In this article
If the fridges in your store, restaurant or warehouse are run from a control panel that your maintenance contractor reaches over the internet, ask them one question today: is that panel exposed online? On the night of 11 to 12 October 2026, attackers got into refrigeration controllers at hundreds of European supermarkets and left them in defrost mode for hours, pushing temperatures inside the fridges to around 50°C and spoiling tens of millions in stock. They broke nothing sophisticated: they used management panels left on the internet without updates. The fix is cheap, and you can apply it before you lose your stock.
What exactly happened in France?
The French response centre CERT-FR issued an alert on 12 October 2026, updated on 16 October, reporting numerous compromises of remote controllers for refrigeration systems from 4 products: Copeland XWEB, Dixell XWEB and the Danfoss AK-SC and AK-SM series. According to Facilities Dive, citing Reuters and AFP, the attack hit stores in 6 countries: France, Spain, Portugal, Poland, Germany and Belgium, including about 150 refrigeration units at the Intermarché chain alone.
Danfoss said most affected devices were legacy models such as the AK-SM 800 and AK-SC 355 that no longer receive software or security updates, and that it had long advised customers to update firmware and migrate to current models. In other words, the problem was not the fridge. It was a management box connected to the internet and forgotten for years.
Is this only a European problem?
No. On 22 October 2026 Forescout published an internet scan that found 12,976 exposed refrigeration management services on 6,017 IP addresses in 99 countries and territories. Most were Copeland and Dixell XWEB panels at 7,075, followed by Danfoss StoreView at 4,697. The same equipment is used by retail chains, restaurants, central kitchens, cold stores and pharmacies in Saudi Arabia, and much of it is installed by the HVAC and refrigeration contractor, who leaves a remote port open to follow alarms from a phone.
The report does not give a figure for Saudi Arabia, so we will not guess one. But the installation pattern is the same everywhere: a small box next to the electrical panel, a public IP address, a password shared by the contractor's technicians, and nobody in the business aware it exists.
5 steps to protect your cold stock
- Inventory the controllers: ask your refrigeration contractor for a written list of every controller or supervisory panel in your branches, with model, firmware version and how it is accessed.
- Close direct internet access: this is the first recommendation in the CERT-FR alert and the first in Forescout's list. The management interface should never open from an ordinary browser outside your network.
- Route remote maintenance through a VPN or secure access gateway: with a named account per technician, multi-factor authentication, least privilege and session logs. Delete old shared passwords.
- Patch what can be patched and replace what is out of support: CERT-FR warns that keeping an end-of-life device online makes compromise very likely, and that a factory reset alone is not enough.
- Monitor settings, not just temperature: link any remote session to changes in defrost schedules, setpoints, alarms or users, and send temperature alarms to the branch manager through a channel independent of the controller itself.
What do Saudi controls say?
The National Cybersecurity Authority issued the Operational Technology Cybersecurity Controls OTCC-1:2022 to protect industrial control systems, as an extension of the Essential Cybersecurity Controls. They are mandatory for the organizations in their scope, but their logic is useful for any business with operational devices on its network, refrigeration included: separate the operational network from the internet, control remote access, and manage vulnerabilities and updates.
The Origami view
We read this incident as a reminder that the most dangerous devices in a business are the ones nobody counts as IT. The refrigeration panel is installed by a contractor, paid for by facilities, and missing from the IT asset list, so nobody updates it and nobody watches it.
That is why we advise Saudi retail and food businesses to add an explicit clause to their refrigeration maintenance contract: the device list, the remote access method, who is responsible for updates, and notice of every login. We wrote earlier about updating FortiGate firewalls, and the lesson is the same: an exposed, unpatched device is the first thing an attacker tries.
Conclusion
This week, ask your refrigeration contractor for the device list and access method, confirm the management interface does not open directly from the internet, and make every remote login go through a VPN with a named account. It costs a few hours of work against stock you could lose in a single night. If you want a review of your network-connected devices, contact us or see our services.
Sources
- CERT-FR — CERTFR-2026-ALE-012: Security incident targeting remote controllers of refrigeration installations, 12 October 2026, updated 16 October: affected products and recommendations.
- Forescout Vedere Labs — Cold Chain, Open Control, 22 October 2026: exposure figures and recommendations.
- National Cybersecurity Authority — Operational Technology Cybersecurity Controls OTCC-1:2022.
- Facilities Dive, 13 October 2026: affected countries, Intermarché units, and the Danfoss statement as reported by Reuters and AFP.
Frequently asked questions
How do I know if my store's refrigeration panel is exposed online?
Ask your refrigeration contractor how they reach the panel from outside the store. If they open it in a browser or app on a public IP address without a VPN, it is probably exposed, and your IT team can confirm by scanning the open ports on the branch address.
Is changing the password enough?
No. Most devices hit in France were out of support and had known flaws, and CERT-FR warns that keeping them online makes compromise very likely. Close direct access first, then use a VPN, then update or replace.
Will the fridges stop working if we disconnect the controller from the internet?
No. Cooling runs locally, and the internet is used for monitoring and remote maintenance. After disconnecting, the technician reaches the device through a VPN or secure gateway, so monitoring continues without exposing it.
Are the NCA OTCC controls mandatory for my restaurant or store?
The controls are mandatory for the organizations in their defined scope, not for every store or restaurant. But their principles, separating the operational network, controlling remote access and managing updates, are a practical baseline for any business protecting refrigeration systems.
Follow Origami in Google
Pin Origami as a preferred source and our articles will surface first for you in Google Search and Top Stories.
