New research from Forescout’s Vedere Labs identified 12,976 internet-exposed service observations associated with refrigeration control systems across 6,017 distinct public IP addresses in 99 countries and territories, warning that publicly accessible management interfaces could expose cold-chain infrastructure to cyberattacks. Affecting over 700 French supermarkets, where attackers reportedly manipulated refrigeration temperature and defrost controls, resulting in food losses, Forescout Research’s Vedere Labs identified that such attacks can exploit legitimate supervisory functions without destructive malware, creating physical and financial consequences for organizations that depend on refrigeration systems.
“In October 2026, French authorities and incident responders investigated cyber incidents affecting internet-exposed refrigeration management systems across more than 700 supermarkets in the country,” Sai Molige and Vedere Labs wrote in a Thursday blog post. “CERT-FR confirmed that compromises involved Danfoss AK-SM and AK-SC systems, as well as Copeland and Dixell XWEB. Public reporting described malicious changes to temperature and defrost controls which caused food losses at affected stores.”
They added that the reported manipulation, including rapid successive configuration changes suggestive of automation, involved ordinary supervisory functions. Initial access methods, exploited vulnerabilities, attacker infrastructure, persistence mechanisms, and responsible actors in those incidents remain unconfirmed.
Forescout’s analysis identified exposed services across 10 product groups, including Copeland/Dixell XWEB, Danfoss StoreView, Copeland Site Supervisor and Carel pCOWeb platforms. The researchers identified two potential attack paths, such as weak or missing authentication and known vulnerabilities, including issues affecting legacy systems that may no longer receive security updates. This comes as the recently attacked systems are by far the most prevalent. Internet-exposed refrigeration systems are also widely used in several other European countries beyond France, which could become the next targets of similar attacks.
Since January 2026, Forescout tracked over 20 claimed hacktivist attacks against refrigeration systems, with pro-Russian groups Z-Pentest Alliance and NoName057(16) among the most active. “The most common targets were fruit storage facilities, wineries, supermarkets, and other agricultural or food processing facilities in Spain, Italy, and other European countries. The most common attack methods were changing temperature and defrost settings via internet-exposed human machine interfaces (HMI). On a single day, April 26, Z-Pentest claimed 10 separate attacks.
“This history of recurring threats and the recent exploitation of multiple product families point to a broader risk for remotely operated refrigeration supervisory equipment that goes beyond refrigeration in food retailers to include cooling equipment used in hospitals, agricultural facilities, and others,” the post identified. “To measure the broader attack surface, we analyzed data about internet-exposed assets containing 12,976 service observations across ten product groups and 6,017 distinct public IP addresses in 99 countries and territories.”
The exposed systems point to two possible attack paths. The first is missing or weak authentication: while nearly every XWEB page included a password field, only 287 of 513 pCOWeb services returned HTTP 401 (unauthorized) responses. Even where authentication is required, the credentials may be weak or purchased from other attackers, as hacktivist tracking has shown.
The second is known vulnerabilities. Several of the identified product families have a history of flaws, including critical issues discovered as recently as 2025 and 2026, and some models, such as the Danfoss AK-SM 800 targeted in France, are end-of-life and cannot be patched. Because firmware versions are not always shown, the researchers could not confirm which vulnerabilities apply to each exposed service. For the Danfoss AK-SM 800A, however, 3,762 StoreView service observations (80% of the total) run firmware older than 4.3.1, which is affected by CVE-2025-41451 and CVE-2025-41452.
The post recommends removing direct public internet access to refrigeration management interfaces, using secure remote-access gateways, patching or replacing unsupported systems, strengthening contractor authentication and monitoring changes to temperature settings, defrost schedules and alarms. They warned that exposure extends beyond supermarkets to agricultural facilities, food processing operations and hospitals.
The recent attacks in France show how ordinary remote supervisory functions for refrigeration systems can be used to cause physical and financial harm. The dataset of exposed systems shows the risk is not limited to France or supermarkets: it is a global problem affecting many industries that depend on cold storage, including agriculture and healthcare. The obvious immediate steps are to remove management interfaces from the public internet, patch devices that can be patched, and replace those that can’t.
These steps are harder than they sound. Remote connectivity is operationally valuable, so much so that manufacturer deployment documentation supported it. And because the exploited management functions are legitimate, malicious changes can look like routine activity and provide cover for disruption. Reducing risk therefore takes more than patching: it requires secure remote access and IoT/OT-aware network monitoring, with explicit ownership of remote access, validated permissions, auditable changes, and independent visibility into the physical process.
To get there, operators should first inventory the full control path, from public endpoints, firewalls, VPNs, and supervisory platforms to downstream controllers, sites, contractors, and accountable owners, and review public-IP assignments, port forwarding, NAT configurations, and exposed management services against current operational needs. They should remove direct public access to refrigeration management interfaces, restore remote maintenance through a secure gateway, and replace unsupported systems while patching the rest.
Furthermore, access controls should be tightened by eliminating shared or stale contractor credentials, requiring named identities, multifactor authentication, least privilege, and session logging, and by documenting which roles can change setpoints, start defrost, suppress alarms, modify users, enable gateways, or override downstream points. Finally, operators should correlate remote-access sessions with changes to defrost schedules, alarms, setpoints, users, and network configuration, investigate anomalies, and review repeated configurations across contractor-managed sites to find shared exposure patterns or common access dependencies.
