Connected refrigeration: how remote settings can break a cold chain

First CERT-FR alert: 12 October 2026. Further European incidents: 2 November. Analysis written on 4 November. CERT-FR reports numerous compromises of remote refrigeration controllers, including Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb. These devices supervise systems preserving food and other sensitive products. A malicious change to their settings can have a physical result: abnormal temperature, defrost cycles, spoiled goods and interrupted operations. Early-November reports from European supermarkets and three French plasma-storage sites show the stakes, while the exact technical relationship among those events remains unproven. (AFP on stores, AP on the French Blood Establishment)

A controller connects software to physical equipment

A refrigeration supervisor receives sensor readings, applies thresholds, schedules defrost periods and allows remote maintenance. An internet-exposed administration interface or compromised vendor access can turn those legitimate functions into an intrusion path. CERT-FR specifically warns about exposed management interfaces and asks operators to inspect defrost ranges. It does not name a single CVE or claim one exploit worked against every listed model.

Administrative access → changed setpoint → refrigeration equipment
          │                    │                    │
    identity/network      configuration log     measured temperature

The attacker need not rewrite firmware or take over each compressor. Once the controller accepts a harmful administrative setting, normal control logic can carry out the damaging command. Conversely, a temperature rise alone does not prove intrusion: sensor, power and network faults must be checked against logs and independent measurements.

How investigators can establish the cause

Correlate three timelines: access to the administration interface, configuration changes, and measured temperatures. A defrost schedule changed shortly before a temperature excursion by an unexpected identity or origin would be a strong lead. Review vendor sessions, shared accounts, default credentials, firmware versions and actual internet exposure. This is an investigative method, not a claim about evidence recovered at every affected site.

CERT-FR recommends removing direct internet exposure, reviewing all settings and restoring administration through a VPN or protected network. IP allowlisting may help immediately but is insufficient on its own. Restarting or resetting an affected device may remove persistence; it cannot fix an exploitable weakness in an obsolete device that is then re-exposed. The alert also calls for firmware updates, strict security mode and replacement of default passwords where applicable. (CERT-FR alert)

What the November incidents add

AFP reported cold-chain disruption at several European retailers on 2 November. Controllers and vendors differed across sites; a common root cause has not been publicly established. The French Blood Establishment, quoted by AP, says temperature and defrost thresholds were changed to abnormal values on 2 November at three plasma-storage sites. Monitoring detected the changes in time, and the organization says no blood product or sample was compromised. The available evidence does not show that all sites shared a controller, password or vulnerability.

Response reaches beyond IT. Operators need an independent temperature reading, protection or relocation of stock, and a documented duration of any thermal excursion before restoring service. A console that again says “normal” does not prove that products stayed within safe conditions during the incident.

Remote maintenance is useful, but access should pass through protected, attributable identities. Changes to setpoints and defrost schedules need monitoring, and physical alarms should still function if central supervision is compromised.

The inventory approach in our forgotten attack surface note also applies to maintenance equipment and remote access. The default-credentials reference can support an authorized configuration review; it does not test devices or establish which credentials caused these incidents.

Sources: CERT-FR alert, AFP report on European stores, AP report on French plasma storage.