# Taking refrigeration controls off the public internet Refrigeration controllers are usually online for a good reason: the contractor who maintains them needs remote access, and monitoring data has to leave the site. The risk comes from how that access is provided. A controller with a login page on a public address can be found and tried by anyone. The fix is not to unplug it but to move the same access onto a private network. By Chris Byrd 5 November 2026 [Sector guides](https://netavo.com/insights) ## Why the controllers are on the internet Supermarket and cold-store refrigeration is managed by site controllers that run defrost cycles, hold setpoints and raise alarms. Contractors maintain them remotely, and owners or insurers may require temperature data to be uploaded off site. The quickest way to provide that is often a public address on the site's internet connection, opened so the contractor can reach the controller's web interface from anywhere. Those connections tend to be set up during installation or a service visit, outside the owner's IT estate. The people responsible for network security often do not know the devices exist, so they are missing from firewall reviews, patching plans and asset lists. Researchers at [Forescout](https://www.forescout.com/blog/cold-chain-open-control-exposed-refrigeration-systems-reveal-global-risk/) counted 12,976 exposed refrigeration control instances worldwide. ## What the 2026 attacks used In October 2026 attackers reached internet-facing refrigeration controllers in French supermarkets overnight, forced defrost cycles and raised setpoints. A second wave in early November affected stores in several other European countries. The route in both cases was the same: controllers that could be reached directly from the internet. France's national CERT issued [alert CERTFR-2026-ALE-012](https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-012/) covering Danfoss AK-SM and AK-SC and Copeland/Dixell xweb controllers. Its first recommendation is to remove internet exposure and restore remote access only through a secure VPN or protected network. It describes filtering by source IP address as an emergency stopgap, and warns that an unpatched device left on the internet is likely to be compromised again. Taking a controller off the public internet removes the route these attacks used. It does not replace patching, retiring end-of-life controllers or changing default passwords, and those still need doing. ## Taking a site off the internet ### 01 Find every exposed controller Ask each refrigeration and building-services contractor which devices they reach remotely and how. Check the site's internet connections for forwarded ports and public addresses, and record every controller, its owner and its firmware. ### 02 Give the contractor a private route Agree how the contractor will connect instead: a VPN or private network into the controller, with access limited to the people and systems who need it. Keep monitoring uploads on the same private path. ### 03 Remove the public address Once the private route is proven, close the forwarded ports and remove the public exposure. Confirm from outside the site that the controller can no longer be reached. ### 04 Patch, replace and review alarms Update firmware, plan replacement of end-of-life units and change default credentials. Review defrost schedules and setpoint alarms so an unexpected change is noticed quickly. ## How Netavo provides private access Netavo works closely with refrigeration contractors and equipment manufacturers to deploy and manage private remote monitoring. Each site's controllers connect through a managed industrial cellular router on a [private APN SIM](https://netavo.com/services/static-ip-sims), which has no public address and cannot be reached from the internet. The routers join a [private WAN](https://netavo.com/services/mpls) to the contractor's monitoring centre, over IPSec or MPLS, and fixed lines can sit on the same private network. The contractor keeps remote access and data uploads. The controllers stop being reachable from the internet. Because the connection is separate from the store's own broadband, it does not depend on the retailer's firewall configuration and is not exposed by a change made there. For estates of remote devices more generally, see [reaching remote IoT devices](https://netavo.com/insights/reaching-remote-iot-devices) and [private APN explained](https://netavo.com/insights/private-apn-explained). ## Common questions ### Do refrigeration controllers need to be on the internet at all? They need a connection for contractor access and monitoring uploads, but not a public address. Netavo provides that connection over a private network instead, so the controller stays reachable to the contractor and unreachable from the internet. ### Is filtering by IP address enough? CERT-FR describes source-IP filtering as an emergency stopgap rather than a fix. Netavo's approach removes the public exposure entirely by putting the controllers on a private APN SIM and a private WAN. ### Does a private network make patching unnecessary? No. Taking controllers off the internet removes the route the 2026 attacks used, but Netavo still advises patching, replacing end-of-life units and changing default passwords. ## Related services and sectors ### [Static IP and Private APN SIMs for IoT Fleets](https://netavo.com/services/static-ip-sims) Static public or private IP SIMs on a private APN network, reached by IPsec, cloud interconnect, MPLS or L2TP. ### [MPLS Network Provider: Private MPLS WAN for Business](https://netavo.com/services/mpls) Any-to-any MPLS VPN on our own core, joining sites, cloud, IoT SIMs, voice and remote workers on one private WAN. ### [IoT & Mobile Data](https://netavo.com/services/iot) Global multi-network SIMs on our own mobile core, with internet access or a private network for device fleets. ### [Retail & Multi-site Estates](https://netavo.com/sectors/retail-and-multi-site) Fibre, Ethernet and private networking for branches and head offices, with mobile failover and estate telephony. ### [Hospitality & Food Service](https://netavo.com/sectors/hospitality-and-food-service) Site connectivity and mobile failover for trading, private data for connected equipment and telephony for hospitality estates. ### [Commercial Property & Facilities Management](https://netavo.com/sectors/commercial-property-and-facilities) Building connectivity, private links for building systems, alarm signalling and voice across a property portfolio. ## Move remote access onto a private network Tell us how your contractors reach your refrigeration controllers today, and we will discuss a private route that keeps their access and removes the public exposure. [Work with us](https://netavo.com/work-with-us) Chris Byrd CTO, Netavo Global Data Services Ltd Chris leads Netavo's engineering: the AS208802 network, its broadband and BNG platforms, and the mobile core behind its IoT SIMs. [Chris Byrd on LinkedIn](https://www.linkedin.com/in/chrisbyrd) Source: https://netavo.com/insights/refrigeration-controls-off-the-internet