On 3 November 2026 the National Cyber Security Centre of the Slovak NBÚ issued a warning about attacks on refrigeration and air-conditioning control systems across the EU. At first glance it reads as a food retail story. It is really a story for anyone who runs a building full of networked equipment.
What happened
According to the warning, attackers gained unauthorised access to control units and changed their configuration. The result was spoiled stored food and, in some cases, fires. The first mass wave hit France on 11 and 12 October 2026 and affected refrigeration systems in several hundred supermarkets. A second wave on 2 November 2026 hit dozens of chains in Ireland, Sweden, Italy, Portugal, Belgium, Luxembourg, the Netherlands, Finland and Estonia.
The warning names the affected systems — Copeland XWEB, Danfoss AK-SC and AK-SM, Dixell XWEB — and notes the list may not be complete. France's CERT-FR published alert CERTFR-2026-ALE-012 on 12 October 2026, extended it to further equipment on 13 October and revised its recommendations on 16 October. As of 9 November 2026 neither warning names a CVE or an officially confirmed initial access vector. The NCKB warning lists no confirmed case in Slovakia.
Why this is an IT problem, not a maintenance one
The risk factors the NCKB lists are dull and familiar: devices reachable from the internet, default or weak credentials, poorly protected admin interfaces, unpatched vulnerabilities. CERT-FR adds that exposing a management interface to the internet goes against good practice, and that end-of-life equipment reachable from the internet should be treated as very likely compromised — a factory reset alone is not enough, because the device stays vulnerable.
The common thread sits elsewhere, though. IT did not usually buy these units. Facilities bought them, a refrigeration contractor installed them, and that contractor kept remote access for servicing. They are not in the asset register, not in the patching plan, not in the network segmentation. An attack on them does not even look like a security incident until someone opens a freezer.
For regulated entities there is a second layer. NBÚ decree 212/2026 Coll., effective from 1 September 2026, works with operational technologies alongside networks and information systems in its audit provisions. Equipment IT does not know about is hard to defend in an audit.
What to check
- Find every refrigeration and HVAC control unit and establish which ones are reachable from the internet.
- Change default credentials and enable multi-factor authentication wherever the device supports it.
- Review user accounts and remote access, including access held by suppliers and service companies.
- Update firmware; for Danfoss equipment CERT-FR recommends setting the security level to Strict.
- Check the configuration — temperature limits, defrost schedules, alarm thresholds — against a trusted backup.
- Verify actual temperatures with independent measurement, not with a reading from the same system.
- Remove direct internet exposure, route access through a VPN or protected network, and segment the OT network.
- Replace end-of-life devices; protect the ones that cannot be replaced more tightly.
Suspected incidents are reported through JISKB at jiskb.nbu.gov.sk.
The more durable lesson
A one-off walk through the buildings after a warning does not fix the underlying issue. If these devices are not in the asset register, the same check will have to be repeated by hand in a year. It is more practical to add them to the same register that holds servers and workstations — with an owner, a supplier, a firmware version, an end-of-support date and a note on who holds remote access. The next warning then becomes a database query instead of a round of phone calls.