Forescout finds thousands of internet-exposed refrigeration controls worldwide

French authorities and incident responders examined cyber incidents involving internet-exposed refrigeration management systems at more than 700 supermarkets across France during October 2026. CERT-FR said the compromises included Danfoss AK-SM and AK-SC systems along with Copeland and Dixell XWEB. Public reporting tied malicious changes to temperature and defrost settings to food losses at affected stores.

Investigators have not confirmed the initial access methods, exploited vulnerabilities, attacker infrastructure, persistence mechanisms, or responsible actors behind the recent French incidents. Internet-exposed refrigeration systems operate in several European countries outside France and face comparable targeting. Those countries share similar exposure patterns with the affected French supermarkets.

Forescout’s Vedere Labs counted 12,976 exposed refrigeration management services reachable over the public internet, spread across 6,017 distinct IP addresses in 99 countries and territories, in research published Oct. 23, 2026. The count serves as a measure of the exposed refrigeration control attack surface. These counts reflect accessible services, not confirmed compromises, since a single IP address can run multiple services and one interface may oversee several downstream systems. The 99-country scope shows the exposure is not confined to one region.

The observations span ten product families, including Copeland/Dixell XWEB, Danfoss StoreView, Copeland Site Supervisor and Carel pCOWeb. Copeland/Dixell XWEB accounted for 7,075 observations, while Danfoss StoreView represented 4,697. The remaining count included 551 Copeland Site Supervisor services, 513 Carel pCOWeb services, and 140 observations spanning six other product groups. That list represents a product inventory of exposed refrigeration controls in use across the food supply chain and other sectors worldwide.

Of the Danfoss StoreView observations, 3,762—80 percent of that total—used firmware older than 4.3.1, which carries CVE-2025-41451 and CVE-2025-41452. The older firmware creates known vulnerability exposure on Danfoss StoreView platforms still in operation across multiple countries. CVE-2025-41451 and CVE-2025-41452 are the vulnerabilities tied to that outdated firmware.

Almost all XWEB pages displayed a password field, yet just 287 of 513 pCOWeb services issued HTTP 401 unauthorized responses. HTTP 401 is an unauthorized response. The Danfoss AK-SM 800 model involved in the French incidents is end-of-life, so no patch exists for it. The results reflect authentication gaps on exposed refrigeration interfaces across the platforms researchers examined.

Remote management lets engineers and third-party maintenance providers monitor and adjust refrigeration equipment without traveling to sites. Vendor deployment documentation supported remote connectivity, which made direct public internet access useful operationally. Operational technology—the hardware and software that monitors and controls physical equipment—was not built to handle direct exposure to the internet.

Some organizations do not have complete visibility into network-connected equipment, particularly when external contractors install and maintain the systems. That gap means operators may not know which contractor-managed devices sit on their networks. Contractor-managed systems can escape the operator’s asset inventory, leaving defenders unsure which devices sit on their networks.

The exposure reaches past supermarkets into agricultural facilities, food processing operations and hospitals. Healthcare, pharmaceuticals, manufacturing and logistics all rely on refrigeration and temperature-control systems. The exposed-system dataset shows the risk is not confined to France or supermarkets; it is a global problem spanning sectors that rely on cold storage, such as agriculture and healthcare. Cold-storage dependence reaches well beyond grocery retail into industries that preserve inventory and support daily operations.

Forescout has tracked more than 20 claimed hacktivist attacks on refrigeration systems since January 2026, with pro-Russian actors Z-Pentest Alliance and NoName057(16) ranking among the most active. The count reflects claims made by the groups rather than independently confirmed compromises. Z-Pentest claimed 10 separate attacks on refrigeration systems on April 26.

Fruit storage facilities, wineries, supermarkets and other agricultural or food processing facilities in Spain, Italy and other European countries were the most common targets.

A Danfoss technical bulletin says hacktivist attacks in 2022 struck 16 supermarkets in Russia and 40 stores in Israel. The vendor cited those incidents as earlier examples of hacktivist refrigeration targeting across multiple countries. Those earlier attacks show the history of this threat.

Attackers can misuse legitimate supervisory functions—remote commands that change settings or trigger equipment actions—without destructive malware, producing physical and financial consequences. Malicious changes can resemble routine activity because the abused management functions are legitimate, giving attackers cover for disruption. The recent French incidents demonstrate that ordinary remote supervisory functions for refrigeration systems can produce physical and financial harm.

Forescout’s guidance calls for taking refrigeration management interfaces off the public internet. The recommendation comes from Forescout’s Vedere Labs research. Forescout’s Vedere Labs issued the recommendation as part of its refrigeration control research.

Asset discovery starts with mapping every public endpoint and its downstream dependencies. Operators should inventory the complete control path, running from public endpoints, firewalls, VPNs and supervisory platforms down to downstream controllers, sites, contractors and accountable owners. The inventory should cover supervisory platforms and downstream controllers alike.

Teams should verify that public-IP assignments, port forwarding rules, NAT configurations and exposed management services still correspond to current operational needs. The review supports exposure reduction by aligning network settings with actual operational requirements. Reviewing port forwarding and NAT rules helps administrators find paths they no longer need.

Teams should route remote maintenance through a secure gateway, replace unsupported systems and patch systems that can be patched. A secure gateway replaces direct internet exposure for maintenance access. Unsupported systems cannot receive patches and should be replaced.

Access controls should remove shared or outdated contractor credentials, require named identities, enforce least privilege, use multifactor authentication and keep session logs. Named identities and session logs make each remote connection attributable to a specific person.

Operators should record which roles are allowed to adjust setpoints—the target temperature or other operating value—initiate defrost cycles, suppress alarms, modify users, enable gateways or override downstream points. Role documentation clarifies who can alter refrigeration parameters and establishes accountability for supervisory changes across the control environment.

Operators should match remote-access sessions to changes in defrost schedules—periodic warming to remove ice buildup—alarms, setpoints, users and network configuration, then investigate anomalies. Monitoring links administrative access to physical parameter changes so irregular activity stands out.

Operators should examine repeated configurations across contractor-managed sites to uncover shared exposure patterns or common access dependencies. Cross-site review helps contractors and operators spot common dependencies across multiple locations.

Forescout says cutting risk rests on secure remote access, IoT/OT-aware network monitoring, clear ownership of each remote connection, validated permissions, auditable changes and independent observation of the physical cooling process. Independent visibility means watching what the cooling equipment actually does, not only what the supervisory interface reports. Validated permissions and auditable changes give defenders a record of who adjusted what and when. Each remote connection should name an owner who answers for it.