Cyberattacks Target Remote Refrigeration Management Systems

The Cyber Security Agency of Singapore (CSA) has issued an advisory following cyberattacks in October and November 2026 targeting internet-connected refrigeration management systems across Europe. Threat actors gained unauthorised remote access to manipulate temperature settings, affecting hundreds of supermarkets across France, Belgium, Luxembourg, Sweden, and Ireland, causing food spoilage and operational disruptions. France's national blood service facilities were also affected via a refrigeration equipment supplier. SingCERT warns that poorly secured Operational Technology (OT) remote access poses severe operational, safety, and supply-chain risks. Organisations in Malaysia observing similar compromises can report incidents directly to Cyber999 (MyCERT).

Key Facts

How Were the Refrigeration Systems Infiltrated?

According to publicly available information cited by SingCERT, threat actors gained unauthorised remote access by exploiting poorly secured, internet-accessible refrigeration controllers. The intrusions reportedly leveraged weak or default credentials, outdated software, and insufficient access controls, although precise technical intrusion methods across all affected European facilities remain under active investigation.

Once attackers gained unauthorised remote access, they altered temperature settings and interfered with operations. In commercial food retail, this resulted in food spoilage, financial losses, and operational disruptions across hundreds of supermarkets in France, Belgium, Luxembourg, Sweden, and Ireland. The attack vector also extended upstream to equipment providers: a breach involving a refrigeration equipment supplier subsequently compromised refrigeration systems at facilities operated by France's national blood service. Similar vulnerabilities threaten a broad range of operational technology environments, including heating, ventilation, and air conditioning (HVAC) systems, industrial manufacturing facilities, water distribution infrastructure, energy utilities, and cold-storage logistics.

Threat actors manipulated temperature controls after accessing exposed controllers protected by weak or default credentials.

What Are the Wider Risks to Operational Technology?

Remote operational technology connections introduce substantial physical and supply-chain vulnerabilities when exposed directly to the internet. Unauthorised actors who compromise remote management interfaces can alter equipment configurations, shut down safety mechanisms, disable alarms, and cause irreversible physical hardware damage, directly interrupting critical cold-chain storage and sensitive industrial processes.

Industrial control systems (ICS), supervisory control and data acquisition (SCADA) setups, programmable logic controllers (PLCs), and building management systems are increasingly connected to corporate networks or the public internet to facilitate third-party vendor maintenance and remote diagnostics. When organisations neglect network boundaries, an intrusion can quickly propagate beyond digital disruption into hazardous physical consequences, such as compromising temperature-sensitive medical supplies or spoiling perishables across widespread distribution networks.

Compromising operational technology controls allows external attackers to disable safety alarms and disrupt physical operations.

What Should You Do?

No specific vendor patch or universal software update was identified in the advisory. SingCERT recommends implementing the following general hardening and mitigation measures across all remotely accessible operational technology control systems:

• Identify, create, and maintain an inventory of all internet-exposed remote management systems, controllers, and OT devices, removing unnecessary public exposure and disabling unused ports, services, and functions.
• Change all default passwords to strong, unique credentials across remote management systems and connected devices.
• Mandate secure remote access solutions, such as Virtual Private Networks (VPNs), and enforce Multi-Factor Authentication (MFA) wherever supported.
• Restrict access strictly to authorised personnel and trusted service providers, removing unneeded accounts, allowlisting specific IPs and accounts, and blocking non-essential outbound connections from controllers.
• Apply the latest vendor security patches and firmware updates to OT software and network devices, while establishing compensating controls or replacement roadmaps for unsupported end-of-life equipment.
• Segregate OT networks from corporate IT networks and monitor remote access for unauthorised logins, configuration modifications, or safety alarm alterations.
• Establish and test incident response and business continuity plans, including procedures to safely isolate compromised devices and revert to local or manual controls during disruptions.

Common Questions

Which countries and organisations were affected by these attacks?

The attacks affected hundreds of supermarkets across France, Belgium, Luxembourg, Sweden, and Ireland during October and November 2026. Additionally, refrigeration systems supporting France's national blood service facilities were affected following a cyberattack involving a third-party refrigeration equipment supplier, demonstrating cross-border and third-party supply-chain disruption.

Is there a specific patch or CVE identified for these incidents?

No specific CVE identifiers, product models, or vendor patches were detailed in SingCERT's advisory. The intrusions exploited common weaknesses, including weak or default credentials, outdated software, and unsegmented remote connections, making comprehensive operational technology hardening and network segregation essential rather than relying on a single patch.

How should administrators in Malaysia handle a suspected OT compromise?

Administrators should promptly isolate affected systems, revert to manual or local controls, and engage technical personnel and equipment vendors. In Malaysia, organisations can report suspected intrusions to Cyber999 operated by MyCERT, while documenting forensic findings and executing business continuity plans to maintain critical services safely.

Sources and Methodology

This dispatch is based solely on the advisory issued by the Cyber Security Agency of Singapore (SingCERT) published on 6 November 2026, accessible via the Cyber Security Agency of Singapore. No external documentation, vendor advisories, or third-party reports were independently verified or reviewed for this report.