Recent attacks on supermarket refrigeration in France and Sweden show how internet-exposed facility controllers can be turned against the physical processes they manage. Continuous exposure management and commissioning assurance give operators a practical way to close the gap across the asset lifecycle.
On the morning of Monday, November 2, 2026, staff at several supermarkets in Sweden arrived to find freezer cases running at plus 50°C. Stock had to be discarded, and at least one store could not open on time while equipment was emptied and reset.
No ransom demand was made and no data was taken. Instead, the attackers changed the operating parameters of the refrigeration systems themselves.
Three weeks earlier, the same pattern affected around 700 supermarkets in France. Together, the two waves show that refrigeration controllers are operational technology (OT) and are now being actively targeted.
What happened
The larger wave took place in France on the night of October 11 to 12, 2026. Temperature setpoints on store refrigeration systems were raised to as high as 50°C, or units were forced into continuous defrost cycles.
Around 700 stores across several national chains were affected. Stock worth millions of euros was destroyed and fires were reported at several sites.
The French incidents have been linked to remote refrigeration management controllers and monitoring platforms from more than one manufacturer. Many of the compromised units were end-of-life and no longer received security updates, while others were supported models that had not been updated.
The Swedish incidents followed on the night of November 1 to 2, 2026. A limited number of stores belonging to two grocery groups were affected, in southern Sweden, Stockholm and further north. Investigations are ongoing, and early indications point to the same class of internet-reachable management platforms.
How the attacks succeeded
No malware was required. The attackers used the controllers’ own supervisory functions, the same interfaces technicians use to adjust temperatures or start defrost cycles.
Independent research published after the incidents identified nearly 13,000 internet-exposed refrigeration management service observations across more than 6,000 public IP addresses worldwide. Four conditions recur across the affected estates.
Direct internet reachability. Management interfaces are published to the internet so service contractors can work remotely.
Weak or missing authentication. Default, shared or absent credentials on web consoles and HMIs.
Outdated firmware. Units run versions with publicly disclosed vulnerabilities, many of them end-of-life and unpatchable.
Unmonitored change. No alerting when a setpoint or defrost schedule changes overnight.
Where all four are present, the effort required of an attacker is low. Researchers noted that little target-specific knowledge was needed, which is consistent with opportunistic scanning rather than a tailored operation. Hacktivist groups have also claimed more than 20 attacks on refrigeration systems since January 2026.
Impact on the wider cold chain
These are cyber-physical attacks. Their objective is interference with a physical process rather than theft of data or extortion, and the consequences are immediate, including destroyed inventory, closed stores, lost sales and, in some cases, fires.
Retail refrigeration sits where facility management, industrial control and food supply meet. It has historically been purchased and maintained as equipment rather than secured as a control system, and its cybersecurity maturity lags behind heavier industrial sectors.
The same controller families and remote service models are used in pharmaceutical storage, hospital cold rooms, food processing and logistics. The exposure therefore extends across the wider cold chain, with direct implications for food safety and public health.
Continuous exposure management as the primary control
The systems attacked in these incidents had been in service for years. The exposure that enabled the attacks accumulated during operation, as contractors opened remote access, firmware moved out of support and temporary firewall rules remained in place.
The attackers located these systems by scanning the internet. Operators need the same visibility, and they need it first. Preemptive Exposure Management (PEM), extended beyond IT to cover OT and facility systems, provides it. PEM operates continuously and from the outside in, across four stages.
Discover. Identify internet-reachable OT management interfaces, HMIs and remote service portals across every site, including those not recorded in an asset register.
Validate. Confirm whether authentication is weak or absent, whether firmware carries known vulnerabilities and whether control functions such as setpoints can be reached.
Prioritize. Rank validated exposures by physical and operational impact, so that a reachable refrigeration controller receives attention ahead of lower-value findings.
Remediate and re-verify. Track each finding to closure and confirm it remains closed, since new exposure can appear whenever a configuration changes.
Periodic security assessments remain valuable, but on their own they cannot keep pace with estates whose configuration changes frequently. Validation needs to be continuous.
Recommended actions for operators
Establish continuous OT exposure visibility. Cover all sites, with exposures validated rather than assumed.
Remove controllers from direct internet access. Place them behind segmented networks. Where a unit cannot be patched, isolation is the primary remaining control.
Control remote access. Route all contractor access through a managed gateway with individual accounts, multi-factor authentication and session logging.
Replace default and shared credentials on every console and HMI.
Monitor control changes. Alert on setpoint and defrost changes outside maintenance windows.
Prepare the response. Treat an unexplained temperature excursion as a potential cyber event, with a runbook covering isolation, manual override and stock decisions.
The role of commissioning assurance
Acceptance testing would not have protected the systems attacked in France and Sweden. They were installed years earlier, and retail refrigeration rarely passes through a formal security gate.
Its value lies in the projects that follow. Many operators will now replace end-of-life controllers across their store estates, and those projects are the right point to prevent the same exposure from being reintroduced.
Cyber Factory Acceptance Testing (FAT) and Cyber Site Acceptance Testing (SAT), aligned with IEC 62443, make cybersecurity a contractual acceptance criterion with independent verification.
Cyber FAT
Cyber SAT
At the manufacturer or integrator
On site, before commissioning
Secure defaults, strong authentication on HMIs and remote interfaces, current firmware with no known vulnerabilities, and logging of setpoint and defrost changes.
No direct internet reachability, correct network zoning, remote access only through controlled channels with MFA, and alerting on abnormal control changes.
Cyber FAT and SAT establish a verified baseline at handover, and continuous exposure management maintains it throughout operation. Together they provide assurance across the full asset lifecycle.
Questions for operators
Leadership and facility teams can use the following questions to assess their current position.
#
Question
Why it matters
1
Do we have a current inventory of every refrigeration and facility controller that can be reached from the internet?
Exposure that is not recorded is not managed.
2
Has each exposed interface been tested to confirm what an attacker could change?
Validation separates real risk from scan noise.
3
Does every contractor connect through a managed gateway with individual accounts and MFA?
Shared vendor access is the most common entry path.
4
Would anyone be alerted if a setpoint changed at three in the morning?
Early alerting limits stock loss.
5
Are Cyber FAT and SAT written into the contract for the next controller replacement?
Defects cost least to correct before handover.
Building digital trust in facility OT
The incidents in France and Sweden show that equipment with a remote management interface can be used to cause physical disruption with limited effort. Refrigeration, HVAC, building management and similar commercial OT require the same lifecycle discipline already applied to industrial control systems.
For existing estates, the immediate priority is continuous discovery and validation of exposed controllers, together with tighter control of contractor access. For new and replacement projects, Cyber FAT and SAT should be included as contractual acceptance criteria. Responsibility for these systems should sit with the teams accountable for OT cybersecurity, not with facility maintenance alone.
Talk to our experts about OT cybersecurity assurance for your facilities and cold chain operations.Talk to our experts
