Cold-storage cyberattack: what Malaysian warehouses should check

Direct answer: in early November 2026, reported attacks on European supermarkets changed refrigeration controllers that were reachable from the internet. Freezers warmed, food had to be thrown away, and in some UK reports the controller’s own temperature warnings were switched off. Sorable did not investigate these incidents. The lesson for a Malaysian cold store, factory, hospital, or site with remote HVAC is narrow: a secure website, database, or ERP does not protect an equipment controller a supplier left on the public internet.

Last updated 8 November 2026. This is a defensive summary of public reporting, not a forensic reconstruction and not a guide to reaching those controllers. The Cyber Security Agency of Singapore published an advisory on 6 November 2026. BleepingComputer and other outlets described the supermarket incidents. French authorities had already described an October wave. The precise access method for every November store is still under investigation.

What was reported

The latest wave was reported across European supermarkets on 1–2 November 2026, after an earlier wave in France in October. Attackers remotely reached refrigeration control systems and changed settings. Some freezers were reported at about 50°C. Stock that could no longer be sold was discarded. The value of the lost food was described as substantial. There is no confirmed ransom demand in the reporting Sorable has reviewed, and there is no confirmed evidence that AI was used. Identities and motives remain unknown.

The important reported detail is where the attack sat. It did not have to start in the supermarket’s main IT system. The targets were internet-connected controllers that operate the refrigerators. Those units exist so an engineer or a supplier can see temperatures and alarms without driving to the store. That remote path is useful. It is also a computer: a dashboard, a network connection, accounts, and software that ages.

How public reports describe the path

This is an illustrative path based on reported incidents. It is not a confirmed reconstruction of every store, and it leaves out anything that would help someone find or operate a controller.

• Refrigeration units had remote management interfaces so engineers and suppliers could monitor equipment without a site visit.
• Public reporting pointed to weak access control and outdated software on some of those interfaces. French authorities, for the October incidents, identified publicly exposed management interfaces and weak authentication as major factors.
• Attackers changed temperature settings or started defrost functions that are meant to run only briefly.
• Refrigerators warmed, food became unsafe, and stores discarded inventory.
• In some UK incidents, reporting says attackers also disabled automated temperature-warning messages from the same controller.

The October French incidents involved systems including Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB, as identified in public authority reporting. Naming those families explains which management interfaces were discussed. It is not a claim that every November store used them, and it is not a vulnerability write-up. The November access method remains under investigation.

Why this is different from ransomware

A familiar ransomware incident encrypts business data, stops software, and often asks for payment. Recovery is an IT problem: restore from backup, rebuild accounts, and reopen the systems staff use. The refrigeration incidents manipulated physical equipment. Temperature control failed. Recovery also means checking the machinery and deciding whether food is safe to sell. Payment was not the confirmed point of the attack.

A secure ERP does not cover the controller

Malaysian cold-chain warehouses, factories, hospitals, and buildings with remote HVAC have the same shape of risk. The office can have a careful warehouse management system, a locked website, and a database that only staff can reach. None of that watches a third-party refrigeration panel that still accepts connections from the open internet. The software that picks and packs is not the software that holds the setpoint.

Sorable builds operational systems for warehouses and logistics teams. Those systems belong on a maintained web stack: HTTPS, access control, backups, patching, and monitoring. That work is described on cybersecurity services. It does not replace the supplier’s responsibility for a controller, and it does not become a penetration test of every freezer in a building. If a controller is in scope, the useful request is to take its dashboard off the public internet and to keep an alarm the controller cannot silence.

WithSecure, which Sorable deploys for endpoints and servers, is a separate layer again. It protects computers and servers. It is not a temperature probe inside a cold room. WithSecure processes security telemetry in Europe. A warehouse that wants both — protected staff machines and a hard look at exposed equipment — should request a quote and say which controllers suppliers still reach remotely.

What to check this week

The Cyber Security Agency of Singapore advisory of 6 November 2026 is the clearest public checklist. These are the protections, stated without steps an attacker could reuse.

• Remove refrigeration control dashboards from the public internet.
• Require a VPN or another tightly restricted path for remote maintenance.
• Replace default passwords and use stronger authentication.
• Update controllers that still receive fixes, and replace equipment the vendor no longer supports.
• Separate operational equipment networks from the normal office network.
• Use an independent temperature alarm that cannot be switched off from the same controller.

Ask the refrigeration vendor, in writing, whether the management interface is reachable without being on your network, who holds the accounts, and when the software was last updated. Ask the same of HVAC and other remotely managed plant. Walk the warehouse and logistics operation as a building, not only as a software project: probes, alarms, and who gets the call at 2 a.m. if a room warms up.

Do not treat a single shared password on a sticker inside the plant room as access control. Do not treat the controller’s own email alert as the only alarm if an attacker who can change the setpoint can also turn that alert off. Do not assume a cloud dashboard “from the supplier” is private because staff need a login. Private means it is not exposed to the internet, and the accounts are ones you can revoke.

What Sorable will and will not claim

We did not attend these incidents. We cannot tell you which supermarket was breached by which method. French authorities named exposed management interfaces and weak authentication for the October cases. November reporting is consistent with that class of weakness, and investigators have not published a single method for every store. Anyone offering a blow-by-blow of “the” attack is ahead of the public record.

We also do not sell a cold-room penetration test or an ISO 27001 certificate on the back of this story. The service we do sell is narrower: WithSecure for endpoints and servers, and security for the web infrastructure of systems we build or host, quoted per environment. If your cold store’s gap is an exposed controller, the first fix is with the equipment vendor and your network boundary. We will say that on a call.

Frequently asked questions

Did hackers have to break into the supermarket ERP?

Public reporting says no. The described target was the refrigeration controller’s remote management interface. A company can have a well-kept ERP and still lose stock through a third-party equipment panel.

Was a ransom demanded, or was AI used?

There is no confirmed ransom demand in the reporting reviewed for this post, and no confirmed evidence that AI was used. Identities and motives are unknown.

Which products were named?

For the October French incidents, authorities publicly identified systems including Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB, and pointed to exposed management interfaces and weak authentication. That does not establish the access method for every November incident.

What should a Malaysian cold store do first?

Take controller dashboards off the public internet, restrict remote maintenance, change default passwords, update or replace unsupported equipment, separate that equipment from the office network, and keep a temperature alarm the controller cannot disable. Then talk to Sorable if you also want WithSecure and the web systems around the warehouse quoted.