A refrigeration cyberattack has now hit hundreds of European supermarkets and, in the latest escalation, three French blood storage sites. Attackers did not steal data. They remotely changed temperature and defrost settings so that cooling failed and stock was lost.
This guide explains what happened, what is confirmed and what is not, and how to reduce your own refrigeration cyberattack risk. It also covers where penetration testing fits once the basics are fixed.
Table of Contents
Refrigeration Cyberattack Timeline: What Happened in Europe
The refrigeration cyberattack story has three parts. Each one used the same idea: take over the system that controls cooling.
Wave 1: France, 12 October
On 12 October, attackers took control of refrigeration controllers at supermarkets across France. One report counted up to 700 stores, including Intermarché, Netto, Carrefour, Coopérative U and Monoprix. The controllers were forced into defrost mode, so cabinets warmed overnight.
An Intermarché spokesperson said cabinets reached about 50°C for roughly six hours. French police said the October attacks caused fires and food losses.
Wave 2: Sweden, Belgium and Ireland, 2 November
Three weeks later the same method appeared again. Freezers in Sweden, Belgium and Ireland were switched to defrost overnight and left to heat up. Reports also mention Luxembourg and Estonia. Britain’s cyber agency issued an alert to retailers.
Sweden’s national cybersecurity centre said it was tracking several incidents and that many operational technology devices in the country remain exposed.
Escalation: the French Blood Bank Refrigeration Cyberattack
On the same night, the French blood service (EFS) said a cyberattack on a refrigeration equipment provider changed temperature and defrost settings at three of its facilities. Alarms caught the change. Staff repaired equipment or moved products to other cold rooms, and no blood products were reported lost.
Refrigeration Cyberattack Facts: Confirmed vs Unconfirmed
Many pages repeat rumours as facts. Use this table to separate them. It will change as investigators publish more.
| Claim | Status |
|---|---|
| Hundreds of French supermarkets had controllers forced into defrost in October | Confirmed by retailers and French authorities |
| A second wave hit stores in Sweden, Belgium, Ireland and other countries on 2 November | Confirmed |
| Danfoss AK-SM and AK-SC controllers were central to the French wave | Reported by researchers and authorities; some Dixell/Copeland equipment was also involved |
| The second wave used the same controller brands | Not confirmed. Neither retailers nor authorities have named brands |
| EFS lost no blood products and was hit via a supplier | Confirmed by EFS and the health ministry |
| Settings were changed from about −30°C to 110°C | Reported but unverified. It does not prove the storage interiors reached that temperature |
| One group is behind every attack | Not confirmed. No group has claimed responsibility |
| The blood bank attack used the same exposed supermarket systems | No public evidence |
Read the reporting on the unverified 110°C figure before you repeat it.
How Many Supermarkets Were Hit? Why the Numbers Differ
Store counts vary a lot. One outlet estimated 250 to 350 French stores, while another put the figure at up to 700. Individual retailers gave their own numbers: Carrefour said about 80, Coopérative U 80 to 100, and Intermarché’s owner between 150 and 300 depending on the report.
There are several plausible reasons. Reports were published on different days. Some counted franchised stores, and some counted only company-owned ones. Others counted stores that removed stock, not stores whose controllers were touched. Until retailers publish a single audited figure, quote a range and name your source.
How Hackers Change a Fridge Temperature Remotely
A refrigeration cyberattack is simpler than it sounds. Investigators have not published full technical details, but the reported pattern is straightforward. A supermarket’s refrigeration plant is run by a central controller. It holds setpoints, alarm limits and defrost schedules for every case and cold room.
Many controllers have a web management interface so maintenance contractors can adjust them from afar. If that interface is reachable from the public internet, an attacker can:
- Find the device with a scan.
- Log in using a weak, default or stolen credential, or an unpatched flaw.
- Change the setpoint or switch evaporators into defrost mode.
- Leave the system running while stock warms overnight, when few people are watching.
Reports so far describe tampering with settings, not malware. That helps explain how this refrigeration cyberattack spread so quickly across borders.
Why Are Refrigeration Controllers on the Internet?
Because it is convenient. A contractor can fix a fault at 2 a.m. without driving to the store. As SOCRadar notes, some of these controllers sit directly on the internet with a web management interface. Security teams rarely see them, because they belong to facilities, not IT.
OT vs IT Security in Plain English
IT systems hold data. Operational technology (OT) controls physical things such as pumps, valves and compressors. The field is often called OT ICS security, short for operational technology and industrial control systems. In OT, availability and safety matter first, so patching is slow and many devices run old firmware.
The NIST guide to OT security and the CISA industrial control systems resources are good starting points.
What Risk Is Posed by Internet of Things Devices?
Connected fridges, thermostats, cameras and sensors form an IoT network, which is simply many small devices linked to one another and to the internet. The risk posed by internet of things devices is that each one is a possible way in. Most are never updated, rarely monitored and often left with default passwords. This refrigeration cyberattack shows the consequences in physical form.
Danfoss AK-SM and AK-SC Controller Security
French authorities and researchers pointed to Danfoss AK-SM 800 and AK-SC 355 controllers, with some Copeland Dixell XWEB equipment also involved. The Register reported more than 4,500 exposed Danfoss interfaces, more than half in France. Researchers said Danfoss had released a firmware fix, and many exposed units ran outdated or end-of-life firmware.
If you own these devices, do three things now: confirm whether they are reachable from the internet, update firmware to the latest version, and plan to replace controllers that no longer get updates. Do not assume other brands are safe. The French wave involved more than one vendor.
Who Is Behind the Refrigeration Cyberattack?
Nobody knows yet. No group has claimed responsibility. Public reports contain no technical findings that identify the attackers or explain how they reached the supplier systems. Treat any firm attribution as speculation.
A useful rule is to wait for three things: a named group or claim, technical indicators from a national agency, and a motive that fits the evidence. Until then, defend against the method, not the actor.
7 Steps to Reduce Your Refrigeration Cyberattack Risk
This checklist is written for small grocers, restaurants, pharmacies and clinics. It follows the guidance France’s national cyber agency issued after the first wave, plus warnings from Sweden’s agency.
Step 1: Check If Your Refrigeration Controller Is Exposed to the Internet
Ask your contractor for the controller’s IP address and test whether it answers from outside your network. You can also search for your public IP on Shodan. If the login page appears, it is exposed.
Step 2: Remove Controllers From Direct Internet Access
Put them behind a firewall. Allow remote access only through a secure VPN or protected network. France’s CERT-FR guidance tells operators to do exactly this.
Step 3: Change Passwords and Update Firmware
Replace default passwords, enable the vendor’s strictest security mode where one exists, and update firmware. This is ICS vulnerability management at its simplest. Schedule updates in a quiet window and keep a rollback plan, since you cannot easily reboot cold storage.
Step 4: Control Supplier and Contractor Access
The blood service attack arrived through a supplier. Write a supplier remote-access policy that covers:
- Named accounts, never shared logins
- Multi-factor authentication
- Access only when a job is open
- Logs you can review
- A vendor security questionnaire before the contract is signed
Step 5: Add Independent Temperature Monitoring
The blood service caught its problem because alarms and an on-call technician noticed. Do the same. Install battery-backed sensors that report to your phone and do not rely on the controller. If the controller is hacked, an independent alarm still fires.
Step 6: Watch Your Network
Use network security monitoring to flag new devices, strange logins and traffic to and from controllers. Even basic alerts on after-hours access help.
Step 7: Test Your Defences
A checklist tells you what should be true. A test tells you what is true. Book a VAPT assessment to confirm your controllers, remote access and supplier paths hold up.
Cold-Storage Cybersecurity for Blood Banks, Labs and Pharmacies
Healthcare cold storage faces the same weakness with higher stakes. Reports note that fresh frozen plasma must be kept at −25°C or below. A short excursion can ruin product.
For blood banks, labs, pharmacies and vaccine stores:
- Keep alarms independent of the control system.
- Rehearse a transfer plan to backup cold rooms.
- Keep a current asset list of every connected cold-storage device.
- Include refrigeration suppliers in your security risk assessment.
Hospital leaders and the healthcare chief information security officer should treat cold storage as critical infrastructure, not facilities equipment.
Is Food Safe After a Refrigeration Cyberattack?
Retailers removed products whose safety could no longer be guaranteed, so food on shelves after a refrigeration cyberattack is not usually the concern. At home, use normal food-safety rules.
- Perishable food above 4°C (40°F) for more than two hours should be thrown away.
- Frozen food that still has ice crystals can usually be refrozen, though quality may drop.
- When in doubt, throw it out.
See FoodSafety.gov for official guidance. Follow any recall notice your store publishes.
Could a Refrigeration Cyberattack Happen in the US or UK?
Yes. The weakness is design, not geography. Wherever contractors manage controllers over the internet, the same exposure exists. Public scan counts so far focus on Europe, but UK cyber chiefs have already alerted retailers, the NCSCpublishes guidance, and Finnish officials found dozens of exposed controllers after the French wave.
US operators should assume their own cold-storage controllers are findable and test them.
Does Cyber Insurance Cover Spoiled Stock?
It depends on your policy wording. Spoilage is often a physical loss, and some property policies exclude cyber causes, while some cyber policies exclude physical damage. Business interruption cover may help with lost sales.
Ask your broker three questions. Does my policy cover spoilage caused by a cyber event? Is there a waiting period? Do I need to prove security controls such as VPN access and multi-factor authentication? This is general information, not insurance or legal advice.
Penetration Testing for OT and IoT Devices
Would a penetration test have caught this refrigeration cyberattack? An external test would very likely have found an exposed login page. That is the point of external penetration testing: attack your systems the way an anonymous internet user would.
IoT Penetration Testing and Infrastructure Testing
IoT penetration testing checks devices, firmware, web interfaces and remote-access paths. Infrastructure penetration testing covers the networks, firewalls and servers around them. OT environments need careful scoping so tests never disrupt live equipment.
OT Security Assessment and Security Risk Assessment
An OT security assessment lists every connected controller, who can reach it and how. Pair it with a wider security risk assessment so refrigeration, building systems and IT are judged together. Automated penetration testing can sweep for exposed services quickly, while manual testing finds weak logins and chained flaws.
Third-Party Penetration Test
Insurers, enterprise customers and regulators increasingly ask for a third-party penetration test and a clear report. Independent testing proves controls work and shortens security questionnaires.
Choosing OT Security Services
When you shop for OT security services, ask for OT experience, a safe-testing method, a sample report and clear scope. A good provider combines vulnerability assessment and penetration testing in one engagement.
Refrigeration Cyberattack FAQ
What is a refrigeration cyberattack?
It is an attack on the systems that control cooling. Attackers change setpoints or defrost schedules so cold storage warms and stock spoils.
How do hackers hack refrigerators?
They find internet-exposed controllers and log in using weak credentials or unpatched flaws. They then change settings remotely.
Which supermarkets were affected by the refrigeration cyberattack?
Reports name Intermarché, Netto, Carrefour, Coopérative U and Monoprix in France, and ICA, Coop, Delhaize and SuperValu in the second wave.
Did the French blood bank lose blood products?
No losses were reported. Alarms and an on-call technician caught the change, and staff moved or secured products.
Who is behind the refrigeration cyberattack?
Unknown. No group has claimed responsibility and no technical findings have been published.
How can I check if my refrigeration controller is exposed?
Ask your contractor for the public IP, test it from outside your network and search for it on Shodan. If a login page appears, remove it from the internet.
Is my food safe after a fridge failure?
Throw away perishables that were above 4°C (40°F) for over two hours. Frozen food with ice crystals can usually be refrozen.
Does a refrigeration cyberattack need malware?
Not necessarily. Reports so far describe changed settings, not malware, though investigators have not published technical details.
Does cyber insurance cover spoiled stock?
Sometimes. Check your policy wording for spoilage and cyber exclusions.
Final Thoughts and Next Step
A refrigeration cyberattack is a business risk, a food-safety risk and, in healthcare, a patient-safety risk. The fixes are mostly basic: take controllers off the internet, update them, control your suppliers and add an independent alarm.
Want to know if your cold storage is exposed? The Nexus Web Security team can test it for you. Request a VAPT assessment today and find out what an attacker would find first.
