing sites across Europe.
On April 26 alone, Z-Pentest claimed 10 attacks. The threat predates this year’s incidents. According to a Danfoss technical bulletin published in October 2025, earlier attacks in 2022 affected 16 Russian supermarkets and 40 Israeli stores.
Thousands of Refrigeration Services Exposed Online
Forescout identified the following internet-exposed services, grouped by product family. The company also found that 80% of observed Danfoss StoreView services were running older firmware potentially affected by known vulnerabilities.
The following exposed services were identified:
| Product family | Exposed services |
| Copeland/Dixell XWEB | 7,075 |
| Danfoss StoreView | 4,697 |
| Copeland Site Supervisor | 551 |
| Carel pCOWeb | 513 |
| Other systems | 140 |
Forescout also found that 80% of observed Danfoss StoreView services were running older firmware potentially affected by known vulnerabilities.
Danfoss’ August 2025 advisories described two vulnerabilities affecting AK-SM 8xxA systems running versions before 4.3.1. CVE-2025-41451 could allow remote code execution through command injection, while CVE-2025-41452 could cause a denial-of-service condition through web interface configuration changes.
Both require authentication before exploitation but highlight the risks posed by vulnerable refrigeration management equipment.
Hospitals Could Face Similar Refrigeration Risks
The attacks in France show how changing refrigeration settings can cause real-world losses without deploying destructive malware. In hospitals, similar interference could spoil vaccines, medicines and other temperature-sensitive supplies.
Forescout warned that attacks on these systems can have “physical and financial consequences” even when attackers use legitimate control functions rather than destructive malware. Its research does not report confirmed attacks on hospital refrigeration networks, but the number of exposed systems raises questions about how well these devices are protected.
Many refrigeration systems can be accessed remotely for maintenance, sometimes by third-party contractors responsible for several sites. Forescout warned that stolen or shared contractor credentials could put these systems at risk, particularly when their management interfaces are exposed online. An attacker with access could alter temperatures or defrost settings without deploying malware.
Forescout recommends restricting direct internet access, securing remote connections, giving contractors individual accounts with multifactor authentication, patching vulnerable systems and monitoring unusual changes to settings or alarms.
Experts Warn of Risks to Hospitals and Critical Infrastructure
Damon Small, board member at Xcape Inc., shared with Hackread.com his concerns about the potential impact on healthcare facilities.
“Unprotected refrigeration controllers represent an immediate threat to clinical operations and patient safety, where even slight temperature variations can spoil irreplaceable lab specimens, degrade critical pharmaceuticals, and interrupt acute care,” Small said.
He warned that attackers could manipulate refrigeration settings without triggering physical alarms in time, adding that security teams must treat environmental controls as critical operational assets.
“If an industrial chiller is easier to access from the Internet than your patient portal, your security architecture has melted,” Small added.
Seemant Sehgal, founder and CEO of BreachLock, also shared his perspective with Hackread.com, pointing to recent incidents involving refrigeration and cold-chain operations.
“Nearly 13,000 refrigeration systems reachable from the public internet across 99 countries is the picture underneath incidents the industry has already seen this year,” Sehgal said.
He warned that hospitals should check which refrigeration units are accessible online, whether their software is up to date, and what happens if temperature controls stop responding outside normal working hours.
“A pentest of the refrigeration environment, specifically what an attacker could reach and change from the controllers themselves, is the right way to answer those questions before someone else answers them during an incident,” Sehgal added.
(Photo by Jude Ballado by Pexels)
