08/11/2026 · 10:10 · Analysis · #Cyberattacks on supermarkets

When refrigeration systems become targets

An attack on the cold chain: when refrigerated goods start to thaw.

November 2026

Unknown attackers gained access to control systems for commercial refrigeration installations and changed their operating parameters. Instead of cooling reliably, some affected systems switched into heating or defrost modes. In individual cases, temperature settings of up to 50 degrees Celsius were reported.

While a domestic refrigerator is generally adjusted directly at the appliance, commercial refrigeration installations often use central control and remote-maintenance systems. It was these remotely accessible systems that were affected in the recent attacks.

The consequences for operators were devastating. Refrigerated display units had to be emptied, food discarded and technical systems restored to a safe operating state.

On 3 November 2026, the German broadcaster Tagesschau reported that individual Rewe, Edeka and CAP stores were among those affected in Germany. The incidents known at the time occurred in North Rhine-Westphalia, Lower Saxony and Bavaria.

This raises an urgent question for operators, technical service providers and those responsible for refrigeration technology:

How can the actual condition of an installation be determined reliably when its own control system becomes a target?

In brief: the technology behind the attacks

Modern refrigeration installations often have remotely connected control systems. They record temperatures, manage operating parameters, coordinate defrost cycles and allow service technicians to perform remote maintenance. Under normal circumstances, that is useful. Technicians can investigate faults and check settings without visiting every store in person. Problems arise when administrative access is inadequately protected or exposed directly to the public internet.

As early as 12 October 2026, France's CERT-FR issued a security alert concerning compromised remote controls for refrigeration systems. It named device families from Danfoss, Copeland and Dixell, among others.

In its alert, the authority recommended disconnecting directly accessible administration interfaces from the internet, checking configurations including defrost parameters, and securing any necessary remote access through protected connections. Outdated firmware, insecure credentials and devices that are no longer supported must also be taken into account.

The specific vulnerability exploited at each affected German store has not been conclusively documented in public.

The risk

Remote control of the cold chain offers numerous advantages. But when a security weakness is exploited, the refrigeration equipment can become a nightmare. Possible consequences include lost stock, water damage from thawing products and technical failures caused by overheating. Extortion is also a potential cyber risk in principle; however, it has not been established as a motive in the incidents described here.

Operators have responsibilities

Food retail operates under different organisational models, including independently run stores and centrally managed branches. Responsibility for maintaining, operating and securing refrigeration equipment depends on the relevant roles and contracts. The practical challenges are familiar: lack of time, deferred investment and confidence in older equipment that appears to work reliably.

Our recommendation is therefore clear: additional monitoring based on separately acquired measurements immediately offers another perspective.

It does not directly answer whether the controller has been hacked. Instead, it shows what temperature a sensor actually measures at the monitored location. Adding read-only monitoring and a digital twin to existing installations can make deviations between actual measurements and desired parameters visible.

The SVARTLIND principle: independent monitoring — observing without controlling

This is where the monitoring concept we have developed comes in. With HJÄRTA as an on-site module and VAKTEN as a digital monitoring and analysis platform, suitable signals acquired separately from an installation can be made visible. Depending on the sensors, connection options and configuration, these can include temperature readings and the states of doors and closing mechanisms.

HJÄRTA receives the on-site signals and forwards them. VAKTEN organises the information, displays current states and evaluates them against individually configured rules. If defined limits or conditions are breached, a need for action can become visible and a configured notification can be triggered. Depending on the configuration, measurement interval and available connection, such changes may become visible promptly. You are welcome to try our demo to see the principle in action.

Documentation

Diagram: Independent monitoring with HJÄRTA and evaluation in VAKTEN — Independent monitoring: record conditions on site, collect them with HJÄRTA and evaluate them in VAKTEN — without intervening in the refrigeration controller.

The essential principle: SVARTLIND observes without intervening in the refrigeration system's control functions.

HJÄRTA is designed to record states and measured values, not to control the installations being monitored. On the Professional version's designated 24 V signal inputs, optocouplers provide galvanic isolation between the connected signal circuitry and the internal evaluation electronics.

This isolation is implemented in hardware and cannot be removed by a software command. Even if an attacker gained access to VAKTEN or HJÄRTA, those inputs would not create a control channel to the refrigeration system. Protection therefore depends not only on software and access rights, but also on the electrical design. It requires professional installation and operation within the specified electrical limits.

Our system is not intended to regulate refrigeration, replace the refrigeration installation or prevent a cyberattack. HJÄRTA was originally developed to address requirements including:

Medical practices: monitoring refrigerators used to store medicines.

Clinics: monitoring (fire-protection) doors — for example, has a door been wedged open?

The aim is to capture real-world states, make deviations visible and provide operators with an auditable basis for understanding what is happening.

What a second monitoring layer can provide during an incident

Suppose a commercial refrigeration installation receives an unsuitable operating parameter through an accidental or unauthorised change. While the controller follows its new instructions, the actual temperature in the cold room begins to change.

A separately installed temperature sensor can detect that rise, provided its measuring range, placement and sampling intervals are appropriate. HJÄRTA can transmit the reading to VAKTEN. There, it can be checked against a configured temperature limit or a defined deviation threshold.

This gives technical service teams an additional source of information: Which monitored area is showing a deviation? How long have the corresponding readings been recorded? Which changes of state were documented?

The key advantage: VAKTEN supports decentralised data acquisition and central evaluation of configured rules. Depending on the setup, alerts and notifications can be assigned to the people responsible. For example, a company operates five supermarkets in one city and monitors their locations centrally. If the temperature in a monitored refrigerated area at the third store deviates from the target value, the responsible contact can be notified specifically.

What technical service teams should check now

The current incidents are a reason to look beyond the refrigeration controller when reviewing existing monitoring concepts. Operators and their refrigeration service providers should first establish which controllers are in use, how their remote-access channels are protected and whether manufacturer updates are available.

Unnecessary administration interfaces exposed to the public internet should be removed. Remote maintenance that is needed should be protected by suitable safeguards, such as secure VPN connections, access controls and appropriate network segmentation.

Equally important is how faults are detected.

Who reports an unusual temperature rise outside business hours? Does alerting still work if the central controller cannot be trusted or reached? Are readings and events recorded in a traceable way?

And above all: Does the responsible person receive information in time to take meaningful action?

An independent measurement and evaluation layer can usefully complement these security measures. It cannot replace a secured controller, required inspections, food-safety obligations or an operationally agreed alarm and emergency response plan.

Knowing what is really happening

The attacks on commercial refrigeration installations show that cybersecurity is no longer solely an IT issue. When digital controls influence physical processes, software problems can become spoiled food, operational disruption and substantial financial losses.

SVARTLIND helps operators better understand the condition of their installations through additional monitoring designed for clear operation and straightforward integration wherever possible. It is not a replacement for existing technology, but an extra layer of visibility for the people responsible for its safe operation.

Monitor existing refrigeration equipment independently

Do you operate cold rooms, refrigerated display cases or other temperature-sensitive installations and want to monitor their actual operating conditions?

SVARTLIND supports the introduction of an additional monitoring layer using HJÄRTA and VAKTEN — tailored to existing equipment, suitable sensors and specific operational requirements. Talk to us about your application.