IoT Security for Small Businesses: Your Smart Equipment Is an Attack Surface

Most small businesses I talk to have a pretty good idea of what's on their computers. Far fewer know what's on their network. The cooler controller, the camera recorder, the door system, the sign in the window, the printer. Each one is a small computer with a login, and a lot of them were set up by a vendor years ago and never touched again. This fall, attackers in Europe showed what that costs.

On October 12, hundreds of French supermarkets came in to find their fridges and freezers warm. The BBC reported that hackers took over the software that regulates the units' temperatures, and Intermarché said its fridges sat at 50C (122F) for six hours overnight, according to Reuters. The BBC named Coopérative U, Intermarché and Netto, Carrefour, Monoprix and E.Leclerc among the chains hit, with Danfoss software as the target. AP later reported the French government's count at about 700 stores. French prosecutors opened a cybercrime investigation.

Then it happened again. Overnight into November 2, the BBC reports, dozens of supermarkets in seven countries, Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland, had their fridges and freezers hit. Around 40 Delhaize stores in Belgium and Luxembourg were affected, Carrefour said 15 of its Belgian stores were, Musgrave said 13 SuperValu stores in Ireland were, Coop said seven of its 800 Swedish stores were, and in Finland some K-stores had refrigeration malfunctions that owner Kesko's security experts are investigating. One Delhaize branch told a Belgian paper it lost €100,000 of produce (about $112,000 at the European Central Bank's November 2 rate), before counting the cost of closing. Sabcobel, which makes some of the affected units and runs Delhaize's systems, said the evaporators were switched to defrost mode, the same trick as in France.

In the Netherlands, a Danfoss spokesperson told NOS that systems at at least 17 businesses were attacked, mostly butcher shops and small neighborhood stores, plus a frozen storage site that should have been at -20C and was found at -10C. The big Dutch chains weren't hit, NL Times reports.

That's the part I'd pay attention to. The second wave landed on smaller shops.

Nobody has published a full technical write-up, but what the companies and France's national cyber agency have said points the same way.

• The controllers were reachable from the internet. France's CERT-FR alert on refrigeration controllers lists Danfoss AK-SM and AK-SC series, Copeland XWEB and Dixell XWEB, says it knows of "numerous" compromises, and says exposing a management interface on the internet goes against basic good practice. Its first fix is to take the units off public IP addresses.
• Default passwords. The Danfoss spokesperson told NOS the Dutch systems hit had default passwords and weren't on a secure network, and that the attack could have been prevented. Danfoss had told its Dutch customers on October 13 to disconnect from the internet and reconnect only through a secure network. "Most stores took action at that time, but a small number did not," the spokesperson said, per NL Times. "They are now the ones suffering the consequences."
• Old equipment that doesn't get fixes anymore. Danfoss said the units hit in France were older models whose security software couldn't be updated, the BBC reported, and Facilities Dive quotes Danfoss calling most of it "legacy" products that "no longer receive software or security updates." Sabcobel told the BBC some units needed physical changes, not just a software update.
• It's not one brand. NOS heard from a Belgian butcher that Copeland equipment was attacked too, and CERT-FR added more targeted equipment to its alert the day after it first went out. It now lists Copeland and Dixell alongside Danfoss.

No exotic zero-day needed. A login page on the internet, a password from the manual, and equipment nobody had looked at in years.

Anything with a network cable, Wi-Fi, a cellular modem or an app. In the businesses I work with, that usually means:

• Cooler, freezer and walk-in controllers, and temperature monitors
• Security cameras and the recorder (DVR or NVR) they plug into
• Door access, alarm panels and smart locks
• Point-of-sale terminals, kiosks and receipt printers
• Office printers and scanners
• Digital signage, smart TVs and music systems
• Lighting and other building controls
• The router, Wi-Fi access points and any box the internet provider or a vendor left behind

You don't have to secure all of that perfectly this week. You do need to know it exists.

Walk the building. For each device, write down what it is, who installed it, who services it, how it connects (your Wi-Fi, a cable, its own cellular modem), how you log in to it, and whether it can be reached from outside. Add whether the maker still ships updates for it. If the answer is no, that's your replacement list, because CERT-FR is blunt about it: leaving an end-of-life device with no security fixes on the internet means a "very high probability" of compromise, and a factory reset alone won't help because it "will certainly be compromised again."

Your router's list of connected devices is a good starting point. Anything on it you can't name is the first thing to chase down.

If a device still has the password from the manual or the sticker, assume someone else has it too. Give each one its own long password, keep them in a password manager the business controls (not one person's phone), and get rid of shared logins where the device allows named accounts. Do the same for the vendor's account on the device. If the vendor says they need a default password to service it, that's a conversation worth having before the next renewal.

While you're logged in, check for firmware updates. CERT-FR's advice for Danfoss units includes updating the firmware, setting the security level to Strict and making sure default passwords are gone.

This is the fix that would have stopped most of what happened in Europe. A controller's management page should not be reachable from the open internet. Period.

Here's a quick test anyone can do: turn Wi-Fi off on your phone so you're on cellular data, then go to the address you or your vendor use to reach the device from outside. If a login page loads, anyone on the internet can load it too. Then log in to your router and look for port forwarding rules you didn't make, and turn off UPnP, the setting that lets devices open holes in your firewall on their own. If a vendor connected a device straight to the internet with its own modem or public IP, ask them to change that.

Your cooler controller doesn't need to talk to the laptop where you do payroll. Most business routers and Wi-Fi systems can run separate networks (VLANs, or at least a separate SSID) for staff computers, guest Wi-Fi, payment terminals and equipment. Put the equipment on its own and block it from reaching the others. If one device gets taken over, that limits what else the attacker can reach.

There's a hint of this in the Swedish reports: ICA told the BBC the stores hit were a small number "operating outside ICA's central network."

Your refrigeration tech, your camera installer and your alarm company may all have a way in. That's fine, and it's usually why the device is on the internet in the first place. It just has to be done right. CISA says remote access should go through a VPN with a strong password and phishing-resistant multi-factor authentication, limited to what that person needs, with old accounts turned off. CERT-FR says to restore remote access only through a secure VPN or protected network, and calls a firewall rule that only allows the vendor's IP addresses an emergency stopgap, not a fix.

Questions I'd ask every vendor with access:

• How do you connect to our equipment, and is the login page open to the internet?
• Do you use a separate account for each technician, with multi-factor authentication?
• Did you change the default password? Where is it stored?
• Who at your company can get in, and how do we turn your access off?
• Will you tell us within a day if you have a security incident?

One catch CERT-FR flagged: before you cut a vendor's monitoring connection, check your service contract and insurance terms, because some require it. Fix the connection rather than leaving yourself without monitoring.

In Europe, a lot of managers found out when they opened the door in the morning. If the controller is the thing that's been taken over, you can't count on it to warn you. Get an independent alert: a standalone temperature sensor that texts someone when a unit warms up, on its own cellular connection or a different network. Make sure the alert goes to a person who will actually see it at 2 AM, and test it.

If your equipment can send alerts for logins, setting changes or schedule changes, turn those on too. After the French attack, CERT-FR told operators to check the whole configuration, especially the defrost schedules, which is exactly where these attackers made their change.

CISA says to "practice and maintain the ability to operate OT systems manually." For a small business that means:

• Know how to switch each critical device to local or manual control, and write it down where staff can find it.
• Keep a printed sheet with the vendor's emergency number, your account number and who's allowed to call.
• Have a way to log temperatures by hand if the system can't be trusted.
• Decide ahead of time who makes the call to pull product, and check your local health department's rules on what has to be thrown out.
• If a device was compromised, follow CERT-FR's order: take it off the internet, restart or factory reset it, reconnect it only through a secure path, then reconfigure and update it.

If you've read my post on scoping AI agent permissions, this is the same idea in a different room: give each thing the least access it needs, and know how to take it away fast. And if a vendor tells you their systems were breached, my key rotation runbook covers replacing the credentials they had.

What is IoT security for a small business?
It's keeping the connected equipment in your business, like cooler controllers, cameras, door systems, payment terminals and printers, from being reachable or controllable by people who shouldn't have access. In practice that means knowing what you have, changing default passwords, keeping admin pages off the internet, separating equipment from your other networks, controlling vendor access, and having alerts and a manual backup plan.

Were any US supermarkets affected by the freezer attacks?
No US supermarkets have been reported as of November 2, 2026. Reported store incidents were in France on October 12, and in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland overnight into November 2. Separately, Reuters reported on October 29 that the Pentagon is treating August freezer failures at at least six US military base commissaries as a suspected hack, and nothing has been confirmed about who did it or which equipment was involved. The same brands of controllers are sold in the US, and CISA has published an advisory on one Danfoss model.

Which refrigeration controllers were targeted?
France's CERT-FR named Danfoss AK-SM and AK-SC series, Copeland XWEB and Dixell XWEB. In the Netherlands, Danfoss said the systems hit had default passwords and weren't on a secure network. Belgian reports also mention Copeland equipment.

Is changing the default password enough?
It's the minimum, not the fix. CERT-FR's first step is removing the device from the public internet, and it warns that an unpatched, end-of-life device left exposed will likely be compromised again even after a factory reset. Change the password, take it off the internet, update or replace it, and put remote access behind a VPN.

How can I tell if my equipment is exposed to the internet?
Turn off Wi-Fi on your phone and try the outside address you or your vendor use for the device. If a login page loads, it's exposed. Also check your router for port forwarding rules and UPnP, and ask each vendor whether their device has its own internet connection.

• BBC News, "Shop freezers in seven European countries hit by cyber-attack" (November 2, 2026, updated)
• BBC News, "Fridges in French supermarkets hit by cyber attack" (October 12, 2026)
• Reuters via Military Times, "Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say" (October 29, 2026)
• European Central Bank, euro reference rate for the US dollar (1.1216 on November 2, 2026)
• AP News, "Cyberattack hits 700 supermarkets in France, sparking investigation"
• NOS, "Ook koelsystemen in Nederland aangevallen, bij 17 bedrijven temperatuur aangepast" (November 2, 2026, in Dutch)
• NL Times, "Fridges, freezers of 17 Dutch businesses attacked; Large supermarkets unaffected" (November 2, 2026)
• CERT-FR, CERTFR-2026-ALE-012, "Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération" (October 12, 2026, updated October 16, in French)
• Facilities Dive, "Hack of Danfoss refrigeration controllers in Europe causes tens of millions in food losses" (October 13, 2026)
• CISA, ICS Advisory ICSA-25-140-03, "Danfoss AK-SM 8xxA Series (Update A)"
• CISA, "Primary Mitigations to Reduce Cyber Threats to Operational Technology"