OT Security: What the Supermarket Refrigeration Attacks Mean for Your ISMS

Key takeaways

• Since October 2026, attackers have manipulated internet-exposed controllers of supermarket refrigeration systems. In France, the Paris prosecutor's office counted around 700 victims; on November 2, 2026, stores in Belgium, Luxembourg, Sweden, and Estonia followed.
• France's CERT-FR names the Danfoss AK-SM and AK-SC series as well as Copeland xweb and Dixell xweb. Danfoss and Copeland say the affected devices are mostly discontinued products that no longer receive security updates.
• OT security rarely fails on technology alone: many companies list neither the controllers a contractor maintains remotely nor the contractor's access in their asset inventory or supplier assessment.
• ISO 27001 covers OT only if the equipment sits inside the ISMS scope. Relevant controls include A.5.9 (inventory), A.5.19 (supplier relationships), A.8.8 (technical vulnerabilities), and A.8.22 (segregation of networks).
• Under NIS2, such systems touch four of the ten risk management measures in Art. 21(2) of the directive. Annex II does not list pure food retail; it does list food wholesale and industrial food production.

‍

The attacks on supermarket refrigeration in October and November 2026 show that OT security also concerns companies that never saw themselves as industrial operators. Attackers remotely switched refrigerated and frozen display cases into defrost mode and kept them running at up to 50 °C. Stock spoiled, and the Paris prosecutor's office also reported fires in France.

Nobody knows yet who is behind the attacks. For your own risk management, that matters less than how the attackers reached the equipment, and you will find the same pattern in almost any company that runs connected building or production technology.

What happened in the refrigeration attacks?

The attackers used refrigeration controllers whose management interface anyone could reach directly from the internet. Through that interface, they put the systems into a continuous defrost cycle.

The first wave hit hundreds of French supermarkets in mid-October 2026, including Intermarché, Carrefour, and Coopérative U stores. The Paris prosecutor's office opened an investigation and speaks of around 700 victims. On October 12, CERT-FR, France's national computer emergency response team, published an alert on the compromised controllers. It names the Danfoss AK-SM and AK-SC series as well as Copeland xweb and Dixell xweb, and states that exposing a management interface to the internet runs against good practice.

A count by French security researcher Baptiste Robert hints at the size of the attack surface: on October 12, he found 2,752 Danfoss systems reachable from the internet, 1,590 of them in France.

A second wave followed overnight into November 2, 2026. According to Reuters, Ahold Delhaize and Colruyt reported an IT incident that hit refrigeration in dozens of stores in Belgium and Luxembourg. In Sweden, ICA and Coop stores were affected, along with a supermarket chain in Estonia. Media also reported cases in the Netherlands and Ireland. Whether the same actors are behind both waves is still open.

After the first wave, Danfoss and Copeland said the affected devices were mostly discontinued products without security updates. Sabcobel, the Belgian refrigeration contractor that maintains Delhaize's systems, said the units need physical modifications, because a software update alone does not fix them.

What is OT security, and why is it so often missing from the ISMS?

OT security (operational technology security) protects the systems that control physical processes: refrigeration and HVAC, building management systems, production machinery, and access control. Unlike classic IT, it is about more than data. If an OT system fails or someone manipulates it, stock spoils, a line stops, or people are put at risk.

A common misconception is that refrigeration belongs to facility management and therefore has no place in the ISMS. That is exactly the split the attackers exploited. In many companies, connected equipment slips through three gaps:

1. No inventory entry. IT tracks laptops, servers, and cloud services, while the controller in the cold room appears on no list.
2. No clear ownership. Facility management owns the equipment, IT owns the network, and nobody owns the contractor's remote access.
3. No supplier assessment. The refrigeration contractor has a maintenance contract but no agreement on how it accesses the equipment or reports incidents.

Service life adds to the problem. OT equipment often runs far longer than a laptop or server and stays in operation after the manufacturer ends support. The controller keeps working; it just stops getting patches.

An ISMS under ISO 27001 is built to catch these gaps, but it only covers what sits inside its scope. Our guide to ISO 27001 certification explains how to set that scope and which steps lead to certification.

Which ISO 27001 controls apply to OT systems?

Each gap from the refrigeration case maps to a control in Annex A of ISO 27001:2022 and to a NIS2 measure.

A second misconception concerns the certificate. An ISO 27001 certificate says nothing about your refrigeration if the scope only covers office IT. Check whether production and logistics sites, in particular, include their equipment in scope. Our comparison of NIS2 and ISO 27001 shows where the two frameworks overlap and where they do not.

Does OT fall under NIS2?

NIS2 regulates entities, not individual systems. If your company falls under NIS2, its connected controllers are among the systems the risk management measures apply to. Our article on NIS2 risk management requirements explains all ten measures.

For the food sector, the scope is narrow. Annex II of the NIS2 Directive covers food businesses engaged in wholesale distribution and industrial production and processing. It does not list pure food retail. A food manufacturer or wholesaler with 50 or more employees, on the other hand, can qualify as an important entity. In Germany, the BSI Act (BSIG) lists the food sector in its Annex 2.

The equipment makers are a different case. Annex II also lists the manufacture of machinery and equipment, section C division 28 of NACE Rev. 2, under manufacturing. Whether a refrigeration manufacturer is in scope depends, as always, on its activity and size. Our NIS2 Checker gives you a first assessment for your own company.

Manufacturers of connected products also face the Cyber Resilience Act, Regulation (EU) 2024/2847. Since September 11, 2026, manufacturers must report actively exploited vulnerabilities in their products, including products already on the market. Most other obligations, including a support period that reflects the product's expected lifetime, apply from December 11, 2027. For devices already installed and discontinued, none of this changes the update situation. The risk stays with the operator.

Companies outside NIS2 still feel it through their customers. Regulated companies must demonstrate supply chain security, so they question their suppliers. Our guide to NIS2 supply chain security covers what to provide when that questionnaire arrives.

What should you check on your OT systems now?

Start with a complete list and with the question of which systems anyone can reach from the internet. Most of the remaining steps follow from those two answers.

1. Build the inventory. Facility management and IT record every networked controller together: manufacturer, model, firmware version, location, support status, and owner.
2. Check exposure. For each system, find out whether its management interface is reachable via a public IP address. Ask your contractors explicitly how they connect.
3. Secure remote access. CERT-FR recommends allowing access only through a secure VPN or protected network, replacing default passwords, and updating firmware. CERT-FR considers filtering by contractor IP addresses an emergency measure only.
4. Deal with discontinued devices. Plan the replacement and take the devices off the internet until then. A factory reset is not enough: according to CERT-FR, it removes an attacker's persistence but leaves the vulnerability open.
5. Bind contractors by contract. Record how the contractor connects, how it authenticates, and how quickly it reports incidents to you. CERT-FR explicitly advises checking your insurance terms before you cut a contractor's connection.
6. Document risk and contingency. Add the scenario to your risk register, and decide how the equipment runs in emergency mode and who gets alerted at night.

A typical example: a food manufacturer with 180 employees runs two cold stores that an external refrigeration contractor maintains through a remote maintenance portal. The inventory reveals three controllers that appear on no list, one of them reachable via a public IP address, and the manufacturer has ended support for the model. As an industrial food producer of this size, the company typically qualifies as an important entity under NIS2. The controllers therefore belong in the scope of its risk management, and the contractor belongs in its supplier assessment.

How Kertos brings OT systems into your ISMS

Kertos is a European compliance platform where companies build their ISMS and manage policies, responsibilities, risks, and evidence in one place. You document production environments and connected equipment there as assets, link them to the relevant risks, and include them in your ISMS scope. The refrigeration controller then sits in the same inventory as the server, with an owner, a risk assessment, and measures.

If you are working toward ISO 27001 certification, Kertos's certified experts guide you through to the audit. So far, every Kertos customer has passed its audit. The technical OT security assessment, such as network segmentation and hardening the controllers, belongs with specialized OT service providers. You then document their results in the ISMS and track open measures there.

Customers value above all the structure the platform brings to certification:

We will show you what that looks like for your sites in a personal demo.

Frequently asked questions

What is OT security?

OT security protects systems that control physical processes, such as refrigeration, building management systems, or production machinery. Its focus is on the availability and safe operation of the equipment, not only on protecting data.

What is the difference between IT and OT security?

IT security mainly protects data and office systems, while OT security protects the control of physical processes. OT equipment often stays in operation long after the manufacturer ends support, and external contractors frequently maintain it remotely. Both make updates and access control harder than in IT.

Does OT fall under NIS2?

NIS2 applies to entities, not to individual systems. If your company falls under NIS2, the ten measures in Art. 21(2) of the directive also apply to your OT systems, in particular supply chain security, vulnerability handling, asset management, and multi-factor authentication.

Does ISO 27001 cover OT security?

Yes, as long as the OT systems sit inside the ISMS scope. Controls such as A.5.9 (inventory), A.8.8 (technical vulnerabilities), and A.8.22 (segregation of networks) then apply to controllers too. If the scope only covers office IT, the certificate says nothing about the equipment.

How were the supermarket refrigeration systems attacked?

The attackers accessed remote controllers whose management interface was reachable directly from the internet and switched the systems into a continuous defrost cycle at up to 50 °C. CERT-FR names the Danfoss AK-SM and AK-SC series as well as Copeland xweb and Dixell xweb. Nobody has yet identified who is behind the attacks.