Forescout warns of global exposure in refrigeration systems

Forescout has published research identifying widespread internet exposure of refrigeration management systems worldwide, pointing to risks that extend beyond the recent attacks on French supermarkets.

The report found 12,976 publicly exposed refrigeration and related management service observations across 6,017 distinct public IP addresses in 99 countries and territories. It also tracked more than 20 claimed cyberattacks on refrigeration systems since January 2026, with reported targets including supermarkets, fruit storage facilities, wineries, and other agricultural or food processing sites.

The research follows investigations in France into cyber incidents affecting refrigeration management systems at more than 700 supermarkets. Public reporting said malicious changes to temperature and defrost controls caused food losses, while CERT-FR said the affected products included Danfoss AK-SM and AK-SC systems, as well as Copeland and Dixell XWEB.

Forescout said the broader concern is that attackers may not need destructive malware to cause physical disruption. Unauthorised access to routine supervisory functions could let them alter temperatures, defrost schedules, and alarms through features designed for normal maintenance and control.

Exposure mapped

The exposed systems covered 10 product groups, including 7,075 Copeland or Dixell XWEB services, 4,697 Danfoss StoreView services, 551 Copeland Site Supervisor services, 513 Carel pCOWeb services, and 140 other services across six additional product groups.

Service observations and IP addresses were counted separately because one public IP address can host the same interface on several ports, while a single management interface can represent multiple downstream systems. Forescout used Shodan data to assess the level of internet exposure.

Several of the identified product families are used in refrigeration but can also support HVAC and other building automation functions. That means the issue extends beyond food retail to sectors including healthcare and agriculture, where cold storage affects medicine, produce, and other temperature-sensitive goods.

Known weaknesses

The report highlighted two main attack paths: weak or missing authentication, and known software vulnerabilities. Of 513 observed pCOWeb services, only 287 returned HTTP 401 responses, suggesting some interfaces may not have required proper authentication, while others may rely on weak or shared credentials.

Several product families also have a record of documented security flaws. Some models remain in use despite being end-of-life and no longer patchable, including the Danfoss AK-SM 800 model cited in the French incidents.

For the Danfoss AK-SM 800A, Forescout said 3,762 StoreView service observations, or 80% of the total identified, were running firmware older than version 4.3.1. That version range is affected by CVE-2025-41451 and CVE-2025-41452.

The report said Copeland XWEB Pro devices had 23 known vulnerabilities affecting firmware below version 1.13, while Copeland E3 and Site Supervisor products were affected by the Frostbyte10 set of vulnerabilities below firmware version 2.31F01. Carel products, including boss, boss mini, and pCOWeb, were also listed as having multiple known vulnerabilities.

Remote access issue

One of the central findings was that public exposure of these systems is not always the result of accidental configuration. Manufacturer documentation for some devices explicitly described internet-based remote maintenance as a supported operating model, including router configuration, network address translation, and incoming connections for web access.

That arrangement reflects a practical need in the sector. Refrigeration contractors often require remote connectivity to diagnose faults, adjust settings, and support multiple sites without travelling to each location. But Forescout said this setup can blur responsibility among contractors, facilities teams, and IT staff, leaving no single group with full oversight of the exposed service, the network route, user identities, and the controller lifecycle.

"The recent attacks in France demonstrate how ordinary refrigeration supervisory functions available for remote operation can be used to create physical and financial consequences," said Sai Molige, Senior Manager of Threat Hunting at Forescout Research - Vedere Labs.

Molige said the issue goes beyond the French supermarket attacks. "The dataset of exposed systems shows that this risk is not contained to France or supermarkets. It is a global problem for several industries that rely on cold storage, including agriculture and healthcare," he said.

Hacktivist activity tracked by Forescout pointed to recurring interest in these systems. The report said the most active groups linked to claimed attacks since January 2026 were the pro-Russian groups Z-Pentest Alliance and NoName057(16), and that the most common methods involved changing temperature and defrost settings through internet-exposed human-machine interfaces. On April 26 alone, Z-Pentest claimed 10 separate attacks.

Forescout recommended removing direct public access to refrigeration management interfaces and restoring remote maintenance through secure remote access gateways. It also called for replacing unsupported systems, patching supported ones, using named user identities and multifactor authentication, enforcing least-privilege access, and introducing session logging and monitoring that can link remote sessions to changes in setpoints, alarms, users, and network configuration.