The Growing Risk of Connected Operational Technology

Connected operational technology (OT) becomes a business risk when equipment that runs a physical process can be reached and changed from the internet. Since October 11, 2026, cybersecurity incidents have hit commercial refrigeration systems in several EU countries, according to a joint EU statement. Any multi-site business can check its own controllers for the OT security risks behind these attacks. Start with what they expose online.

On November 5, 2026, the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and three other agencies issued a joint fact sheet on attacks on such equipment in grocery stores and cold storage. In several European cases, the equipment was maintained by an outside contractor or sat outside the chain's central network.

This guide is for US operations, facilities, and security leaders at grocery chains, restaurant groups, cold storage operators, pharmacies, and plants that run remotely managed refrigeration, HVAC, or building systems.

Key takeaways

• Attackers changed store equipment from the internet: CERT-FR named remote refrigeration controllers from Danfoss, Copeland, and Dixell, and NCSC Ireland said attackers reportedly reached such controllers over the public internet. For the refrigeration attacks, France's November 9 attribution covers only the October attacks in France and names a unit linked to Iran's Islamic Revolutionary Guard Corps.
• Five weaknesses run through the reports and the guidance: exposed interfaces, outdated firmware, default credentials, weak segmentation, and contractor remote access.
• The damage landed on stock and trading: stores wrote off spoiled food and some traded with empty cases, and the US fact sheet also warns of harm to consumers from unsafe storage.
• US agencies give the same advice at home: their November 5, 2026, fact sheet warns grocery and cold storage operators about attacks on the same kind of controllers.
• Start with an inventory and take management interfaces off the public internet: those two steps show what is exposed and close the path the European attacks reportedly used.

What happened in the European supermarket refrigeration attacks

Attackers took over the remote controllers that run supermarket refrigeration and changed their settings, first in France from October 11, 2026, and then in several other European countries on the night of November 1 to 2. France's CERT-FR alert identified the targets of this operational technology attack as remote controllers of refrigeration installations, the equipment that holds food at a safe temperature.

October 2026: hundreds of French supermarkets

CERT-FR's alert, first published on October 12 and updated on October 13 and 16, says the agency knew of numerous compromises of Danfoss AK-SM and AK-SC series controllers and of Copeland XWEB and Dixell XWEB controllers.

France's finance minister, Roland Lescure, told parliament that about 700 of the country's 10,000 supermarkets were affected, AP reported. Intermarché and its Netto brand urgently disconnected another 100 shops from the internet to keep the attack from reaching them, a spokesman said, according to the BBC. The Paris prosecutor's cybercrime unit opened an investigation.

On November 9, France set out its attribution of the October attacks in a Foreign Ministry statement and a joint report published by CERT-FR:

• Who: Shahid Kaveh, a cyber unit affiliated with Iran's Islamic Revolutionary Guard Corps.
• Why: the Foreign Ministry called the October attacks the first offensive cyber campaign carried out purely for sabotage on French soil.
• Legal action: the same day, the Paris prosecutor's office opened a judicial investigation into Shahid Kaveh's leader and his two deputies and is seeking international arrest warrants, AP reported in a story carried by OPB.
• Scope: the attribution does not cover the November wave.

November 2026: a second wave across Europe, IKEA included

Retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands, and Sweden reported problems with their refrigeration systems on November 2, according to the Guardian's November 2 report. By November 9, The Record reported businesses hit in at least 11 European countries.

Companies and authorities confirmed the incidents and issued warnings:

• IKEA: the company told NBC News that a "cyber incident" hit the refrigeration and freezer units of its store in Mons, Belgium, which stayed open while IKEA investigated.
• Danfoss: a spokesperson told Bloomberg, in a story republished by Insurance Journal, that the incidents involved its products, as in France in October.
• NCSC Ireland: the agency published an advisory on remote refrigeration controllers on November 3.
• EU joint statement: on November 4, ENISA, the European Commission, Europol, the EU CSIRTs Network, and EU-CyCLONe advised organizations to act at once to reduce exposure.

Two pro-Russian hacking groups later claimed in Telegram posts to have hacked Danfoss technology, but their involvement in the supermarket attacks had not been independently established, RTÉ reported on November 5.

What the attackers changed on the controllers

Sabcobel, which operates Delhaize's refrigeration systems in Belgium, said the units' evaporators were switched to defrost mode, NBC News reported, citing the Belga news agency. Temperatures in some fridges and freezers rose as high as 50C (122F), the Guardian reported. In France, initial investigations suggested the attackers disabled alarm systems before changing the thermostats, or extended defrost programs by several hours to avoid the alarms, according to the Guardian's October 17 report.

Table 1 puts the reported events in order, from the first incidents on October 11, 2026, to France's attribution of November 9.

Table 1. The 2026 refrigeration attacks, as officials and outlets reported them

Sources: ENISA joint statement; CERT-FR; AP; the Guardian; NBC News; NCSC Ireland; US fact sheet; French Foreign Ministry. Read November 9 and 10, 2026.

What connected operational technology is

Operational technology (OT) is equipment that monitors or controls a physical process, such as cooling a freezer. It counts as connected when someone can reach it over a network, for example to monitor or maintain it.

NIST SP 800-82 Rev. 3, the Guide to Operational Technology (OT) Security that NIST published in September 2023, describes OT as programmable systems and devices that interact with the physical environment. Its examples include building automation systems and physical environment monitoring systems. NIST has released a draft of Revision 4 for public comment.

A supermarket refrigeration controller is connected OT on three counts:

• It runs a physical process: the US fact sheet says these systems handle remote temperature monitoring, temperature logging, defrost cycle management, and energy optimization.
• It can be reached from outside: the Guardian reported that most supermarket cold aisles are connected to the internet to allow remote maintenance and failure alerts.
• It sits next to business systems: CISA's OT asset inventory guidance says many OT systems are increasingly connected to business operations and applications, and that such links can open paths between networks unless they are integrated securely.

OT security for a refrigeration controller means, for example, keeping it off the public internet and protecting it with a unique password. NIST counts HVAC, lighting, and access systems as part of building automation, so we would run the same checks there.

OT security threats: who targets connected equipment, and why

An OT threat is any actor or method that can reach connected equipment and change the physical process it runs. Several kinds of actors do this. On November 9, France blamed a state-linked unit for the October attacks on its supermarkets. A US academic told AP the French attack was unusual for its scale and because there appeared to be no ransom demand or theft of information. We group the authorities' reporting into four sources of OT cyber attacks:

• Hacktivists claiming OT intrusions: the ENISA Threat Landscape 2026 recorded 37 OT-related intrusion claims by hacktivist groups in the third quarter of 2025 and 124 in the fourth. Most of those claims named neither the methods nor the victims, and ENISA says verified disruption remained limited.
• State-linked actors: in a Secure by Design alert of December 2023, CISA said actors including groups affiliated with Iran's Islamic Revolutionary Guard Corps had compromised US critical infrastructure through OT products sold with static default passwords.
• Attackers moving from IT into OT: weak internal boundaries let an intruder who starts in office systems reach the controllers. CISA's asset inventory guidance lists insufficient network segmentation among the ways actors "move laterally from IT to OT environments and between OT systems."
• Opportunistic scanning: OT devices are easy targets when connected to the internet, according to CISA's Primary Mitigations to Reduce Cyber Threats to Operational Technology. Attackers find them by searching public IP ranges for open ports, with "simple, repeatable, and scalable toolsets available to anyone with an internet browser." Such scanning finds an exposed controller without the attacker choosing your company as a target.

The OT security risks that turn ordinary devices into outages

Five weaknesses run through the 2026 reports and the authorities' guidance. Four of them appear in CISA's asset inventory guidance among the ways actors get into OT systems, and the fifth, internet exposure, is the first item in CISA's Primary Mitigations.

Management interfaces exposed to the internet

CERT-FR's alert says that exposing a management interface on the internet runs against good practice. NCSC Ireland said attackers reportedly gained access to refrigeration controllers directly accessible over the public internet.

In research first published in August 2026 and revised on October 14, Claroty's Team82 counted 2,765 exposed AK-SM 800A devices in a Censys scan. The AK-SM 800A belongs to the AK-SM 8xxA series that CISA's advisory covers. After the second wave, the head of Sweden's national cybersecurity center said the country had "quite a lot of exposed operational technology devices" that needed updating or patching, the Guardian reported.

Outdated and end-of-life firmware

Danfoss said most affected systems were older products that no longer received software or security updates, AP reported. The company said it had long advised customers to keep supported systems updated and to operate behind a firewall.

Copeland said a vulnerability had been identified in "a discontinued, end-of-life generation of controllers," AP reported. In Estonia, the Selver chain's only affected store was its only one still using an older type of Danfoss control system, Bloomberg reported. NIST SP 800-82 notes that patching older OT components on unsupported operating systems may not be an option.

Default and weak credentials

Writing about attacks on US critical infrastructure, CISA says in its Primary Mitigations that analysis showed the targeted systems used default or easily guessable passwords. A security researcher told the Guardian that many of the French freezers appeared to be running with a default password.

CISA's advisory on the Danfoss AK-SM 8xxA series describes CVE-2025-41450 as an authentication bypass caused by datetime-based password generation. Claroty found that the routine generated a daily password from the device's current date alone. A new password does not close this flaw; only a firmware update does.

Equipment left outside the central network

Insufficient segmentation opens the IT-to-OT path described in the threats section. In the 2026 reports, two chains said the affected equipment sat outside their own central network or safeguards.

ICA told NBC News the incident hit "a small number of stores that use an external supplier and have their connectivity outside ICA's central network." Kesko's head of corporate security told Bloomberg that only a couple of smaller grocery stores, whose equipment was outside the scope of the chain's centralized safeguards, were affected.

CISA recommends segmenting IT and OT networks and passing control data to business systems through a demilitarized zone.

Remote access run by maintenance contractors

The French chains Coopérative U and Les Mousquetaires both tied the attack to the companies that maintain their refrigeration. Dominique Schelcher, Coopérative U's president, told RTL radio, "Our supermarkets are not customers of Danfoss," and blamed the refrigeration contractors, the Guardian reported. Les Mousquetaires told CNBC the attack affected one of its service providers responsible for managing refrigeration systems in some stores.

CISA says many critical infrastructure entities, or the contractors working for them, make risk-based tradeoffs when they set up remote access to OT, and that these tradeoffs "deserve careful reevaluation." A contractor with a standing connection to your controllers holds privileged access, so it belongs in your vendor program. Our guide on how to tier a vendor before you review it sets how deep that check goes.

Table 2 sums up each weakness with what was reported in 2026 and the first fix, and gives the performance goal (CPG) the US fact sheet maps to that fix.

Table 2. Five weaknesses, what was reported, and the first fix

Sources: NCSC Ireland; AP; the Guardian; CISA ICSA-25-140-03; NBC News; Bloomberg; CNBC; the fact sheet of November 5, 2026. Read November 9, 2026.

What a tampered controller costs the business

A tampered controller costs a business more than the food in its cases. The European reporting and the US fact sheet point to six kinds of cost:

• Stock written off: individual French supermarkets reportedly lost from tens of thousands of euros to more than €130,000, the Guardian reported. Intermarché's CEO, Thierry Cotillard, said total losses could run to "tens of millions of euros."
• Smoke, fire, and equipment wear: in certain French stores the temperature rise sparked fires that set off sprinklers, according to the Guardian. Les Mousquetaires told CNBC that some of its stores saw smoke and that no fires had been reported. The fact sheet adds that a temperature change can affect the service life of the system and create a fire hazard.
• Trading with empty cases: in Belgium, a Delhaize spokesperson said its range of fresh and frozen products was "temporarily somewhat limited" in affected shops, the Guardian reported.
• Food safety: consumers could be indirectly harmed if products are eaten after unsafe storage, the fact sheet warns.
• Blind monitoring: a researcher told the Guardian the attackers were able to modify or turn off the alerts, so shops only realized when the first person arrived in the morning. The US fact sheet calls the loss of visibility into current temperatures a denial-of-view condition.
• Insurance in doubt: store companies said the French losses were unlikely to be covered by their insurance, the Guardian reported. Segmented network access is among the insurer requirements our article on new cyber insurance requirements describes, so the segmentation in step 5 is also an insurance question.

Why US businesses should treat this as their own risk

Three US sources show the same equipment and the same warnings at home:

• CISA's ICS advisory ICSA-25-140-03: it lists the Danfoss AK-SM 8xxA controller family as deployed worldwide in the Commercial Facilities sector.
• Reporting on military commissaries: NPR reported, in a story carried by member station WAMC, that multiple US military commissaries had what the Pentagon described as a "possible refrigeration disruption" in August 2026. The Pentagon had not said whether hackers were responsible. On November 9, Reuters reported, in a story republished by The Business Standard, that Pentagon investigators were working with French officials on the commissary malfunctions, and that Reuters could not establish whether those incidents, the October attacks in France, and the November wave were linked. A review of public contracting documents by NPR found commissaries running Danfoss refrigeration remote control systems, including older versions that can no longer be updated with new, secure software.
• The November 5 fact sheet: CISA and the FBI wrote it with the Department of Health and Human Services (HHS), the Department of Agriculture (USDA), and the Department of Transportation (DOT). The agencies say they are aware of malicious actors targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. Organizations in healthcare and public health, chemicals, food and agriculture, and transportation widely use these systems, including in refrigerated transport, the fact sheet adds.

None of these documents says the commissary disruption and the European attacks were the work of the same actor. Together they show that the same controller families run in the United States. US agencies give the same advice as their European counterparts.

How to reduce OT security risks in connected equipment

Seven steps reduce the risk, from an inventory of the equipment to a plan for the night a controller is changed. We would take them in this order. Steps 2 to 7 follow the mitigations in the US fact sheet; step 1 and the manual fallback in step 7 come from CISA's OT guidance. The fact sheet aligns its mitigations with CISA and NIST's Cross-Sector Cybersecurity Performance Goals (CPGs), the codes in Table 2.

1. Build an inventory of connected equipment and every party that connects to it

List every controller that runs refrigeration, HVAC, or building systems at each site, with its owner, model, firmware version, and network path. CISA's asset inventory guidance defines an inventory as "an organized, regularly updated list of an organization's systems, hardware, and software." NCSC Ireland asks organizations to review all remotely accessible refrigeration equipment, regardless of manufacturer.

Then ask each contractor that services the equipment:

• How do you connect to our controllers, and from which locations?
• Which accounts do you use, and who in your company holds them?
• When did the last firmware update go onto our units, and who applied it?
• Who is alerted when a setpoint changes outside business hours?

The result is one list of controllers with their owners, firmware versions, and connections.

2. Take controller management interfaces off the public internet

The first mitigation in the fact sheet tells owners not to expose control system devices to the internet, controller panels in particular. Where remote access is needed, it says to put that access behind an updated firewall or edge device.

CERT-FR treats removing the internet exposure as an emergency step. At the end of this step, no controller panel answers from the public internet.

3. Replace default passwords and turn on the strongest security mode

Change every default password, set a strong password policy, and add phishing-resistant multi-factor authentication wherever the equipment supports it, as the fact sheet recommends. For Danfoss units, CERT-FR and NCSC Ireland both recommend setting the security level to Strict mode. You end up with unique credentials on every unit and MFA where feasible.

4. Update firmware and set a date to replace end-of-life controllers

Bring every unit to its vendor's current firmware, and run a lifecycle process to identify, retire, and replace devices the manufacturer no longer supports, as the fact sheet recommends. For the Danfoss AK-SM 8xxA series, CISA's advisory names releases R4.2 and R4.3.1 as the fixes.

CERT-FR warns that keeping an end-of-life device exposed to the internet means a very high probability of compromise. A factory reset alone is insufficient, it adds, because the device stays vulnerable and will certainly be compromised again. NCSC Ireland says such equipment should be isolated from untrusted networks and assessed for replacement or additional protective controls.

A unit you cannot replace yet needs a documented exception with a named owner, a compensating control, and an expiry date. You then have a firmware baseline and a replacement date for every unsupported unit.

5. Segment OT from business networks and route contractor access through one controlled path

Put controllers on a dedicated OT VLAN separated from business networks, as the fact sheet recommends. Allowlist the devices and IP addresses authorized to make changes, and limit access to them.

For contractor access, CISA recommends a private network connection that takes the controllers off the public internet. CISA also asks for a VPN with a strong password and phishing-resistant MFA, and for least-privilege access scoped to the contractor's work. CERT-FR and NCSC Ireland treat filtering contractors' source IP addresses at a firewall as a temporary measure only.

For manufacturers, we design that segmentation and schedule every intrusive step inside maintenance windows, as our page on OT security consulting for manufacturers describes. Once this step is done, each contractor reaches your controllers through one documented path.

6. Set safe setpoint limits, test the alarms, and keep the logs

Define reasonable setpoint limits for the devices downstream of each controller and set alerts for deviations, as the fact sheet recommends. Enable logging and review the logs for unexpected activity.

NCSC Ireland's review list adds defrost schedules, alarm and notification settings, and remote access accounts. Because the French attackers reportedly got around the alarms, we would test the alert path outside business hours. After this step, a controller pushed past its limits sends an alert that reaches a person.

7. Plan for the night a controller is tampered with

Write down who does what when a controller is changed: the contractor's contact, the manual fallback for keeping stock cold, and who reports the incident.

CISA recommends keeping the ability to operate OT systems manually. The fact sheet asks for current backups kept offsite and offline and tested, and it recommends that US organizations report suspicious activity to CISA's 24/7 Operations Center or to the FBI through IC3 or a local field office. Our incident response plan template covers the roles and notification clocks such a plan needs. You then have a written plan a night manager can follow.

Conclusion

Connected building and refrigeration controllers become a business risk when someone outside can reach and change them, and the European attacks put the cost on stock and store trading. We would start with two steps: list the equipment and everyone who connects to it, and take its management interfaces off the public internet. Then ask your contractor how it connects to your controllers and with which accounts.