From supermarkets to hospitals: securing connected cooling across Africa

Connected cooling extends far beyond supermarkets

The attack on French supermarket refrigeration raises a broader question for Africa: which buildings depend on remotely accessible temperature control? The list includes hospitals, laboratories, vaccine stores, food warehouses, data centres, hotels, offices and sensitive government facilities. A presidency, ministry or central bank may use building management systems for cooling, power, alarms or generators. This does not mean that any such African site has been hacked. It means that the same cyber-physical security principles belong in their risk assessments.

Not every connected device creates the same danger. A sensor that only sends readings to a platform does not necessarily provide the ability to alter a setpoint. A bidirectional controller may change defrost cycles, stop a compressor or control an HVAC installation. Before assessing exposure, an organisation must distinguish monitoring, administration and physical command.

Africa’s cold chain is already becoming digital

Connectivity provides essential benefits. In 2025, Africa CDC described Uganda’s receipt of 500 solar-powered refrigerators and 1,746 remote temperature-monitoring devices, enabling central oversight of storage conditions. It also highlighted Uganda’s National Medical Stores, a highly digitised medical warehouse with cold rooms able to hold millions of vaccine doses.

This is not an isolated development. In 2024, Africa CDC announced deliveries to five member states, including Cameroon, Sierra Leone, Uganda and Zambia, comprising hundreds of refrigerators, freezers and temperature monitors. The World Health Organization considers continuous remote monitoring good practice in stores holding large quantities of vaccines because it can quickly alert health workers when temperatures leave the required range.

Cybersecurity and modernisation should not be presented as opposing choices. Remote monitoring can prevent vaccine loss, compensate for long distances and accelerate maintenance. The sound approach preserves those benefits while preventing a central account, SIM connection, cloud gateway or contractor from becoming an uncontrolled command point.

Three scenarios that deserve attention

The first is silent falsification. An attacker changes the displayed temperature or disables alarms without immediately stopping the equipment. Food, reagents or vaccines may appear compliant after an unsafe temperature excursion. Independent measurement and local verification are essential for detecting that mismatch.

The second scenario is visible interruption. Cooling for a server room, laboratory or government building is switched off. The consequences may develop quickly: overheated IT equipment, halted operations, evacuated rooms or lost stock. In an environment already affected by electricity outages, teams may initially blame the power supply and lose valuable response time.

The third scenario targets maintenance concentration. One integrator may support several hospitals, stores or public buildings through the same platform. Compromising a technician’s account or workstation can then reach several customers. Security must therefore protect each site while also limiting the reach of vendor access and providing a rapid revocation mechanism.

A baseline suited to African operating conditions

Every organisation should begin with a joint inventory of IT, operational technology and building equipment. It should identify what is connected, what can receive commands, where the console is hosted, who supports it and how long the installation can operate without the network or primary power. Unknown, obsolete or unsupported equipment should be prioritised by operational consequence rather than purchase price.

Management consoles should not be exposed directly to the Internet. CISA guidance recommends placing control systems behind firewalls, isolating them from business networks and using secure remote-access methods. African operators should add named accounts, multifactor authentication, defined maintenance windows, destination allowlists and logs sent to a location that the controller cannot erase. Remote vendors should reach only the sites and functions required for the current task.

Degraded operation matters as much as the firewall. A hospital or vaccine store needs local alarms, an independent reading, printed procedures and reachable personnel when the cloud platform or mobile network is unavailable. Safety thresholds should continue to operate locally. An abnormal remote command should not disable every physical protection. Staff must be able to isolate the external connection without stopping cooling.

Energy resilience and cybersecurity should be tested together. An exercise can combine loss of connectivity, an unavailable vendor and a suspicious setpoint change. It should verify battery, solar or generator autonomy and the process for deciding whether stored products remain safe. For vaccines and medicines, that decision belongs to established health protocols and must not be improvised by the IT team.

Monitoring should also focus on physical meaning. A login from an unusual country is relevant, but so is a defrost command outside the normal schedule, simultaneous changes across unrelated sites or a setpoint outside an approved engineering range. Where older controllers cannot generate adequate logs, a network sensor or independent temperature monitor can provide compensating visibility.

What public procurement should require

Governments and health institutions can reduce risk at purchase time. Specifications should require a defined support period, authenticated updates, removal of default credentials, log export, separation between read-only and control privileges, and a vulnerability-disclosure process. Contracts should state where data is hosted, who can access the fleet and how access is removed when the contract ends.

For sensitive government sites, the assessment must include vendor dependency and interactions with energy, telecommunications and physical security. Publishing the detailed configuration of those buildings is unnecessary. The owning authority must nevertheless know which third parties have access, ensure national teams can take back control and prevent remote maintenance from bypassing site rules.

Connect without surrendering control

Africa needs more cold-chain capacity, monitoring and energy efficiency. The French incident should not slow that modernisation; it should improve its design. A resilient system detects unsafe deviations, limits remote command, retains local protection and runs long enough in degraded conditions. Whether it protects food, vaccines, servers or an official building, cooling infrastructure now belongs in cyber inventories alongside applications and networks.

— ◆ —