Around 2:30 in the morning on 2 November, the manager of a Delhaize store in Eeklo got an alert: her freezers had been set to 50°C. By morning, meat and fish worth tens of thousands of euros were in the bin, [VRT NWS].
The crazy thing? Nobody in the store had touched a thermostat. Somebody did it remotely.
Refrigeration attacks have been popping up across Europe. This is a wake-up call that goes far beyond supermarkets. Any organisation that runs connected equipment, from cold rooms and HVAC to production lines and building management, should be on high alert. The question to ask yourself: if someone gets in, how far can they go?
What happened
On the night of 11 to 12 October, attackers took control of refrigeration controllers in hundreds of French supermarkets. Refrigeration units from up to 700 stores across chains were put into defrost mode for hours, so they heated up instead of cooling. Some cold rooms reached temperatures up to 50°C.
In mid-October the French CERT issued an alert naming refrigeration controllers from Danfoss (AK-SM and AK-SC series) and Copeland/Dixell (xweb). It urged operators to take them off the internet and update what can still be updated. The Belgian CCB issued a warning too. According to Danfoss, most units hit in France were older models that no longer get security updates.
Three weeks later the same pattern hit Belgium. During the night of 1 to 2 November, around 40 Delhaize stores in Flanders and Wallonia saw their fridges and freezers warm up. Carrefour Belgium counted 15 affected stores, and around five Spar shops and several Intermarché stores were hit as well. In these stores too, units were switched to defrost mode. One Proxy Delhaize operator estimated his loss at €60,000. The same night, stores in the Netherlands, Luxembourg, Ireland, Sweden, Finland, Estonia, Portugal and Italy reported similar problems.
The Belgian federal prosecutor has opened an investigation, and the CCB says the perpetrators may never be identified. What is clear is how easy it was. In the Netherlands, Danfoss said the affected systems weren’t on a secured network and still used default passwords. In Belgium alone, around 970 Danfoss and 123 Copeland systems were found reachable from the internet.
So why do attackers go after fridges?
Refrigeration controllers are a textbook example of operational technology (OT) that has quietly joined the network. They are bought by facilities or store operations, and often aren’t managed by or even considered the responsibility of IT.
An installer connects them so they can be monitored and maintained remotely. After that, they run in the background for ten, fifteen years without anyone looking at them again.
That makes them attractive targets:
- They’re often reachable from the internet, or from a flat store network where a till, a camera and a cooling unit all sit in the same zone.
- They’re protected by default or predictable passwords that were never changed after installation.
- They’re managed through a supplier’s remote access that the store itself doesn’t fully control.
- Many run old firmware. Some models in the French attack no longer get any security updates.
- The impact is physical and visible: spoiled stock, closed shelves and, in the worst case, a fire.
So far nobody has officially claimed the attacks, but specialised media suggest that the perpetrators are pro-Russian hackers. No ransom demand has been reported.
That raises an uncomfortable question: is someone doing this simply because they can? Or is disruption the goal in itself? Illumio warns that state-sponsored groups may target sectors such as food production, where an outage is felt immediately. There’s no obvious financial gain for the attacker, while the victims are left with spoiled stock, empty shelves and a bad image, and maybe worst of all: the bill.
The patch that will never come
The standard advice would be to patch and to take devices off the internet. While both are right, neither is enough on its own.
You can’t patch a controller that the manufacturer has stopped supporting. And you won’t replace hundreds of units across dozens of sites in a single week. In the meantime, those devices stay on your network.
And this goes far beyond fridges. The same goes for medical equipment, building systems, production machines and that one old server nobody dares to touch.
We made the same point recently about servers, in When patching isn’t possible yet. The cooling attacks show the problem is even bigger in OT, where the patch often never comes at all.
Contain what you can't fix
Start with the basics. Every incident reported so far followed the same pattern: a controller reachable directly from the internet, protected by default credentials or running outdated firmware. Microsegmentation would not have prevented those incidents. Taking controllers off the internet, changing default passwords and updating firmware would have. That comes first.
But you can’t always remove every weakness. Some controllers can’t be patched, and suppliers still need remote access. If you can’t remove the weakness, limit what it can reach. This is often called virtual patching, and it is what microsegmentation does.
A refrigeration controller needs to talk to very few things: its monitoring system, perhaps one supplier connection, and an alarm channel. With microsegmentation, those few flows are allowed and everything else is blocked. This limits two things. An attacker who reaches the controller can’t use it as a stepping stone into the store network or head office. And an attacker who has already compromised a laptop or server elsewhere on the network can’t reach the controller.
The result is a breach that stays small. One compromised controller stays one compromised controller, not a foothold into the rest of the store or head office.
Finally, watch for the change that matters. An alert on setpoint changes tells you as soon as someone adjusts a temperature, so you can respond before stock is lost.
Segmentation without rebuilding your network
Many organisations assume this kind of segmentation means a huge network project. And traditionally it did: firewall rules per site, new VLANs, change windows and months of work, repeated at every location.
“The cooling attacks are exactly the kind of case where segmentation pays off. The classic approach with firewalls is fairly complex: you redesign the network, write rules for every site and hope nothing breaks. With Illumio it’s simple. First you map which systems talk to each other, then lock down what a device, like a cooling controller, is allowed to do. The key in this approach is you can do all of this without touching the network itself.”
– Wouter Decruy, Managing Director @ACEN
That’s the approach we take with our partner Illumio. We start by mapping actual traffic, so you see what each device really needs. Then we test policies in a visibility-only mode before they are enforced. For servers and workstations, Illumio enforces policy on the host itself.
For devices that can’t run software, like cooling controllers, we model them in the same policy and enforce it at the nearest control point: the systems they talk to, your existing firewall or your switching infrastructure.
A suspicious device can be isolated with one click. You don’t need to redesign your network, rewrite firewall rules, change VLANs or update routing, and nobody writes rule sets by hand for each site.
Illumio makes the same case for factories in PHP2Shell exposes hidden risks in factory systems. The lessons apply just as well to cold rooms.
Six things to do this week
- Find your OT.
List every connected device that isn’t a laptop or a server: cooling, HVAC, access control, cameras, production equipment. Don’t forget the web interfaces and management software nobody remembers installing. - Take it off the internet.
No controller should have a web interface reachable from outside. - Change defaults.
Having default passwords on the fridge controllers is yet another door left open. - Take control of supplier access.
Remote maintenance should go through a jump host or Zero Trust Network Access under your own control, not a permanent tunnel. - Ringfence what you can’t patch.
Allow only the flows a device actually needs and block the rest. - Agree on the plan.
Decide in advance who can isolate a site or a system, what gets cut, and what must keep running.
