A refrigeration controller does not look like critical infrastructure. It may be a small industrial computer in a supermarket’s back room, connected to compressors, fans, temperature sensors and alarm systems.
But if that controller manages the equipment keeping food cold, its failure can become a supply-chain event.
That is the significance of a recent warning from France’s national cybersecurity agency. In an alert first issued October 12 and updated October 16, CERT-FR reported numerous compromises involving remote refrigeration controllers from Danfoss, Copeland and Dixell. The agency said attack campaigns were probably still continuing and advised operators to remove affected systems from direct internet exposure.
The warning does not establish who carried out the attacks, how every system was entered or how many stores were affected. It does establish something more basic: refrigeration systems that can be reached remotely must be managed as operational technology, not as ordinary appliances with a web interface.
The computer behind the freezer
Commercial refrigeration systems are usually arranged in layers. Local field controllers monitor temperature sensors and operate individual equipment such as compressors, cooling fans and defrost heaters. Above them sits a supervisory controller that collects information, displays alarms and allows operators or contractors to change settings across multiple units.
That supervisory layer is the important one. A compromised temperature sensor may provide bad information. A compromised supervisory controller may be able to issue commands to several refrigeration circuits at once.
Claroty’s research on Copeland XWEB Pro controllers describes this architecture in practical terms. The supervisory controller communicates with field devices, often over a serial Modbus connection, while coordinating equipment that controls compressors, evaporators, fans, defrost cycles and lighting.
Remote access is not an accidental feature. Supermarket operators and refrigeration contractors use it to monitor alarms, review temperature histories and troubleshoot equipment without sending technicians to every location. That convenience can reduce maintenance time and help identify equipment problems early.
It also creates a path from an outside network into a system that changes physical conditions.
The attack surface was created by convenience
Security researchers had already demonstrated that the risk was not theoretical. In August, Claroty’s Team82 reported multiple vulnerabilities in the Danfoss AK-SM 800A platform, including an authentication-bypass mechanism, command injection and a way for authenticated users to alter web-server configuration. The company said it identified thousands of publicly accessible management interfaces during its research.
Claroty separately reported 23 vulnerabilities in Copeland XWEB Pro systems, 21 of them classified as high severity. In a physical demonstration, researchers used a compromised supervisory controller to manipulate a connected refrigeration system, including the compressor, cooling fans, defrost cycle and lighting. Copeland addressed the reported vulnerabilities in firmware version 1.13.
Those findings do not prove that the French attacks used the same vulnerabilities. CERT-FR has not publicly identified the precise intrusion method, and it has not said that every affected controller was running the same firmware or had the same configuration.
That distinction matters. A technical demonstration shows what a system can be made to do under specified conditions. It does not establish what happened during a live incident. The evidence supports a narrower but more useful conclusion: exposed supervisory controllers can provide attackers with a direct route to systems that affect temperature-sensitive goods.
Why patching is only the beginning
The instinctive response to a software vulnerability is to install the vendor’s update. That remains necessary. It is not always sufficient.
Danfoss’s security guidance for the AK-SM 800A recommends protected network placement, strong passwords, HTTPS, strict session controls and current software. The company describes the controller as an embedded device intended to operate behind appropriate firewalls and secure networks.
CERT-FR’s response goes further because it distinguishes between an exposed system that is not known to be compromised and one that may already have been accessed. Operators are told to remove internet exposure, verify configuration, restore or reset compromised equipment, reconfigure it, apply firmware updates and return remote access only through a secure VPN or protected network.
That sequence reflects a basic incident-response problem. Updating software may close a known vulnerability. It does not answer whether someone changed the temperature schedules, created an account, altered an alarm threshold, modified network settings or left behind another form of persistence before the update was installed.
A controller that has rebooted is not automatically a trusted controller.
The distinction is familiar in enterprise cybersecurity, but it is less consistently applied to commercial equipment. Organizations often treat refrigeration systems as facilities equipment, while their remote connections are managed by contractors, vendors or a separate information-technology team. Each group may control part of the system without owning the full security outcome.
The end-of-life problem
Older equipment makes this division more difficult. CERT-FR warned that leaving an end-of-life system exposed to the internet creates a very high likelihood of compromise. It also warned that a factory reset alone is insufficient when the device remains unpatched and vulnerable.
This is the practical problem behind many operational-technology incidents. An operator may know that a controller exists but not whether it is still supported, whether its firmware is current, whether it is reachable from a public IP address or whether replacing it would require a lengthy store shutdown.
The device may also contain configuration information that nobody wants to lose. A reset can remove an attacker’s changes, but it can also remove settings that control equipment across the store. Restoring safely therefore requires both technical knowledge and an operating plan for the physical system.
That is why “just reset it” is not a recovery strategy. It is one action inside a recovery process.
Who owns the remote connection?
A supermarket may own the building and the inventory, but several other organizations may be involved in keeping the refrigeration system running:
- A refrigeration contractor may perform remote monitoring and maintenance.
- The equipment manufacturer may provide firmware and technical support.
- An information-technology provider may manage firewalls, VPNs or cellular connections.
- A facilities department may control physical access and emergency procedures.
- A cybersecurity team may be responsible for incident response without knowing the controller exists.
When responsibility is divided this way, every participant may believe another party is handling the most important questions. Are contractor accounts unique to individuals? Are former employees removed promptly? Can access be disabled without losing alarms? Are systems shared across multiple customers? Who retains logs? Who decides whether a controller should be patched, replaced or isolated?
These are not abstract governance questions. They determine whether a store can keep operating when the remote maintenance path must be cut.
The lesson is not that remote access should be eliminated. A permanent disconnection could make maintenance slower and leave operators with less visibility into failing equipment. The lesson is that remote access must be treated as an operational dependency with a failure mode, not as an invisible convenience.
What this means for U.S. operators
The French incident is not evidence that American supermarkets are currently experiencing the same campaign. The U.S. relevance is structural.
Danfoss markets the AK-SM 800A for food-retail and commercial refrigeration applications, and similar supervisory systems are used in cold-storage warehouses, food-processing facilities, institutional kitchens, hospitals, laboratories and pharmaceutical storage. A problem in one controller family can therefore reveal a broader class of risk even when the affected campaign remains geographically limited.
U.S. operators should be able to answer five questions without assembling a special investigation:
- Which refrigeration supervisors and field controllers are connected to a network?
- Which of them are reachable from the public internet?
- Who can access them remotely, and through what path?
- Which firmware and support status does each system have?
- How will the facility maintain safe temperatures if remote access is disabled?
A useful inventory needs more than device names and IP addresses. It should identify ownership, firmware, vendor access, network connections, integrations, supported recovery methods and the operational consequences of isolation.
It should also be reconciled with reality. Equipment changes. Contractors change. Store renovations add connections. Temporary cellular gateways become permanent. A spreadsheet that was accurate at installation can become fiction several years later.
The real security failure is organizational
The recent compromises are easy to describe as a story about old refrigeration equipment. That description is incomplete.
The deeper failure is the assumption that remote access is merely an administrative feature rather than part of the physical operating system. Once a controller can change conditions inside a freezer, warehouse or pharmaceutical refrigerator, its network exposure becomes a safety and continuity question.
Operators need current firmware, protected access paths and strong authentication. They also need a tested manual process, independent temperature verification and a recovery plan that does not assume a device is trustworthy because it has restarted.
The technology worked as designed: a remote system could change physical conditions at a distance. The security failure was treating that distance as protection.
