FREDALARM / BLOG
When someone tampers with refrigeration from afar
The supermarket has closed. The lights are still on and the cold rooms seem to be in order. But let's imagine that someone, from the outside, has changed what they shouldn't have.
The cold does not disappear suddenly. The temperature begins to move slowly, while a panel can continue to transmit a tranquility that no longer corresponds to what is happening inside. The scene serves to raise a very specific question: if the system that governs refrigeration fails, who checks that the product continues at the expected temperature?
From investigation to alert
On August 9, 2026, Claroty's Team82 team published research on vulnerabilities in Danfoss and Copeland refrigeration monitoring platforms. A physical demonstration with XWEB Pro showed that compromising the supervisor could allow the operation to be manipulated and the information presented to be falsified. Manufacturers released fixes. It was security research, not an account of an attack suffered by a FredAlarm customer.
On October 12, 2026, the French CERT-FR alerted of multiple compromises of Danfoss AK-SM and AK-SC, Copeland XWEB and Dixell XWEB remote refrigeration controllers. It recommended removing management interfaces from direct Internet exposure and protecting remote access. Your alert does not demonstrate that exactly the vulnerabilities in those investigations were used.
A second measure provides another perspective
FredAlarm's proposal is simple: measure the temperature with its own probe and follow its evolution, as a complement to the system that regulates the cold room. If the actual temperature deviates from the configured limits, monitoring can generate a warning without having to rely exclusively on what the refrigeration controller displays.
This additional reading can help you quickly discover the consequences of manipulation. When the warning is received depends on the measurement interval, thresholds, delays and connectivity. It does not identify a cyber attack on its own, nor does it guarantee detecting it at the first moment. What it provides is an additional physical check and a record to investigate.
Supervise without governing the cold
FredAlarm does not modify the setpoint, does not order the compressor to start and does not replace the controller. Its LoRa, Modbus or PLC devices collect measurements and states through a gateway. This carries the information via MQTT through an encrypted connection to the platform, where those responsible consult the cold rooms, logs and alarms.
A standalone probe does not make the entire installation immune to attack: the network, gateway, accounts and accesses also need protection. Monitoring complements the maintenance and safety measures of the cooling system. It does not replace them.
Sometimes there is no hacker
A thermal that has tripped or a setpoint changed by mistake can end up producing a similar deviation. In supervised installations we have discovered incidents of both types after checking what was happening. The temperature curve helps to locate the beginning of the problem and to compare before and after the intervention.
The advantage is having information when there is still room to check the cold room and decide what to do with the product. It is not necessary to determine in advance whether the origin will be an oversight, a breakdown or manipulation. We need to know that the cold is no longer behaving as it should.