November 6, 2026 13 min to read

Hacked Freezers: What the Cold-Chain Attacks Mean and What to Do

Attackers are switching supermarket and blood-bank fridges into defrost from the internet. Here is how to keep your controllers off their list.

Most security incidents end with stolen data. This one ends with a freezer reading 50°C and a skip full of spoiled food. Since 11 October 2026, attackers have repeatedly broken into the electronic controllers that run commercial refrigeration in supermarkets, and they have used them to push fridges and freezers into long defrost cycles. The first wave hit several hundred stores in France. A second hit more than a hundred stores across Belgium, Sweden, Ireland, Estonia, the Netherlands and other countries on 2 November. On 3 November, France’s national blood service said three of its blood-storage facilities had been affected through a refrigeration supplier.

On 5 November, the FBI and CISA, together with HHS, USDA and DOT, issued a joint warning to every organisation that relies on refrigeration and cold-chain monitoring. CISA’s message was blunt: “Every organization that depends on refrigeration and monitoring systems should assume it could be a target.”

That covers far more than grocery chains. Pharmacies, hospitals, vaccine stores, dairies, frozen-food makers, restaurants, cold-storage warehouses and e-commerce grocery operations all run the same kind of equipment. This post explains what happened, why it worked, and what to do this week.

TL;DR / Key takeaways

• What: Attackers are logging into refrigeration management controllers that are reachable from the internet and changing temperature setpoints and defrost schedules. Food is spoiled, equipment is stressed, and some sites have reported fires.
• Who was hit: Hundreds of supermarkets in France (11–13 October), more than 100 stores in at least six European countries (2 November), two Italian food companies, and three French blood-storage sites. Nobody has claimed the attacks.
• Which equipment: France’s CERT-FR named Danfoss AK-SM and AK-SC controllers and Copeland / Dixell XWEB systems. Danfoss says most hit units were older, end-of-life models, plus some newer AK-SM 800A units on outdated firmware.
• How they got in: Not officially confirmed. Reported factors include controllers exposed directly to the internet, default passwords, and known flaws in older firmware.
• Do first: Find every refrigeration and building-control interface you own, take it off the public internet, change default passwords, and check defrost schedules and setpoints for tampering.

Timeline

Dates come from the sources listed at the end. Store counts differ between outlets, so ranges are given where they disagree.

How the attacks work

A supermarket does not have one thermostat per freezer. It has a store controller, a small embedded computer with a web interface that manages every refrigerated case, cold room and compressor in the building. It holds the setpoints, runs defrost cycles, raises alarms and lets the refrigeration contractor monitor and adjust everything remotely. Danfoss’s AK-SM 800-series and Copeland’s XWEB are common examples.

Defrost is a normal function. Evaporator coils ice up, so the controller periodically warms them to clear the ice. The attackers abused exactly that feature. According to reporting by Le Monde, cited by WSB-TV, defrost cycles in France were stretched from one hour to eight hours so that alarms would not fire. Swedish and French stores reported cases reaching 50°C. CERT-FR’s guidance specifically tells operators to check defrost schedules, because a tampered schedule can look like a routine setting.

No exploit is required for that last step. Once someone has an administrator session on the controller, changing setpoints and schedules is just using the product as designed. That is why the access question matters so much.

How did the attackers get access?

No agency has published a confirmed entry point, a CVE or indicators of compromise for this campaign. What is on the record:

• Internet exposure. Researchers counted thousands of these interfaces online. Claroty found 2,765 AK-SM 800A interfaces via Censys in August. ONYPHE counted 6,212 public IPs serving Danfoss’s StoreView web interface across 95 countries, nearly half in France.
• Default passwords. A Danfoss spokesperson told Dutch broadcaster NOS that systems hit in the Netherlands “were not on a secure network and still used default passwords”.
• End-of-life hardware. Danfoss says most affected units were the AK-SM 800 (end of life in May 2021) and AK-SC 355 (phased out in 2016). These get no security updates. Some current AK-SM 800A units were also hit while running outdated firmware.
• Known flaws. Danfoss fixed three AK-SM 800A flaws in 2025: an authentication bypass (CVE-2025-41450), a post-login command injection (CVE-2025-41451) and a third post-login issue (CVE-2025-41452). None has been officially tied to these attacks. They show what an unpatched, exposed controller can be vulnerable to.
• Third parties. Several victims pointed to suppliers. E.Leclerc said the attack hit “one of its refrigeration equipment suppliers”. Intermarché in Portugal and the French blood service also cited outside refrigeration providers. ICA said the affected stores’ systems sat on a contractor network outside its central network.

The FBI/CISA warning, as reported by BleepingComputer, describes attackers targeting “unpatched or internet-accessible electronic temperature controllers” through authentication bypass flaws, code injection or weak configurations.

Why this is worse than it looks

The losses are real. Les Mousquetaires, the group behind Intermarché and Netto, expects losses of “tens of millions of euros”. A single butcher’s shop in Belgium lost about €15,000 of meat. The US agencies also warn of shorter equipment life, fire hazards and unsafe storage conditions.

The bigger risk is silent spoilage. A freezer that obviously fails gets emptied. A cold room that drifts a few degrees above safe limits overnight and then recovers may never be noticed, and that matters most for vaccines, insulin, blood products and chilled food. In one Estonian store the freezer warmed by only two to three degrees before staff fixed it within about ten minutes. Not every site will be that lucky or that alert.

Am I affected?

You are in scope if you operate any of the following and someone, including a contractor, can reach it over a network:

• Supermarket or store refrigeration controllers (Danfoss AK-SM / AK-SC, Copeland or Dixell XWEB, or similar)
• Cold rooms, blast freezers or cold-storage warehouses with remote monitoring
• Pharmacy, hospital, laboratory or blood-bank fridges with networked temperature monitoring
• Building management systems (BMS) that include HVAC and refrigeration
• Any “remote access for the service company” set up years ago and never revisited

Start with three questions for your facilities team and your refrigeration contractor:

1. Can the controller’s web page be opened from outside our network? If anyone can reach it with just a browser and an IP address, that is the problem.
2. Has the default password ever been changed? Check every account, including the “service” or installer account.
3. What model and firmware is it running, and is it still supported? Danfoss’s AK-SM 800 and AK-SC 355 no longer get updates.

To check exposure from the outside, look up your own public IP ranges in an internet scanning service such as Shodan or Censys and search for web interfaces on those addresses. Internally, the queries below can help. Adjust field names to your logging platform. They assume you already collect firewall logs, and they are starting points, not campaign IOCs (none have been published).

~|-|~|-| Splunk / SQL~|-|style idea: inbound connections from the internet
~|-|~|-| to the subnet or hosts where refrigeration/BMS controllers live.
index~|=|firewall action~|=|allowed direction~|=|inbound
  dest_ip IN ("10.20.30.0/24")        /* your OT / controller subnet */
  NOT src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16")
| stats count values(dest_port) as ports min(_time) as first max(_time) as last by src_ip dest_ip
| sort ~|-| count

// Microsoft Sentinel (CommonSecurityLog): public sources reaching controller IPs
let ControllerIPs ~|=| dynamic(["10.20.30.10","10.20.30.11"]);  // replace with your controllers
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DestinationIP in (ControllerIPs)
| where not(ipv4_is_private(SourceIP))
| summarize Hits~|=|count(), Ports~|=|make_set(DestinationPort), First~|=|min(TimeGenerated), Last~|=|max(TimeGenerated) by SourceIP, DestinationIP
| order by Hits desc

Any hit from an unknown public address is worth investigating. On the controllers themselves, review the audit or event log if the model has one, list all user accounts, and compare current setpoints and defrost schedules with what your contractor says they should be.

What to do: a prioritised checklist

Immediately (today)

• Take controllers off the public internet. CERT-FR’s first recommendation is to make sure devices cannot be reached from the internet, including on a public IP. Danfoss advised its Dutch customers to disconnect from the internet.
• Tell your contractor before you cut their link. CERT-FR notes that some insurance contracts depend on the contractor’s monitoring feed. Agree on a safe interim arrangement rather than leaving cases unmonitored.
• Change every default password, including installer and service accounts.
• Check setpoints and defrost schedules on every controller against the contractor’s documented values.
• Turn on independent temperature alarms. A standalone sensor with its own SMS or email alert does not depend on the controller you are worried about.

This week

• Restore remote access only through a secure path: a VPN or protected network with multi-factor authentication. CERT-FR says filtering contractor IPs at a firewall is an emergency measure only, not a fix.
• Update firmware. For Danfoss AK-SM 800A, the vendor told customers to move to R4.3.1 or later. Units on 3.x must go to 4.x first, and 5.3.x cannot be downgraded. CERT-FR also tells Danfoss users to set the security level to Strict. Copeland’s fix for XWEB Pro was firmware 1.13.
• Segment the network. Italy’s ACN and the US agencies both say to separate these systems from corporate networks.
• If you suspect compromise, follow CERT-FR’s order: limit network access to the service provider only, factory reset, apply all available fixes, change secrets, review accounts, then fully reconfigure. CERT-FR warns that a factory reset on its own leaves an exposed end-of-life device open to attack again.

Longer term

• Replace end-of-life controllers. ACN recommends updating or replacing devices no longer supported by their manufacturers. An exposed EOL controller, in CERT-FR’s words, is “very likely to be compromised”.
• Enforce safe limits in the equipment, so setpoints and defrost durations cannot be pushed outside acceptable ranges, as the US agencies recommend.
• Put OT assets in your asset inventory and contracts. Write remote-access, patching and password requirements into refrigeration and BMS service contracts.
• Monitor privileged accounts on remote support systems, as ACN advises.
• Test it. Include building and OT systems in your next external attack-surface review and penetration test.

What this means for Pakistan and South Asia

Pakistan’s pharmaceutical distributors, hospital pharmacies, vaccine programmes, dairy and frozen-food producers, and fast-growing grocery delivery businesses all depend on cold chains. In a hot climate, a few hours of forced defrost costs more and is harder to recover from. The equipment is the same as in Europe, and so is the habit of letting an installer expose a controller on a public IP “so we can fix it remotely”. Nothing about this campaign is specific to Europe. Any exposed controller with a default password is a target, wherever it is.

OffensioX perspective

This campaign is a clear sign that attackers have found a cheap way to cause real-world disruption: no ransomware, no zero-day, no ransom note, just a browser and a forgotten login page. Nobody has claimed it, and investigators in Belgium have said the people behind it may never be identified. Whether the motive is sabotage, testing or simple vandalism, the lesson for defenders is the same. Operational technology, such as fridges, HVAC, cameras and building controls, usually sits outside the IT team’s inventory and outside its patch cycle, and it is often managed by a contractor nobody has audited. The first step is not expensive. Find out what you own, find out what the internet can see, and close it.

OffensioX helps organisations map their external attack surface, including OT and building systems, and run penetration tests and security assessments that find exposed controllers before attackers do.

References

• BleepingComputer – FBI, CISA warn of cyberattacks targeting refrigeration systems
• CISA – US government partners urge hardening industrial refrigeration and cold-chain monitoring systems
• BleepingComputer – Cyberattack shuts down refrigerators at French supermarkets
• The Hacker News – Attackers heat French supermarket fridges up to 50°C by hijacking Danfoss controllers
• The Hacker News – New wave of refrigeration cyberattacks hits supermarkets across Europe
• CSO Online – When defrost becomes sabotage: 3 OT lessons from France’s supermarket attack
• Il Sole 24 Ore – Cyberattacks on the cold chain: two Italian companies hit, ACN issues alert
• WSB-TV – Hackers target freezers, cold storage in cyberattacks
• Climate Control News – Firmware issued to secure controllers
• Ciphers Security – Supermarket refrigeration cyberattacks
• CXO Digital Pulse – Supermarket refrigeration systems targeted across seven European countries
• CERT-FR – Alert CERTFR-2026-ALE-012