Today’s article is titled When Cyberattacks Start Fires: France Blames Iran, and the Questions We Have Been Asking for Years. It discusses an update to the refrigeration saga we’ve been following, and we’ll get Sans episodes 42 and 43’s show notes up here. That’s why they’re not linked in the sources section at the end. Feel free to comment if you wish.
For years, I’ve been asking questions about the security of internet-connected devices. Why are certain systems connected to the internet in the first place? Who is responsible for securing them? And what happens when someone gains unauthorized control of equipment that performs an essential function?
In 2014, I discussed the massive Target data breach and the role of a third-party contractor. In July 2024, I questioned the security of internet-connected traffic-light controllers. In my October 23 article about refrigeration controllers, I brought those earlier questions together. More recently, during my coverage of the SANS NewsBites newsletters, I continued asking why refrigerators and freezers need to be accessible through the internet.
Now we have a developing international cybersecurity story that brings those questions together. On November 9, 2026, France publicly attributed destructive cyberattacks against refrigeration equipment at approximately 700 French retail locations to an Iranian state-linked cyber unit. According to French authorities, the attacks caused substantial food losses, significant property damage, and at least 15 fires. This is no longer simply a story about someone stealing information or taking down a website. It is a story about cyberattacks producing physical consequences. And unfortunately, some of the questions I have been asking for years still do not have satisfactory answers.
What happened in France?
During the night of October 11-12, 2026, attackers compromised industrial refrigeration controllers used by supermarkets and other food-related businesses in France.
Rather than simply disabling the equipment, the attackers manipulated legitimate defrosting functions and changed temperature settings. Refrigeration equipment that should have preserved food instead operated under conditions that caused products to spoil.
Early reporting estimated that between 250 and 350 supermarkets were affected. Subsequent investigations revealed a substantially larger operation.
According to a statement from the French Ministry for Europe and Foreign Affairs, refrigeration controllers at more than 700 retail locations were targeted.
French authorities reported tens of millions of euros in food losses and at least 15 fires. The affected businesses included major supermarket chains, smaller butcher shops, food-processing facilities, and a slaughterhouse.
Think about that for a moment. Someone sitting at a computer was reportedly able to manipulate equipment at hundreds of locations, destroy merchandise, and contribute to fires. That is a significant escalation from the ordinary data breaches we regularly discuss on The Security Box.
France identifies an Iranian cyber unit
On November 9, France announced that its investigation attributed the October attacks to Shahid Kaveh, an offensive cyber unit associated with Iran’s Islamic Revolutionary Guard Corps. France’s Cyber Crisis Coordination Centre, known as C4, published a technical assessment describing the evidence behind that conclusion.
According to the French government’s technical report, investigators identified connections between infrastructure used in the refrigeration attacks and reconnaissance activity involving other industrial control systems.
Investigators also examined the attackers’ use of the FOFA internet-connected device search platform, communications associated with a propaganda outlet linked to Shahid Kaveh, and Farsi-language artifacts.
French authorities associated the unit with several online identities, including CyberAv3ngers and Soldiers of Solomon.
The investigation also identified attacks against Schneider Electric equipment at small hydroelectric facilities during the same period, although the reported effects were comparatively limited.
France has announced plans to pursue additional European Union sanctions against individuals and organizations involved in malicious cyber operations. Iran has denied responsibility for the attacks.
There is an important distinction here. France has made a formal government attribution supported by a published technical assessment. That is considerably stronger than an anonymous social media claim. Nevertheless, the attribution remains the conclusion of French authorities, and not every investigative detail has been independently established in public.
We should also avoid assuming that every similar refrigeration attack was conducted by the same group.
We were already asking questions in SANS episodes 43 and 44
When I restarted my SANS NewsBites coverage, I certainly did not expect refrigeration equipment to become one of the most important cybersecurity subjects we would discuss. But the warning signs were already there.
In SANS episode 43, covering the October 13 newsletter, we discussed attacks against French supermarket refrigeration systems. My question was straightforward: “Why the hell do refrigerators and freezers need to be connected to the Internet?”
I understood the legitimate reasons for remote monitoring. Businesses need to know when equipment malfunctions. Maintenance contractors may need diagnostic information, and temperature alerts can prevent merchandise losses. But monitoring equipment and remotely controlling its operation are not the same thing. Why should a remotely accessible controller be capable of placing refrigeration equipment into an unsafe operating condition? Why should an attacker be able to change temperatures without independent protective systems intervening?
In episode 44, covering the October 16 newsletter, we learned that the attacks involved controllers from multiple manufacturers, including Danfoss and Dixell/Copeland equipment. Some of the affected controller models had documented security weaknesses, outdated firmware, or limited support.
That introduced another question: Who is responsible when industrial equipment remains mechanically functional but its software is no longer secure? The supermarket? The equipment manufacturer? The maintenance contractor? The company responsible for remote monitoring? If everybody assumes someone else is responsible, nobody may be doing the work.
We also need to distinguish documented vulnerabilities from proven exploitation methods. The existence of a vulnerable controller does not establish precisely which weakness an attacker used during a particular incident. That distinction matters when investigating cybersecurity incidents and recommending corrective action.
The attacks spread beyond France
The original October attacks were followed by another wave of incidents in early November. The November 3 SANS NewsBites newsletter described refrigeration disruptions at more than 100 retail locations across several European countries, including Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands, and Sweden. Reports described attackers manipulating remote management interfaces, changing temperature settings, and disrupting commercial refrigeration equipment. The attacks demonstrated how similar weaknesses across widely deployed equipment can affect otherwise unrelated businesses.
There is an important investigative limitation: The November incidents have not all been formally attributed to Shahid Kaveh or another specific organization. The similarity of the attacks raises questions about shared equipment, vulnerabilities, methods, and possible perpetrators. Similarity alone does not prove common responsibility. France’s November 9 attribution concerns the October attacks against French interests.
When blood supplies become a target
The November 6 SANS NewsBites newsletter introduced a particularly disturbing development. Refrigeration equipment associated with the French Blood Establishment, known as EFS, was affected by a cybersecurity incident involving one of its equipment providers. Temperature and defrost settings were manipulated at three facilities storing blood-related products.
Fortunately, monitoring and alarm systems detected the abnormal conditions, allowing personnel to relocate the affected products. This is an important example of why independent monitoring and operational safeguards matter. But consider what could have happened if the alarms had failed or nobody had responded quickly enough.
Blood products, medicines, vaccines, and other temperature-sensitive medical supplies can become unusable when storage conditions exceed acceptable limits. That creates consequences beyond financial losses. We could be discussing the availability of essential medical supplies and the ability of healthcare facilities to provide treatment.
To be clear, the reported EFS incident does not establish that blood products were lost or that patients were harmed. The successful response is part of the story and deserves recognition. It also demonstrates why cybersecurity cannot be separated from physical safety.
What about the American military commissaries?
Another question appeared in our earlier SANS coverage. During August 2026, refrigeration failures were reported at commissaries on several United States military installations. Subsequent reporting indicated that investigators were examining whether those incidents involved malicious cyber activity. Similarities between the American incidents and the European refrigeration attacks are worth investigating.
However, as of November 11, there is no publicly established conclusion that the same attackers were responsible, or that every American refrigeration failure resulted from a cyberattack. We should not turn an investigative possibility into an established fact. That said, the potential implications for military food supplies and other essential services are serious enough to justify continued investigation.
Five United States government agencies issue a warning
The November 10 SANS NewsBites newsletter reported another significant development. Five federal agencies, including the Cybersecurity and Infrastructure Security Agency, the FBI, the Department of Health and Human Services, the Department of Agriculture, and the Department of Transportation, jointly issued guidance addressing industrial refrigeration and cold-chain monitoring systems. The guidance addressed risks involving weak configurations, authentication bypass, arbitrary code injection, and exposed industrial equipment. Organizations were urged to remove vulnerable systems from direct public internet exposure and strengthen the security of equipment supporting critical services.
The involvement of the Department of Transportation particularly caught my attention. Refrigeration and cold-chain systems support more than supermarkets. They are involved in the movement and storage of food, medical supplies, and other temperature-sensitive materials. Transportation systems also depend on industrial equipment, communications networks, monitoring systems, and third-party maintenance arrangements. That does not mean a transit agency has been compromised by the same attackers. It means the underlying security principles apply well beyond the grocery industry. Any organization operating equipment that can affect public safety should understand who can access it, how that access is controlled, and what happens if digital controls fail.
The Target breach should have taught us something
Back in February 2014, I covered the Target data breach and the role of a third-party contractor. As Brian Krebs reported, attackers obtained credentials associated with Fazio Mechanical Services, a refrigeration and HVAC contractor that worked with Target. Those credentials became part of the attackers’ path into Target’s environment, ultimately contributing to the compromise of payment-card information. Fazio subsequently clarified that its access concerned billing, contracts, and project management, rather than remote operation of Target’s refrigeration equipment.
That distinction is important. The Target breach was not an example of attackers remotely manipulating industrial refrigeration controls. It was an example of third-party access contributing to a major security compromise. More than a decade later, we are still asking whether organizations properly understand the access granted to contractors, vendors, and service providers.
How many companies know every outside organization that can remotely connect to their systems? How many regularly review those permissions? And how many can immediately revoke that access if a contractor’s systems become compromised? The technology has changed, but the underlying responsibility has not.
Traffic lights raised similar questions in 2024
In July 2024, I published an article titled Why Do We Have Traffic Lights and Their Controllers Online on the Internet? That article discussed security research involving traffic-light controllers and the risks associated with exposed management interfaces. One of the important findings was that independent safety equipment reportedly prevented certain dangerous signal combinations, even though other forms of disruption remained possible. That is exactly the kind of distinction we need to make when discussing refrigeration systems.
A remotely controlled device should not be able to exceed critical safety limits simply because somebody has gained access to its administrative interface. Independent safeguards can help prevent a compromised control system from becoming a physical disaster. Whether we are discussing traffic lights, refrigeration equipment, building management systems, or transportation infrastructure, the same question applies. What prevents an unauthorized command from creating an unsafe physical condition?
Why are we still connecting everything to the internet?
I’m not opposed to remote monitoring. I’m not suggesting that businesses abandon technology or return to entirely manual operations. There are legitimate reasons to monitor equipment remotely, identify problems, and provide maintenance services. But there is a substantial difference between allowing equipment to report its operating condition and allowing someone on a remote network to change how it operates.
If a business only needs temperature information, why should an internet-accessible interface also permit someone to change critical temperature settings? If remote maintenance is necessary, why isn’t access restricted to authorized personnel using strong authentication, monitored connections, and appropriate network separation? And why are unsupported controllers still operating with publicly reachable management interfaces?
These are not new cybersecurity concepts. They involve basic principles such as limiting access, maintaining equipment inventories, updating supported systems, replacing obsolete technology, and providing independent safety mechanisms.
Organizations should also test whether their emergency procedures actually work. Can employees recognize an abnormal temperature change? Can they disconnect compromised remote access? Can they operate equipment locally? Are alarms independent of the controller being manipulated? Can essential inventory be relocated before it becomes unusable? These questions should be answered before an incident, not during one.
Manufacturers and service providers must share responsibility
One of the recurring subjects in our SANS coverage has been software manufacturer accountability. The October 30 SANS newsletter discussed proposals in the United Kingdom to examine responsibility for breaches involving insecure software products. That discussion is relevant here.
Industrial equipment may remain in service for many years after its original installation. A refrigeration controller can continue performing its mechanical function long after its software becomes outdated. But equipment that still works is not necessarily equipment that is still secure.
Manufacturers should clearly communicate support periods, known vulnerabilities, security requirements, and replacement options. Service providers should secure remote connections and maintain appropriate access controls. Organizations operating the equipment should understand their exposure, maintain inventories, and establish practical plans for replacing systems that can no longer be protected. Responsibility should not disappear somewhere between the manufacturer, installer, contractor, and customer. And when equipment supports essential services, security needs to be part of its design and operational lifecycle, not an optional feature considered after an incident.
What we know and what remains unanswered
As of November 11, 2026, several important facts have emerged. French authorities have documented a large-scale October cyberattack against industrial refrigeration controllers. They report substantial merchandise losses and at least 15 fires. France has formally attributed that campaign to Shahid Kaveh, an Iranian Revolutionary Guard cyber unit, based on a technical and intelligence investigation. Iran denies responsibility. Additional refrigeration attacks have occurred across Europe, and incidents involving French blood-storage facilities demonstrate the potential risks to healthcare. United States government agencies have issued joint guidance addressing the security of industrial refrigeration and cold-chain monitoring systems.
However, several questions remain unresolved. We do not have a complete public accounting of the exact compromise method used at every affected location. We cannot assume that every vulnerable controller was exploited in the same way. We also cannot conclude that the November European attacks or the August American military commissary incidents were conducted by Shahid Kaveh simply because they involved similar equipment or effects. And we still need answers about the roles of equipment manufacturers, contractors, remote maintenance providers, and operators in preventing these attacks.
Those uncertainties should be investigated rather than filled with speculation.
My final thoughts
When I first asked why refrigerators and freezers needed to be connected to the internet, I was asking a practical cybersecurity question.
I wasn’t expecting that question to develop into a story involving hundreds of businesses, fires, international investigations, and an accusation of state-sponsored sabotage. But here we are. The Target breach demonstrated how third-party access can contribute to a major compromise. The traffic-light research raised questions about remotely accessible control systems and independent safeguards. The refrigeration attacks show what can happen when attackers manipulate equipment responsible for protecting essential goods. These are different incidents, and they should not be presented as one continuous attack campaign.
But they illustrate a recurring problem. We continue connecting important systems to networks without always giving sufficient attention to the consequences of unauthorized access. Then, when something goes wrong, we ask why the systems were exposed, why safeguards failed, and who was supposed to be responsible. I’ve been asking versions of those questions for years, both on my blog and through The Security Box.
Perhaps the question now is whether manufacturers, operators, and governments are prepared to provide meaningful answers. Because this time, we aren’t just talking about stolen passwords, compromised credit cards, or inaccessible websites. We’re talking about spoiled food, damaged equipment, fires, and potentially essential medical supplies. As I’ve said before, what could possibly go wrong?
Apparently, quite a lot.
And unless we take the security of operational technology seriously, I suspect this will not be the last time we’re having this conversation.
Sources and previous coverage
- BleepingComputer: France blames Iranian hackers for supermarket attacks that sparked fires, November 9, 2026
- French Ministry for Europe and Foreign Affairs: Declaration of attribution to Iran of cyber attacks against France
- French Cyber Crisis Coordination Centre: Technical attribution report, November 9, 2026
- Recorded Future News: France blames Iran for fridge cyberattacks
- Reuters: French officials blame Iran for refrigerator hacks
- BleepingComputer: Initial October refrigeration attacks
- Krebs on Security: Target hackers broke in via HVAC company, February 2014
- Jared Rimer: Target hackers broke in via HVAC company, February 5, 2014
- Jared Rimer: Why Do We Have Traffic Lights and Their Controllers Online on the Internet?, July 22, 2024
- SANS NewsBites: October 9, October 13, October 16, October 23, October 30, November 3, November 6, and November 10, 2026.
- The Security Box SANS NewsBites episodes 42 through 45, including Jared Rimer’s commentary and follow-up questions.
- SANS NewsBites, October 30, 2026 (working newsletter)
- SANS NewsBites, November 3, 2026
- SANS NewsBites, November 6, 2026
- SANS NewsBites, November 10, 2026
Related
Discover more from Jared's Technology podcast network
Subscribe to get the latest posts sent to your email.
When Cyberattacks Start Fires: France Blames Iran, and the Questions We Have Been Asking for Years
Today’s article is titled When Cyberattacks Start Fires: France Blames Iran, and the Questions We Have Been Asking for Years. It discusses an update to the refrigeration saga we’ve been following, and we’ll get Sans episodes 42 and 43’s show notes up here. That’s why they’re not linked in the sources section at the end. Feel free to comment if you wish.
For years, I’ve been asking questions about the security of internet-connected devices. Why are certain systems connected to the internet in the first place? Who is responsible for securing them? And what happens when someone gains unauthorized control of equipment that performs an essential function?
In 2014, I discussed the massive Target data breach and the role of a third-party contractor. In July 2024, I questioned the security of internet-connected traffic-light controllers. In my October 23 article about refrigeration controllers, I brought those earlier questions together. More recently, during my coverage of the SANS NewsBites newsletters, I continued asking why refrigerators and freezers need to be accessible through the internet.
Now we have a developing international cybersecurity story that brings those questions together. On November 9, 2026, France publicly attributed destructive cyberattacks against refrigeration equipment at approximately 700 French retail locations to an Iranian state-linked cyber unit. According to French authorities, the attacks caused substantial food losses, significant property damage, and at least 15 fires. This is no longer simply a story about someone stealing information or taking down a website. It is a story about cyberattacks producing physical consequences. And unfortunately, some of the questions I have been asking for years still do not have satisfactory answers.
What happened in France?
During the night of October 11-12, 2026, attackers compromised industrial refrigeration controllers used by supermarkets and other food-related businesses in France.
Rather than simply disabling the equipment, the attackers manipulated legitimate defrosting functions and changed temperature settings. Refrigeration equipment that should have preserved food instead operated under conditions that caused products to spoil.
Early reporting estimated that between 250 and 350 supermarkets were affected. Subsequent investigations revealed a substantially larger operation.
According to a statement from the French Ministry for Europe and Foreign Affairs, refrigeration controllers at more than 700 retail locations were targeted.
French authorities reported tens of millions of euros in food losses and at least 15 fires. The affected businesses included major supermarket chains, smaller butcher shops, food-processing facilities, and a slaughterhouse.
Think about that for a moment. Someone sitting at a computer was reportedly able to manipulate equipment at hundreds of locations, destroy merchandise, and contribute to fires. That is a significant escalation from the ordinary data breaches we regularly discuss on The Security Box.
France identifies an Iranian cyber unit
On November 9, France announced that its investigation attributed the October attacks to Shahid Kaveh, an offensive cyber unit associated with Iran’s Islamic Revolutionary Guard Corps. France’s Cyber Crisis Coordination Centre, known as C4, published a technical assessment describing the evidence behind that conclusion.
According to the French government’s technical report, investigators identified connections between infrastructure used in the refrigeration attacks and reconnaissance activity involving other industrial control systems.
Investigators also examined the attackers’ use of the FOFA internet-connected device search platform, communications associated with a propaganda outlet linked to Shahid Kaveh, and Farsi-language artifacts.
French authorities associated the unit with several online identities, including CyberAv3ngers and Soldiers of Solomon.
The investigation also identified attacks against Schneider Electric equipment at small hydroelectric facilities during the same period, although the reported effects were comparatively limited.
France has announced plans to pursue additional European Union sanctions against individuals and organizations involved in malicious cyber operations. Iran has denied responsibility for the attacks.
There is an important distinction here. France has made a formal government attribution supported by a published technical assessment. That is considerably stronger than an anonymous social media claim. Nevertheless, the attribution remains the conclusion of French authorities, and not every investigative detail has been independently established in public.
We should also avoid assuming that every similar refrigeration attack was conducted by the same group.
We were already asking questions in SANS episodes 43 and 44
When I restarted my SANS NewsBites coverage, I certainly did not expect refrigeration equipment to become one of the most important cybersecurity subjects we would discuss. But the warning signs were already there.
In SANS episode 43, covering the October 13 newsletter, we discussed attacks against French supermarket refrigeration systems. My question was straightforward: “Why the hell do refrigerators and freezers need to be connected to the Internet?”
I understood the legitimate reasons for remote monitoring. Businesses need to know when equipment malfunctions. Maintenance contractors may need diagnostic information, and temperature alerts can prevent merchandise losses. But monitoring equipment and remotely controlling its operation are not the same thing. Why should a remotely accessible controller be capable of placing refrigeration equipment into an unsafe operating condition? Why should an attacker be able to change temperatures without independent protective systems intervening?
In episode 44, covering the October 16 newsletter, we learned that the attacks involved controllers from multiple manufacturers, including Danfoss and Dixell/Copeland equipment. Some of the affected controller models had documented security weaknesses, outdated firmware, or limited support.
That introduced another question: Who is responsible when industrial equipment remains mechanically functional but its software is no longer secure? The supermarket? The equipment manufacturer? The maintenance contractor? The company responsible for remote monitoring? If everybody assumes someone else is responsible, nobody may be doing the work.
We also need to distinguish documented vulnerabilities from proven exploitation methods. The existence of a vulnerable controller does not establish precisely which weakness an attacker used during a particular incident. That distinction matters when investigating cybersecurity incidents and recommending corrective action.
The attacks spread beyond France
The original October attacks were followed by another wave of incidents in early November. The November 3 SANS NewsBites newsletter described refrigeration disruptions at more than 100 retail locations across several European countries, including Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands, and Sweden. Reports described attackers manipulating remote management interfaces, changing temperature settings, and disrupting commercial refrigeration equipment. The attacks demonstrated how similar weaknesses across widely deployed equipment can affect otherwise unrelated businesses.
There is an important investigative limitation: The November incidents have not all been formally attributed to Shahid Kaveh or another specific organization. The similarity of the attacks raises questions about shared equipment, vulnerabilities, methods, and possible perpetrators. Similarity alone does not prove common responsibility. France’s November 9 attribution concerns the October attacks against French interests.
When blood supplies become a target
The November 6 SANS NewsBites newsletter introduced a particularly disturbing development. Refrigeration equipment associated with the French Blood Establishment, known as EFS, was affected by a cybersecurity incident involving one of its equipment providers. Temperature and defrost settings were manipulated at three facilities storing blood-related products.
Fortunately, monitoring and alarm systems detected the abnormal conditions, allowing personnel to relocate the affected products. This is an important example of why independent monitoring and operational safeguards matter. But consider what could have happened if the alarms had failed or nobody had responded quickly enough.
Blood products, medicines, vaccines, and other temperature-sensitive medical supplies can become unusable when storage conditions exceed acceptable limits. That creates consequences beyond financial losses. We could be discussing the availability of essential medical supplies and the ability of healthcare facilities to provide treatment.
To be clear, the reported EFS incident does not establish that blood products were lost or that patients were harmed. The successful response is part of the story and deserves recognition. It also demonstrates why cybersecurity cannot be separated from physical safety.
What about the American military commissaries?
Another question appeared in our earlier SANS coverage. During August 2026, refrigeration failures were reported at commissaries on several United States military installations. Subsequent reporting indicated that investigators were examining whether those incidents involved malicious cyber activity. Similarities between the American incidents and the European refrigeration attacks are worth investigating.
However, as of November 11, there is no publicly established conclusion that the same attackers were responsible, or that every American refrigeration failure resulted from a cyberattack. We should not turn an investigative possibility into an established fact. That said, the potential implications for military food supplies and other essential services are serious enough to justify continued investigation.
Five United States government agencies issue a warning
The November 10 SANS NewsBites newsletter reported another significant development. Five federal agencies, including the Cybersecurity and Infrastructure Security Agency, the FBI, the Department of Health and Human Services, the Department of Agriculture, and the Department of Transportation, jointly issued guidance addressing industrial refrigeration and cold-chain monitoring systems. The guidance addressed risks involving weak configurations, authentication bypass, arbitrary code injection, and exposed industrial equipment. Organizations were urged to remove vulnerable systems from direct public internet exposure and strengthen the security of equipment supporting critical services.
The involvement of the Department of Transportation particularly caught my attention. Refrigeration and cold-chain systems support more than supermarkets. They are involved in the movement and storage of food, medical supplies, and other temperature-sensitive materials. Transportation systems also depend on industrial equipment, communications networks, monitoring systems, and third-party maintenance arrangements. That does not mean a transit agency has been compromised by the same attackers. It means the underlying security principles apply well beyond the grocery industry. Any organization operating equipment that can affect public safety should understand who can access it, how that access is controlled, and what happens if digital controls fail.
The Target breach should have taught us something
Back in February 2014, I covered the Target data breach and the role of a third-party contractor. As Brian Krebs reported, attackers obtained credentials associated with Fazio Mechanical Services, a refrigeration and HVAC contractor that worked with Target. Those credentials became part of the attackers’ path into Target’s environment, ultimately contributing to the compromise of payment-card information. Fazio subsequently clarified that its access concerned billing, contracts, and project management, rather than remote operation of Target’s refrigeration equipment.
That distinction is important. The Target breach was not an example of attackers remotely manipulating industrial refrigeration controls. It was an example of third-party access contributing to a major security compromise. More than a decade later, we are still asking whether organizations properly understand the access granted to contractors, vendors, and service providers.
How many companies know every outside organization that can remotely connect to their systems? How many regularly review those permissions? And how many can immediately revoke that access if a contractor’s systems become compromised? The technology has changed, but the underlying responsibility has not.
Traffic lights raised similar questions in 2024
In July 2024, I published an article titled Why Do We Have Traffic Lights and Their Controllers Online on the Internet? That article discussed security research involving traffic-light controllers and the risks associated with exposed management interfaces. One of the important findings was that independent safety equipment reportedly prevented certain dangerous signal combinations, even though other forms of disruption remained possible. That is exactly the kind of distinction we need to make when discussing refrigeration systems.
A remotely controlled device should not be able to exceed critical safety limits simply because somebody has gained access to its administrative interface. Independent safeguards can help prevent a compromised control system from becoming a physical disaster. Whether we are discussing traffic lights, refrigeration equipment, building management systems, or transportation infrastructure, the same question applies. What prevents an unauthorized command from creating an unsafe physical condition?
Why are we still connecting everything to the internet?
I’m not opposed to remote monitoring. I’m not suggesting that businesses abandon technology or return to entirely manual operations. There are legitimate reasons to monitor equipment remotely, identify problems, and provide maintenance services. But there is a substantial difference between allowing equipment to report its operating condition and allowing someone on a remote network to change how it operates.
If a business only needs temperature information, why should an internet-accessible interface also permit someone to change critical temperature settings? If remote maintenance is necessary, why isn’t access restricted to authorized personnel using strong authentication, monitored connections, and appropriate network separation? And why are unsupported controllers still operating with publicly reachable management interfaces?
These are not new cybersecurity concepts. They involve basic principles such as limiting access, maintaining equipment inventories, updating supported systems, replacing obsolete technology, and providing independent safety mechanisms.
Organizations should also test whether their emergency procedures actually work. Can employees recognize an abnormal temperature change? Can they disconnect compromised remote access? Can they operate equipment locally? Are alarms independent of the controller being manipulated? Can essential inventory be relocated before it becomes unusable? These questions should be answered before an incident, not during one.
Manufacturers and service providers must share responsibility
One of the recurring subjects in our SANS coverage has been software manufacturer accountability. The October 30 SANS newsletter discussed proposals in the United Kingdom to examine responsibility for breaches involving insecure software products. That discussion is relevant here.
Industrial equipment may remain in service for many years after its original installation. A refrigeration controller can continue performing its mechanical function long after its software becomes outdated. But equipment that still works is not necessarily equipment that is still secure.
Manufacturers should clearly communicate support periods, known vulnerabilities, security requirements, and replacement options. Service providers should secure remote connections and maintain appropriate access controls. Organizations operating the equipment should understand their exposure, maintain inventories, and establish practical plans for replacing systems that can no longer be protected. Responsibility should not disappear somewhere between the manufacturer, installer, contractor, and customer. And when equipment supports essential services, security needs to be part of its design and operational lifecycle, not an optional feature considered after an incident.
What we know and what remains unanswered
As of November 11, 2026, several important facts have emerged. French authorities have documented a large-scale October cyberattack against industrial refrigeration controllers. They report substantial merchandise losses and at least 15 fires. France has formally attributed that campaign to Shahid Kaveh, an Iranian Revolutionary Guard cyber unit, based on a technical and intelligence investigation. Iran denies responsibility. Additional refrigeration attacks have occurred across Europe, and incidents involving French blood-storage facilities demonstrate the potential risks to healthcare. United States government agencies have issued joint guidance addressing the security of industrial refrigeration and cold-chain monitoring systems.
However, several questions remain unresolved. We do not have a complete public accounting of the exact compromise method used at every affected location. We cannot assume that every vulnerable controller was exploited in the same way. We also cannot conclude that the November European attacks or the August American military commissary incidents were conducted by Shahid Kaveh simply because they involved similar equipment or effects. And we still need answers about the roles of equipment manufacturers, contractors, remote maintenance providers, and operators in preventing these attacks.
Those uncertainties should be investigated rather than filled with speculation.
My final thoughts
When I first asked why refrigerators and freezers needed to be connected to the internet, I was asking a practical cybersecurity question.
I wasn’t expecting that question to develop into a story involving hundreds of businesses, fires, international investigations, and an accusation of state-sponsored sabotage. But here we are. The Target breach demonstrated how third-party access can contribute to a major compromise. The traffic-light research raised questions about remotely accessible control systems and independent safeguards. The refrigeration attacks show what can happen when attackers manipulate equipment responsible for protecting essential goods. These are different incidents, and they should not be presented as one continuous attack campaign.
But they illustrate a recurring problem. We continue connecting important systems to networks without always giving sufficient attention to the consequences of unauthorized access. Then, when something goes wrong, we ask why the systems were exposed, why safeguards failed, and who was supposed to be responsible. I’ve been asking versions of those questions for years, both on my blog and through The Security Box.
Perhaps the question now is whether manufacturers, operators, and governments are prepared to provide meaningful answers. Because this time, we aren’t just talking about stolen passwords, compromised credit cards, or inaccessible websites. We’re talking about spoiled food, damaged equipment, fires, and potentially essential medical supplies. As I’ve said before, what could possibly go wrong?
Apparently, quite a lot.
And unless we take the security of operational technology seriously, I suspect this will not be the last time we’re having this conversation.
Sources and previous coverage
Share this:
Like this:
Related
Discover more from Jared's Technology podcast network
Subscribe to get the latest posts sent to your email.
Published in article commentary