Supermarket refrigerators under attack: what to check in your company

Information current as of 9 November 2026.

In several European supermarkets, someone remotely changed the refrigerator settings, raising temperatures and forcing some stores to throw away food. The reports, which began in France in October, spread to other countries, including Italy, in early November. [1]

If your company runs cold rooms or other remotely controlled equipment, there is one check to start with: knowing how your maintenance provider gets into the system and who can use that access.

What we know about the attacks

On 12 October CERT-FR, the French computer emergency response team, reported compromises of Danfoss AK-SM and AK-SC series controllers and of Copeland and Dixell XWEB systems. The alert recommends removing direct exposure to the internet and checking the configuration. [2]

On 5 November US authorities also issued an advisory on the security of refrigeration and cold-chain systems, referenced by the FDA. [3]

On 4 November ANSA reported a claim of responsibility by the pro-Russian groups NoName057(16) and Z-Pentest, spread through a video and Telegram channels that were later deleted. The claim has not been independently verified and attribution of the incidents is not supported by public evidence; the initial access vector has not been confirmed either. [4][5][6]

Z-Pentest also appears in US documents from December 2025, which describe its relationship with Russian military intelligence (GRU) differently. According to the indictment described by the Department of Justice, the CARR group, “also known as Z-Pentest”, was founded, funded and directed by the GRU; the joint advisory by the FBI, CISA and other agencies instead distinguishes Z-Pentest from CARR and describes it as separate from GRU involvement. [7][8]

Advisories help identify priority devices and checks. Establishing how a single intrusion happened, however, requires checks on the system involved: we cannot attribute the same entry point to every incident.

The maintenance provider’s access

Remote control lets a technician read temperatures, receive alarms and intervene without travelling to the store. This connection needs to be managed after installation too.

A controller can stay in service for a long time. In the meantime, the maintenance provider, the authorised technicians and the IT manager may change. You therefore need to check that access still matches the people who should use it and that access no longer needed has been revoked.

The check involves whoever manages the network and whoever knows the equipment. The former needs to know which connections are allowed; the latter must clarify which are needed for support, alarms and operation. A shared decision is needed before changing those connections.

Five checks to agree with your maintenance provider

These are OT devices, that is, computer systems that control physical processes. On running equipment, even a security scan can cause instability: tests, updates and network changes must be planned with service continuity in mind. [9]

1. Map controllers and connections. Start from the inventory and the network configuration. For each device, record the model, software version, owner and access method. Also check any supplier connections that do not go through the office network.
2. Check access from the internet. Agree how to protect panels reachable from outside, for example through a properly configured, up-to-date VPN. Before cutting the data flow to the maintenance provider, check the impact on the service, the contract with the maintenance provider and the terms of the insurance policy: CERT-FR specifically mentions the latter. [2]
3. Review accounts and passwords. Replace factory credentials and revoke unused access. Where possible, give each technician their own account and use multi-factor authentication. If the controller does not support it, consider how to identify individual users on the system that handles remote access. [9][10]
4. Check manufacturer support. Find out which updates are available and how to install them safely. For devices that are out of support, agree access restrictions and a replacement plan with the maintenance provider. Restoring factory settings alone leaves the vulnerabilities unresolved. [2][10]
5. Separate networks and keep useful logs. Limit communication between equipment and the office network to what is necessary. Check which access and changes are logged and how to keep logs outside the controller, with controlled access. VPN and firewall logs can also help reconstruct anomalous activity. [9]

Before considering the review complete, have the maintenance provider also check temperature setpoints, defrost cycles and alarms. Checking access alone is not enough: someone may already have changed the equipment settings. [2][10]

NIS2 and the food sector: who needs to check their obligations

Italian Legislative Decree 138/2024 also covers food businesses engaged in wholesale distribution, industrial production and processing. Whether it applies depends on the activities carried out, the size criteria and the exceptions in the decree: retail sales alone are not enough to establish it. [11]

For entities in scope, risk management must also cover access, maintenance, incidents and supplier security. A company that is not directly in scope may still receive contractual security requirements from a customer that is. [12]

How IT Global Consulting can help

IT Global Consulting can work alongside your IT contact and your maintenance provider on network and access: reviewing external connections, designing network separation, setting up log collection and defining incident management procedures. Any work must take into account the needs of the equipment and the manufacturer’s guidance.

Our information security management system is certified to ISO/IEC 27001:2022. Find out more about our cyber security services for businesses and our technical and organisational support for NIS2. Let’s talk about your project.

Sources

1. Euronews, “Attacco cyber ai frigoriferi dei supermercati in almeno nove Paesi europei” (in Italian), 3 November 2026.
2. CERT-FR, alert CERTFR-2026-ALE-012 (in French), published 12 October and updated 16 October 2026.
3. FDA, “Important Information Regarding Cybersecurity Resiliency”, referring to the US advisory of 5 November 2026.
4. ANSA, claim reported by Tg1 (in Italian), 4 November 2026.
5. Unit 42 (Palo Alto Networks), “Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System”, 6 November 2026.
6. SentinelLABS, “Defrost and Disrupt | An Assessment of Europe’s Refrigeration Attacks”, November 2026.
7. US Department of Justice, press release on actions against CARR and NoName057(16), 9 December 2025, updated 22 July 2026.
8. FBI, CISA, NSA and partners, joint advisory AA25-343A, 9 December 2025.
9. NIST, “Guide to Operational Technology (OT) Security”, SP 800-82 Rev. 3, September 2023. On caution with active scanning: Appendix E.2.3.
10. Copeland Controls, security bulletin on XWEB systems (in French), 14 October 2026.
11. Italian Legislative Decree 138/2024 (in Italian): Article 3, scope, and Annex II, point 4, food sector.
12. Italian Legislative Decree 138/2024, Article 24, cybersecurity risk-management measures and supply chain security (in Italian).