A Forescout investigation uncovered 12,976 internet-exposed refrigeration services across 99 countries. The risks go far beyond cybersecurity, potentially threatening food supplies, pharmaceuticals, and critical infrastructure.
Imagine walking into a supermarket only to discover that every refrigerated product must be thrown away.
Not because of a power outage or equipment failure, but because someone halfway around the world decided to change the refrigerators’ temperature settings.
Sounds like a Hollywood thriller? That’s essentially what happened to more than 700 supermarkets in France in October 2026.
Attackers manipulated temperature controls and defrost settings, causing food losses. France’s CERT-FR confirmed incidents involving Danfoss, Copeland, and Dixell equipment, although the attackers’ identities and exact access methods remain unknown.
And the incidents in France may be just the tip of the iceberg.
Nearly 13,000 Refrigeration Services Exposed to the Internet
Researchers at Forescout’s Vedere Labs identified 12,976 internet-accessible refrigeration services associated with 6,017 public IP addresses across 99 countries and territories.
The discovery was made using Shodan, a search engine that identifies internet-connected devices and services.
One important distinction: these figures represent exposed services, not necessarily individual refrigeration units. A single IP address can host multiple management interfaces.
Still, the findings are concerning.
We’re talking about systems responsible for preserving food, storing temperature-sensitive medications, and keeping industrial processes operating safely.
And apparently, some of that infrastructure is far more accessible than it should be.
Which Refrigeration Systems Are Most Exposed?
Copeland/Dixell XWEB systems accounted for the largest share, with 7,075 exposed services.
Danfoss StoreView followed with 4,697, while Copeland Site Supervisor accounted for 551 and Carel pCOWeb for 513. Another 140 exposures involved other systems.
One particularly troubling finding: approximately 80% of the observed Danfoss StoreView services were running older firmware versions potentially affected by known security vulnerabilities.
In August 2025, Danfoss disclosed two vulnerabilities affecting AK-SM 8xxA controllers running firmware versions earlier than 4.3.1.
CVE-2025-41451 could allow remote code execution, while CVE-2025-41452 could cause a denial of service.
Both vulnerabilities require authentication to exploit. That means an exposed device isn’t automatically accessible to every attacker.
But leaving critical industrial systems directly connected to the public internet certainly doesn’t make things safer.
Cyberattacks Show the Threat Is Already Real
According to Forescout, more than 20 attacks targeting refrigeration systems have been claimed since January 2026.
Pro-Russian hacktivist groups, including Z-Pentest Alliance and NoName057(16), were among those making the most claims.
Reported targets included supermarkets, wineries, agricultural facilities, and food-processing businesses across Europe.
On April 26 alone, Z-Pentest claimed responsibility for ten attacks.
And this isn’t an entirely new threat.
A Danfoss technical bulletin published in 2025 referenced earlier incidents from 2022 involving 16 Russian supermarkets and 40 Israeli establishments.
The most alarming part? Attackers don’t necessarily need sophisticated destructive malware.
Depending on the access they obtain, they can simply use legitimate equipment controls to change temperatures or defrost cycles.
The consequences can include financial losses, operational disruptions, and spoiled inventory.
Could Hospital Refrigeration Systems Be Next?
Now imagine the same scenario inside a hospital.
Vaccines, medications, laboratory samples, and other sensitive medical supplies depend on carefully controlled storage temperatures.
Unauthorized changes could compromise those materials and potentially affect patient care.
The Forescout investigation did not identify confirmed attacks against hospital refrigeration equipment. However, researchers warned about the potential physical and financial consequences of such incidents.
Third-party maintenance providers introduce another concern.
Shared credentials, stolen passwords, and exposed administrative interfaces can turn routine remote maintenance access into an entry point for cybercriminals.
A system designed for convenience can quickly become a security liability.
How to Protect Internet-Connected Refrigeration Systems
The researchers’ recommendations start with a fundamental security principle: keep administrative interfaces off the public internet whenever possible.
Remote access should rely on secure connections, multifactor authentication, and individual accounts for technicians and service providers.
Firmware updates, configuration monitoring, and alerts for suspicious activity are equally important.
Organizations should also identify which refrigeration controllers are externally accessible and assess the potential consequences of unauthorized changes.
Because discovering a cybersecurity weakness after losing tons of food or temperature-sensitive medications isn’t exactly an effective risk-management strategy.
Why Refrigeration Cybersecurity Matters
The findings highlight how cybersecurity has evolved beyond protecting computers, websites, and traditional servers.
When physical equipment depends on connected control systems, a digital intrusion can quickly become a real-world emergency.
An attacker doesn’t have to steal customer data to cause serious damage. Sometimes, changing a temperature setting is enough.
For supermarkets, pharmaceutical companies, hospitals, and food manufacturers, protecting refrigeration infrastructure is no longer just an IT responsibility.
It’s a matter of business continuity, operational resilience, and security.
And with nearly 13,000 refrigeration services exposed online, the warning couldn’t be clearer: even the systems keeping our food cold need protection from hackers.
