Securing the store: Seven actions for retail security leaders

Heather Archamb · 41m ago

When the fridge becomes the attack surface

If you run security for stores, you already know you can’t protect what you can’t see. Overnight on 11–12 October, attackers reportedly pushed refrigerators and freezers at about 700 of France’s 10,000 supermarkets to as high as 50°C (122°F). Some units caught fire. Overnight on 1–2 November, a second wave hit stores in Belgium, Luxembourg, Sweden, Ireland, Estonia and the Netherlands. No one has claimed responsibility for either wave.

Refrigeration controllers sit on the store network, often outside IT’s inventory, and keep running long after updates stop. Many stores also keep insulin and vaccines in the same cold chain. No reporting so far says pharmacy equipment was affected, but the same weaknesses could reach it.

A refrigeration failure in even one store is costly. Recovery means specialist cleaning and disposal of spoiled stock, empty shelves for days while the range is rebuilt, and store teams absorbing customer frustration. Now picture that across hundreds of stores at once, from a cyber incident, with no clear cause and no clear end date. It’s a position no retail team wants to be in.

How the attack worked

The attackers went after refrigeration system managers, the central units that run every fridge and freezer in a store. France’s national computer emergency response team named Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB systems among those affected. In November, Danfoss and Copeland equipment was targeted again.

Reporting points to four ways in. Not all are confirmed, but every path ends in the same place: the system’s own controls.

Way in	What’s been reported	Status
Exposed logins	Management interfaces reachable from the internet and found by scanning. Many ran end-of-life software or carried known flaws.	Stated by vendor or agency
Default passwords	Danfoss said the Dutch systems hit in November weren’t on a secure network and still used a default password.	Stated by vendor
Contractor access	Some retailers said the attack came through the supplier that manages their refrigeration. How that access was used hasn’t been confirmed.	Unconfirmed
IT intrusion	In May, attackers used remote-access software on a food processor’s IT network to reprogram its refrigeration controllers, destroying three compressors. It hasn’t been linked to these waves.	Earlier precedent

Once inside, the attackers needed no custom malware. They turned the system’s own controls against it:

They forced defrost to run continuously, or far longer than normal.

They overrode the timers and coil sensors that normally end a defrost, so the heaters stayed on.

They raised freezer setpoints from around −22°C to extreme values, or locked them there.

They pushed the changes from one system manager to every connected case in the store at once.

With heaters on and cooling suppressed for hours, case temperatures climbed to around 50°C, and higher in some reports. Raising the setpoint alone would only let cases warm to room temperature. Reaching 50°C meant keeping the defrost heaters running. And because the system still saw a normal defrost in progress, high-temperature alarms were delayed or never fired. Both waves ran overnight, when few people were in stores to notice. In some stores, settings changed in rapid succession, a sign the attack was scripted.

This is a repeatable, low-skill technique: no malware, no special tools, just access and a working knowledge of how these systems run. It has now worked at national scale, twice.

The warning signs were public

None of this came out of nowhere. Attacks on these controllers go back years, and the flaws, fixes and warnings were public well before the first wave hit.

Date	What happened
2022	Attackers hit 16 Russian and 40 Israeli supermarkets through Danfoss AK-SM 800 controllers. Danfoss later said the Israeli sites lacked firewall or VPN protection.
Mar and Aug 2025	Danfoss fixes three flaws in its current AK-SM 800A controller, including an authentication bypass.
Sep 2025	Armis, now part of ServiceNow, discloses ten flaws in Copeland E2 and E3 controllers.
Feb 2026	CISA, the US cybersecurity agency, warns of critical flaws in Copeland XWEB and XWEB Pro controllers.
May 2026	Attackers break into an Israeli food plant’s IT network and reprogram its refrigeration controllers, destroying three compressors. The method differs from the later waves.
9 Aug 2026	Security researchers publish flaws in the AK-SM 800A and count 2,765 of these controllers reachable from the internet.
26–28 Aug 2026	At least six US military commissaries report refrigeration failures. At Fort Huachuca, freezers enter defrost mode overnight.
11–13 Oct 2026	The first wave hits France. CERT-FR names Danfoss AK-SM and AK-SC controllers, then adds Copeland and Dixell XWEB systems.
29 Oct 2026	Reuters reports the Pentagon is treating the commissary failures as a suspected cyberattack. The cause hasn’t been confirmed.
1–2 Nov 2026	A second wave hits Belgium, Luxembourg, Sweden, Ireland, Estonia and the Netherlands. Israel’s National Cyber Directorate warns its retailers.

A patch wasn’t the control that failed. Most units hit in France were end-of-life models with no patch to apply. Some current models had fixes available that were never installed, and others still ran default passwords. No one has linked the August research to the attacks, but it showed how many of these systems sat open on the internet. What failed was visibility: knowing which controllers you own, who maintains them and what can be reached from the internet, before anyone discloses a flaw.

The weaknesses go beyond the systems named in France. In 2025, research from Armis, now part of ServiceNow, identified ten vulnerabilities in Copeland E2 and E3 controllers. An unauthorized attacker could manipulate parameters, disable systems or run code with root privileges. Those controllers also run HVAC and lighting, so the exposure reaches well beyond refrigeration. Copeland has since released firmware fixes.

Your leadership will ask one question first: what do we actually have in our stores? Which devices are running, which are out of date, and which can be reached from outside the store? Refrigeration is only the start. Point-of-sale (POS) systems, scales, shelf labels, cameras, HVAC and self-checkout all add to the attack surface. Many teams can’t answer that completely, especially for equipment maintained by third-party firms. The gap usually sits with older units that can no longer be patched but still keep the store running.

AI is widening the surface

AI agents are now being added to store systems, with access to data and equipment. Each one adds to the attack surface. ServiceNow’s published study, Deployed but ungoverned: The state of agentic security, surveyed more than 3,700 security leaders across 20 countries and eight industries. It found that 82% of organizations have AI agents operating in or interacting with operational technology (OT) and other physical environments. Two-thirds (66%) can’t act automatically when an AI agent behaves anomalously. Exposure is growing at machine speed, but most fixes still happen at human speed. No public reporting ties AI to these attacks. But the technique needs only access and a working knowledge of how these systems run, and AI makes that knowledge easier to get. The underlying problem predates AI: connected equipment creates more ways in, and slow visibility and slow response let a breach run for hours.

Seven actions to secure the store

Security, facilities and store operations each see part of the store. These actions put them on the same record.

Build a complete inventory of connected devices. Include IT, OT and Internet of Things (IoT) equipment, and don’t rely on the asset list the team already has. Refrigeration controllers, POS, scales, shelf labels, cameras and HVAC often sit outside it.
Tie each device to its store, service, owner and maintainer. A controller that keeps fresh food cold should get a different priority from an idle kiosk, and leadership should be able to see that difference when deciding what to fix first.
Find the exposures that matter. Check for end-of-life firmware, default passwords, devices reachable from the internet and known vulnerabilities. Rank them by business impact, not just severity score.
Close the path before it’s used. Separate OT from the corporate network, restrict remote access and remove internet exposure from devices that don’t need it.
Track every fix. Each one needs an owner, a deadline and a record, including work done by third-party maintenance firms. Test changes before they reach production stores.
Set up fast detection and containment. Alerts should arrive with the store, owner and business impact attached, and should flag unexpected configuration changes, not just temperature. Isolating a device should be a logged, repeatable action across IT and OT.
Be ready to prove it. Capture evidence as the work happens so you can show a regulator, auditor or board where you stand.

Complex store environments are hard to secure, but the work starts with knowing what’s connected and where it sits. We help retailers see every connected device in their stores, from unmanaged OT and IoT equipment to end-of-life units and devices still on default passwords, and close those gaps before attackers find them. Read the ServiceNow Blueprint for Autonomous Security. Connect with our team to learn more.

For more information

www.servicenow.com