Security
Is your refrigeration controller exposed? The CERT-FR list in plain English
The recommendations of 16 October 2026 from CERT-FR, the French government's cyber alert centre, rephrased for site operators. The official text remains the reference.
Published on 4 November 2026 2 min read
In this article
This article rephrases the alert from CERT-FR, the French government's cyber alert centre, for people running a shop or warehouse, in its version of 16 October 2026. The official text remains the reference: read alert CERTFR-2026-ALE-012 (in French), and bring in your refrigeration engineer or your IT provider.
The first question to ask
Can your refrigeration controller or supervisor be reached from the internet, on a public IP address? CERT-FR points out that exposing a management interface on the internet goes against good practice. Put the question to your provider and ask for a written answer. The alert targets specific equipment, listed in the official text, but this reminder applies to any exposed unit.
If the equipment does not appear to be compromised
- Remove internet exposure from the units concerned and from all those exposed on a public IP address.
- Check your insurance contract before cutting off the data feed to your refrigeration contractor.
- Check the entire configuration, especially the defrost schedules.
- Restore access only through a secure VPN or a protected network. In an emergency, filtering contractors' addresses on a firewall is possible, but CERT-FR specifies that this is not a lasting solution.
- Apply the manufacturer's good practice: firmware updates, default passwords changed, suitable security level.
If the equipment is compromised
- Remove internet exposure, and check your insurance contract as above.
- Restart the equipment, or failing that restore it, following the official text.
- Restore access only through a VPN or a protected network.
- Reconfigure the equipment for its return to service.
- Apply the manufacturer's good practice.
Do not forget
CERT-FR warns that campaigns are probably still under way. Leaving end-of-life equipment exposed, with no patch available, means exposing it to a very high probability of compromise. A simple reset is not enough in this case, because the equipment would remain vulnerable.
What we do not do
We neither sell nor secure refrigeration controls, and this article is not an audit. A separate probe does not fix any of these points. It simply gives another reading of the temperature: what it offers and where it stops.
