A refrigeration controller does not look like a computer. But if a supplier can reach it remotely, it has an account, a network path and a security boundary that somebody needs to understand.
Recent reporting has made that point concrete. BBC News reported refrigeration disruption at supermarkets in Belgium, Sweden and Ireland. UK trade publication Food Manufacture reported that several meat suppliers had experienced unexpected changes to refrigeration settings. It said the Association of Independent Meat Suppliers had contacted the NCSC. The suppliers were not named, and no connection with the supermarket incidents was established.
The attacker and access method have not been established publicly. The question for another business is therefore not whether it operates the same controller. It is whether any important operational equipment can be reached from outside the premises, and who owns that access.
Table of Contents
Why refrigeration controllers have become a wider business question
France’s national cyber incident response team, CERT-FR, confirmed numerous compromises involving Danfoss AK-SC and AK-SM controllers, Copeland xweb and Dixell xweb. Its guidance says that exposing a management interface directly to the internet is contrary to good practice. It advises removing public exposure and restoring access through a secure VPN or protected network, alongside the equipment manufacturer’s security guidance.
Separately, Copeland’s November 2024 standing security notice for XWEB PRO says never to expose the controller to the broader internet. It recommends restricting administrative and control-system communications through firewall and network configuration. The notice predates the current incidents and is included as manufacturer guidance, not as evidence of how access was gained.
The NCSC’s 2026 annual-review announcement asks organisations not to have technology unnecessarily connected to the internet.
None of that means every remotely managed device is unsafe. Remote access may be essential for monitoring, maintenance or specialist support. The business question is whether the route is necessary, controlled and understood.
What counts as internet-connected operational equipment?
Start with equipment that affects the physical operation of a site or a customer-facing service. Depending on the business, that might include:
- refrigeration or environmental controls;
- heating, ventilation or building-management systems;
- CCTV and access-control equipment;
- alarms, sensors and monitoring devices;
- production, warehouse or specialist machinery;
- energy, lighting or telemetry systems.
For each system, separate four things that are often blurred together:
- the specialist equipment;
- the network path or internet connection it uses;
- the account or remote-access method used to reach it;
- the people and suppliers responsible for each part.
The refrigeration engineer may understand the controller but not own the firewall. The network provider may manage the firewall but not the equipment settings. An internal facilities lead may own the business process without holding either supplier contract. The gap appears when everybody assumes another party has the complete view.
Five checks for remotely managed business equipment
1. List the equipment and the business consequence
Create a short register of operational equipment with network or remote-management capability. Record its location, purpose and what would happen if it stopped, became unavailable or had its settings changed.
Keep the consequence specific. For example:
- stock could move outside an agreed temperature range;
- a door or barrier might not operate as expected;
- staff could lose access to a working area;
- an alarm or sensor could stop reporting;
- production or customer service could pause.
Do not begin with a technical product list. Begin with the business activity that depends on the equipment.
2. Confirm how remote access reaches it
Ask the equipment supplier to describe the remote route in plain English.
Questions to ask include:
- Is there a web-management interface, and is it reachable directly from a public internet address?
- Does the supplier connect through a VPN or another protected route?
- Is access always available, or enabled only when required?
- Does the equipment share a network with staff or guest devices, and which firewall rule permits the connection?
A phrase such as “the supplier logs in remotely” is not enough. The business needs to know the route, the owner and why the access remains necessary.
If the answer reveals direct public exposure, coordinate any change with the specialist maintainer and the network or firewall provider. The section below explains why an unplanned disconnection can create another problem.
3. Name the business owner and specialist supplier
Every remotely managed operational system needs a named business owner, even when a third party maintains it.
Record the internal business owner, specialist maintainer and network or firewall provider. State who approves remote access, who may change settings and who removes access when a supplier or engineer changes.
This does not make the internal owner a technical administrator. It gives the business one person who can confirm why the access exists, which suppliers are involved and who needs to act when something changes.
This is the same ownership principle that applies to VPNs, firewall rules and supplier access, but applied to equipment that may sit outside the usual IT inventory.
4. Check credentials, updates and support status
Ask who manages the accounts used by internal staff and external suppliers.
Confirm whether:
- default credentials have been changed and shared accounts are still necessary;
- former suppliers or staff retain access;
- stronger authentication is enabled where supported;
- firmware, security updates and manufacturer support have a named owner;
- the configuration can be recovered after a reset or replacement.
Do not assume that an equipment service contract includes network security, or that a managed network contract includes the specialist controller. Compare the written scopes and resolve the gap explicitly.
5. Agree alerting, response and continuity
A useful alert must reach somebody who knows what to do next.
For each important system, decide:
- which conditions should trigger an alert and who receives it;
- who checks whether the change was authorised;
- which specialist supplier needs to be contacted;
- whether access should be restricted during investigation and how the business continues safely meanwhile.
The response will differ by system. A refrigeration controller, access-control panel and CCTV recorder have different safety, operational and supplier requirements. The plan should preserve those distinctions rather than reduce everything to “call IT”.
Link this register to the wider business recovery plan so that operational equipment is not forgotten when priorities are agreed.
Do not disconnect operational equipment without a plan
Removing unnecessary public exposure is a sensible objective. Cutting a connection without understanding it can create another problem.
The route may support alarms, maintenance data or urgent specialist support. CERT-FR advises organisations to check relevant contractual conditions before interrupting data sent to a refrigeration provider.
Before changing a firewall rule, cable or account, get the internal business owner, specialist equipment maintainer, network or firewall provider and whoever is responsible for continuity and safety to agree the change. Confirm how normal service will be verified and how the previous configuration could be restored if needed.
Where 1Connect fits
1Connect can help where the uncertainty sits around the business network, firewall policy, secure remote access or ownership of managed infrastructure.
Sentinel brings agreed networking, firewall, monitoring and remote-access responsibilities into one managed environment. The boundary is agreed so the business and its suppliers know which parts 1Connect manages. A specialist refrigeration, HVAC, CCTV or access-control system remains the responsibility of the appropriate equipment provider unless a different written scope has been agreed.
The objective is not to pretend that one supplier owns every device. It is to make the boundary clear enough that the equipment specialist, network provider and business owner can act together.
See A better way to run your business network for the wider operating model.
A next step
Create a one-page register with one row for each important connected system. Include:
- equipment, location, purpose and business consequence;
- network or internet route;
- specialist supplier and internal owner;
- account and remote-access owner;
- manufacturer support and update owner;
- alert destination, first response and continuity action.
If the network, firewall or remote-access boundary is unclear, talk to 1Connect about whether Sentinel fits that part of your infrastructure.
