Refrigeration controls exposed online: the NCSC warning and what businesses should check
The NCSC reports attacks on refrigeration controllers reachable from the internet, including in Switzerland: temperatures and alarms changed remotely. Who is affected, the recommended measures and five questions for your refrigeration provider.
On 10 November 2026 Switzerland’s National Cyber Security Centre (NCSC) published a warning about cooling and refrigeration control systems. Attacks that came to light in recent weeks in several European countries also affected Switzerland, and the NCSC points out that these systems are widely used by small and medium-sized enterprises as well.
This is not only a supermarket issue. A cold room in a restaurant, a butcher’s counter or the medicine fridge in a pharmacy may be run by a controller with a web interface. If that interface can be reached from the internet, anyone who finds it can try to get in.
What happened
On 12 October 2026 CERT-FR, the incident response centre of the French agency ANSSI, reported numerous compromises of remote controllers for refrigeration installations. The alert, updated on 13 and 16 October, covers the Danfoss AK-SM and AK-SC series and the Copeland and Dixell XWEB supervisors.
According to the NCSC, the focus was initially on three Danfoss systems: the end-of-life AK-SM 800 System Manager and AK-SC 355, and the current AK-SM 800A / AK-SM 8xxA family when running outdated firmware. Systems from the Copeland/Dixell XWEB family were later also identified as potentially affected.
The pattern described by the NCSC is simple: attackers get in through management interfaces that are directly reachable from the internet and then remotely change temperatures, defrost cycles, alarm thresholds or notification settings. The result can be spoiled goods, food or medicines, with financial losses and business interruptions. Cases in the healthcare sector have also been reported abroad.
Who is affected
The NCSC lists, among others:
- butchers and food production companies;
- restaurants and hotels;
- pharmacies;
- medical practices and laboratories;
- logistics companies and warehouses;
- industrial and production facilities;
- farms.
For an SME in Ticino the critical point is often a different one: many companies, the NCSC notes, are not aware that their installation is reachable from the internet, directly or indirectly, or that it is operated by an external service provider. The refrigeration technician installs the controller, enables remote access for support, and from then on nobody in the company treats it as part of IT.
Recommended measures
| Measure | What it means in practice |
|---|---|
| Take inventory | Check whether the company uses cooling or refrigeration controllers, including systems maintained or operated by external providers. |
| Update the firmware | Follow the manufacturer’s guidance. For AK-SM 800A / AK-SM 8xxA, updates are available that fix the known vulnerabilities and enforce encrypted HTTPS communication. |
| Remove direct internet access | Management interfaces must not be exposed; access only from trusted IP addresses or via VPN, through a centrally managed access point. |
| Change default passwords | Immediately, using strong, individual and different passwords. |
| Protect or replace unsupported systems | Models that no longer receive updates must not be reachable from the internet and should be replaced as soon as possible. |
CERT-FR adds some useful details. For Danfoss devices it recommends updating the firmware, setting the security level to “Strict” mode and making sure default passwords have been changed. Before cutting the data link to the refrigeration provider, check the terms of your insurance contract. Filtering the provider’s IP addresses on the firewall is acceptable only as an emergency measure, not a permanent one.
Five questions to ask your refrigeration provider
- Which controllers do we have, which make and model, and which firmware version?
- Is the management interface reachable from the internet on a public IP address?
- How do you connect for support: VPN, IP filtering or open access?
- Have the default passwords been changed? Who knows them?
- Does the model still receive security updates from the manufacturer?
The same reasoning applies to any networked device: anything reachable from the internet can be found by anyone with a port scanner or a specialised search engine. We covered this in our article on NAS, Plex and port forwarding.
If the installation has already been tampered with
CERT-FR advises removing internet exposure, checking the whole configuration, especially defrost periods, restarting the device or restoring factory settings and reconfiguring it, and restoring access only via VPN or a protected network. It warns, however, that a factory reset alone is not enough for an unsupported device that stays exposed: it would very likely be compromised again.
Incidents can be reported to the NCSC. Operators of critical infrastructure are also subject to the reporting obligation for cyberattacks within 24 hours of discovery.
Our approach
ElaraTeq Sagl helps SMEs, restaurants, hotels and practices in Ticino take inventory of networked devices, close unnecessary access and set up remote access for providers via VPN (consulting, hosting in Switzerland). Our article on the SME Cybersecurity 2026 study shows why the organisational side matters as much as the technical one. To review your situation, contact us.
Sources
- NCSC, Cooling and refrigeration control systems: Identifying, updating and protecting systems, 10 November 2026
- CERT-FR, CERTFR-2026-ALE-012, Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération, 12 October 2026 (updated 16 October)
- BSI, Gefährdung durch internet-verbundene OT-Systeme, 13 October 2026
- NCSC, Reporting obligation for cyberattacks on critical infrastructure
