What happened
CERT-FR first issued alert CERTFR-2026-ALE-012 on 12 October 2026 and last updated it on 16 October 2026. The alert says France’s national response team knew of numerous compromises affecting remote refrigeration controllers. On 2 November 2026, refrigeration attacks disrupted retailers across multiple European countries and forced some stores to discard chilled and frozen stock. On 3 November 2026, Reuters reported retailers disconnecting affected refrigeration systems from the internet and accelerating upgrades.
Reuters reported stores in eight European countries, while Euronews and AFP listed nine, indicating that the confirmed geographic count was still changing during the reporting window. Reuters said all 23 affected ICA stores were outside the chain’s centrally managed network; Carrefour reported 15 affected Belgian stores and Coop reported seven affected Swedish stores. The spread across franchise, cooperative and independently managed locations complicates central containment and assurance.
An ICA store reported refrigeration settings raised to 50°C, and AP reported a Greek butcher’s controller set to 150°C before technicians restored control. CERT-FR names Danfoss AK-SC, Danfoss AK-SM, Copeland xweb and Dixell xweb as affected product families. CERT-FR advises removing public internet exposure, checking the entire configuration including defrost schedules, restoring access only through a secure VPN or protected network, updating firmware, setting Danfoss security to Strict and changing default passwords.
Attribution posture: No actor attribution has been established for the refrigeration attacks. Reporting indicates similar operational effects across countries, but the evidence does not yet prove that every incident used the same vulnerability, supplier, infrastructure or operator.
Why this matters now
The new attacks demonstrate operational loss without requiring an enterprise IT outage or data breach. Refrigeration controllers can alter defrost cycles and temperature setpoints while stores, payment systems and corporate networks remain available. Retail, food production, warehousing, hospitality, pharmaceuticals and laboratories should treat connected environmental controls as operational technology with safety, spoilage and continuity consequences.
Ownership fragmentation is central to the exposure. Reuters reported that affected ICA stores sat outside the centrally managed network, while other retailers described independently operated stores and external refrigeration providers. A corporate vulnerability-management programme cannot close risk it cannot inventory, reach or contractually direct. Franchise, landlord and maintenance-provider responsibilities must therefore be visible to the same executive resilience process.
The incident also challenges recovery assumptions. Disconnecting a controller may stop remote tampering but can remove supplier telemetry or remote maintenance. Operators need an approved isolation mode, independent temperature measurement and a manual operating procedure that preserves food-safety or process limits while technical remediation proceeds.
The decision for security leaders
Assign one accountable executive owner for connected facilities technology, even where equipment belongs to a franchisee, landlord or maintenance provider. The owner needs authority to demand inventory, isolation, firmware status, secure remote access and continuity evidence across organisational boundaries.
Prioritise exposure reduction over waiting for a universal exploit explanation. A controller with a public management interface, default credentials or unsupported firmware should move into an approved isolation or replacement plan, with operational impact assessed before connectivity is removed.
Require resilience evidence independent of the controller being protected. Temperature alarms, food-safety decisions, manual setpoint recovery and product-disposal authority must continue when remote management, supplier telemetry or central networking is deliberately disconnected.
Evidence of closure
- Asset register links every controller to model, firmware, public exposure and accountable supplier.
- External validation shows no controller management interface reachable directly from the internet.
- Configuration comparison confirms approved defrost schedules, setpoints and alarm thresholds.
- Contractor attestation identifies supported firmware or approved replacement dates for every end-of-life unit.Continuity testing proves independent temperature alarms, manual recovery and product-disposition decisions meet approved food-safety limits.Supplier-access records demonstrate authenticated, time-bounded and.
The Security.io assessment
The materially new fact is geographic and organisational spread. The October event could have been treated as a French controller problem; the November wave shows that the same class of facilities technology can create simultaneous losses across different retailers, suppliers and operating models. That makes asset ownership and remote-service concentration executive resilience questions.
CERT-FR did not publish a CVE, firmware matrix, hash, IP address or domain for the campaign. Counts also differed during the reporting window, and authorities have not established whether all affected stores share one entry path. Security teams should preserve this uncertainty rather than converting similar effects into an unsupported single-campaign conclusion.
The strongest common evidence is architectural: internet-reachable management, legacy or end-of-life equipment, default or weak access controls, and supplier-managed systems outside central networks. The attacks required no confirmed novel technique or AI capability. The consequence came from ordinary remote control over a physical process with insufficient isolation, monitoring and replacement discipline.
Questions for the morning meeting
- Who owns each refrigeration controller: IT, facilities, a franchisee or a contractor?
- Which controllers remain publicly reachable or unsupported?
- Can independent temperature telemetry detect malicious setpoint changes?
- Do continuity plans cover simultaneous refrigeration loss across multiple sites?