Five US agencies, led by CISA and the FBI, published a joint advisory on 5 November warning that attackers worldwide are going after the controllers that run commercial fridges, freezers and cold rooms. The warning follows a month in which unidentified attackers remotely switched refrigeration units into heating or defrost mode at hundreds of European supermarkets and at three French blood banks.
Many of these controllers are legacy units whose management interfaces were left reachable from the internet so operators could watch temperatures and manage defrost cycles remotely. The attacks show what happens when such an interface is exposed with default passwords or outdated firmware: the damage is physical, from spoiled food to fire hazards.
Two waves in Europe, then blood banks
The first wave hit French supermarkets overnight from 11 to 12 October, forcing refrigeration units into defrost mode and spoiling food; reports also mention fires. The count differs by source: BleepingComputer puts it at 250 to 350 stores, while SecurityWeek says around 700, including Intermarché, Carrefour and Monoprix. France's CERT-FR first tied the compromises to Danfoss AK-SM and AK-SC controllers and then added Copeland and Dixell XWEB systems.
A second wave struck overnight from 1 to 2 November, affecting more than 100 stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden, with problems also reported in Finland, Italy and Portugal. Some units were set as high as 50°C. Belgium was hit hardest, with dozens of Delhaize stores, 15 Carrefour locations and an IKEA store affected. Investigators have not said whether the two waves are linked, and nobody has claimed them.
On 2 November the French Blood Establishment (EFS) saw temperature and defrost settings pushed to extreme levels in cold rooms at three sites. It was not attacked directly: the incident came through a refrigeration supplier, and Coolworld Rentals has said a flaw in a third-party remote monitoring component affected some of its units. EFS says its alarms caught the change quickly, products were moved or secured, and no blood products were lost.
How the attackers likely got in
Officials have not explained the exact entry point, but the pattern is consistent. Security researcher Kevin Beaumont told SecurityWeek that every freezer hit in the second wave had a management interface reachable from the internet, and that many of the devices are end-of-life with no patch available. Danfoss said most hacked units in France were legacy products it no longer updated, and that it had told customers on 13 October to disconnect them, advice most but not all followed.
Deception firm Lupovis saw a burst of login attempts against its Danfoss AK-SM decoys between 20 and 30 October, mostly using factory-default credentials that Danfoss documents publicly. Censys counts just over 1,000 Danfoss StoreView interfaces still online worldwide, with France, Belgium and the US exposing the most. BleepingComputer notes that two Danfoss AK-SM flaws disclosed in 2025 allow authentication bypass and remote commands, though it is not confirmed they were used here.
The US advisory describes the same playbook in general terms: authentication bypass, code injection and weak configurations used to change setpoints, force continuous heating or defrost cycles, and even hide current temperatures from staff. The Register found no documented attacks on American supermarkets so far, but reports that the Pentagon is treating freezer failures at US military bases in August as a suspected cyberattack.
What to do
- Take refrigeration controllers and other control system devices off the public internet, and route any remote access that is truly needed through an updated firewall or edge device.
- Replace default passwords, enable phishing-resistant MFA where the device supports it, and apply firmware updates, retiring controllers the vendor no longer patches.
- Put operational technology devices on their own VLAN with an allowlist of devices and IP addresses that may reach them, and keep logging turned on.
- Set safe setpoint limits on equipment downstream of the controllers and alerts for any temperature deviation, so a hijacked controller cannot quietly push units out of range.
Sources
- FBI, CISA warn of cyberattacks targeting refrigeration systems BleepingComputer
- Feds warn grocers: Don't chill on cyber defenses as freezer hacking spree heats up The Register
- US agencies warn attackers are targeting refrigeration systems that protect food and medicine Help Net Security
- Over 100 European Stores Hit as Supermarket Fridge Attacks Return SecurityWeek
- Cyberattack disrupts blood storage refrigeration systems in France BleepingComputer