Freezer attacks across Europe show the risk of unattended devices on the open internet

Attackers have switched refrigeration systems into defrost or heating mode at hundreds of supermarkets in 10 European countries since mid-October, spoiling chilled and frozen food and prompting criminal investigations in France and Belgium.

The pattern has since appeared outside food retail. Freezer settings were changed at cold storage used by France's blood service, and in early November a department store and a fruit cold store in Norway reported suspected attacks. In the United States, the Pentagon is investigating freezer failures at military commissaries as a suspected cyberattack.

For anyone who runs equipment that nobody watches overnight, the incidents raise a practical question. In the cases described so far by authorities and researchers, the controllers were not tampered with on site. They were reachable from the internet.

Nobody has claimed responsibility. Investigators have not said who is behind the attacks, whether the incidents are linked, or exactly how the attackers got in.

Timeline of reported incidents

The table lists incidents reported publicly up to 5 November 2026.

The Paris prosecutor's office opened an investigation after the October attack, TIME reported, and Belgium's federal prosecutor has opened one into the November incidents, according to SecurityWeek.

EU agriculture commissioner Christophe Hansen described the attacks as a deliberate attempt to disrupt Europe's food supply, NRK reported, citing Reuters. He added that food security in the EU is not under threat for now, according to SecurityWeek.

In Norway, the business security council NSR said several dozen attacks against Norwegian refrigeration systems had been averted. It also found systems with login pages open on the internet, NRK reported.

How the controllers became reachable

Supermarket refrigeration controllers are connected for practical reasons. They send temperature alarms overnight, and refrigeration contractors log in to adjust settings and clear faults without a site visit. A security specialist interviewed by RTÉ said some systems need internet access for overnight alerts, but that outdated equipment should not be connected directly to the public internet.

The risk comes from how the equipment is connected, not from any single make. The CERT-FR alert covers controllers from 3 manufacturers, Danfoss, Copeland and Dixell, and states that exposing any management interface on the internet goes against good practice. Security researcher Kevin Beaumont said people he spoke with confirmed that every freezer hit on 2 November had a management interface reachable from the internet, SecurityWeek reported.

What the attackers looked for was exposure and settings left unchanged. Deception security firm Lupovis recorded login attempts against its decoy refrigeration controllers between 20 and 30 October, most of them trying factory-default credentials, which both CERT-FR and the manufacturer advise changing. Internet scanning firm Censys counted a little over 1,000 web interfaces for 1 widely used controller family still reachable online after the second wave. Both findings come from the same SecurityWeek report.

Much of the equipment hit was old. Danfoss told Cooling Post that most affected units in France were legacy products, or current products that had not been updated, and that it has long advised customers to keep firmware current and migrate legacy systems. For its current models, fixes were already available. Danfoss's firmware updates included fixes for flaws researchers had reported in its current AK-SM 800A controller, TIME reported.

The route in was not always a fixed line. The owner of Havaristen said the affected freezer was connected through an external 4G transmitter that allowed the supplier to control it remotely, while the rest of the site sat behind the company firewall. He said the business had not known the transmitter was unsecured, E24 reported, citing NRK.

Where operators have acted, exposure has fallen. Censys counted exposed Danfoss StoreView instances in France falling from 1,825 before the October attacks to 220 by early November, according to SecurityWeek.

What the authorities and Danfoss advise

The CERT-FR alert, first published on 12 October and updated on 16 October, sets out an order of work. Operators should remove internet exposure from affected units and from any unit on a public IP address, then check the full configuration, including defrost schedules. Access should be restored only through a secure VPN or a protected network. Filtering the refrigeration contractor's source IP addresses on a firewall is acceptable in an emergency, the agency says, but not as a lasting fix. Manufacturer hardening follows, which for Danfoss means current firmware, the Strict security level and changed default passwords.

CERT-FR warns that an unpatched end-of-life device left exposed to the internet faces a high likelihood of compromise, and that a factory reset alone leaves it open to the next attempt. It also says attack campaigns against these devices are likely still under way.

Danfoss told customers on 13 October to disconnect their systems from the internet and reconnect only through a secure network. A company spokesperson told Dutch broadcaster NOS that most stores acted but a small number did not, SecurityWeek reported. Sabcobel chief executive Stephan Moelans said a software update does not fully close the gap on some affected equipment, which also needs physical modification.

Norwegian authorities have given similar advice. The Norwegian National Security Authority (NSM) told NRK that old equipment should be phased out and security updates applied where possible. The Norwegian Communications Authority (Nkom) advised businesses to ask their suppliers about updates, vulnerability handling and security support, Nettavisen reported.

Remote access is not the problem

None of the authorities recommend taking refrigeration offline altogether. Overnight alarms and remote servicing are why these systems were connected in the first place. CERT-FR tells operators to check their insurance terms before they cut the data feed to their refrigeration contractor.

The issue is how the connection reaches the device. ICA told NBC News that its affected stores used an external supplier and had their connectivity outside ICA's central network. Arrangements like this are common with unattended equipment. One company owns the device, another provides the connection and a third maintains it. In that set-up, responsibility for the exposure is easy to lose between them.

 

"A freezer controller talks to 2 or 3 systems: the alarm service, the service contractor, the energy platform. None of these needs to be on the open Internet. If anyone in the world is able to reach the device, sooner or later someone will," said Henning Solberg, CTO of IXT.

The same questions apply well beyond food retail. EV chargers, water pump stations, building controllers and cold-chain sensors all sit unattended, need remote access, and in many cases run firmware their owners cannot update on demand. For any of them, it is worth asking whether the device has a public address, who logs in to it and how, and whether you would know if its settings changed overnight.

Keeping remote access without the exposure

The principle behind CERT-FR's advice applies whatever the connection. An unattended device should not have a public address, and each remote connection to it should be deliberate, limited and recorded. That rules out an open login page on a fixed line, and, as the Norwegian case shows, it rules out a cellular link with a public address too.

"Most of this equipment needs a technician to reach it. The mistake is connecting it so that anyone can," said Henning Solberg, CTO of IXT. "We keep devices like these on a private mobile network with no public address, and contractors get access to 1 device at a time, with every session recorded. A regular SIM just gives you unprotected Internet access."

What remains the operator's responsibility

No connectivity layer replaces security on the device itself. Default passwords need changing, supported equipment needs current firmware, and controllers that no longer receive security updates need replacing, as Danfoss and CERT-FR both advise. Operators also need a record of what is connected, who maintains it and how they reach it.

A private network controls the path to the device and who is allowed to use it. Firmware, credentials and the device lifecycle stay with the operator and the equipment supplier.

Questions operators are asking

Were the attacked controllers connected over cellular?

For most incidents, public reporting does not say. In 1 Norwegian case, the owner said the freezer was connected through an unsecured external 4G transmitter. For the November wave, sources confirm that the affected management interfaces were reachable from the internet, whatever the underlying connection.

Do refrigeration systems need internet access?

They need to send alarms and accept remote service. That requires a connection, not a public address.

Is a VPN enough?

CERT-FR names a secure VPN or a protected network as the way to restore access, and either is a clear improvement on an open login page. A VPN gives whoever holds it access to the network behind it. For outside contractors, browser-based access limited to 1 device and a set time window narrows that access further.

What should operators do first?

Follow the CERT-FR order. Remove public exposure, check the configuration including defrost schedules, restore access through a protected path, then update firmware and change credentials.

Does this apply outside food retail?

Yes. The same pattern reached French blood plasma storage, and the Pentagon is investigating freezer failures at US military commissaries. Any unattended device with a reachable management interface carries the same risk, from EV chargers to water pump stations.

Running unattended equipment that needs remote access? Ask us how it works for your deployment.

Why trust this guide

This guidance is based on real IoT and OT deployments in regulated industries including energy, utilities, and industrial environments.

IXT designs and operates secure connectivity architectures where:

• devices are deployed across multiple countries and networks
• SIM-level identity is enforced at the network edge
• third-party access is controlled without VPNs
• audit trails are required for regulatory compliance (including NIS2)

The patterns described here reflect how these environments are secured in practice, not theoretical models.

About the author

This article was written by the IXT Connectivity and Security team.

IXT operates a full MVNO core network and delivers secure IoT connectivity across 190+ countries and 600+ mobile networks. The team works directly with industrial, utilities, and infrastructure operators to design and secure large-scale IoT and OT deployments.

Their focus is on network-level Zero Trust architecture, SIM-based identity, and secure device communication without relying on VPNs or endpoint agents.