↓ Skip to main content
fr1zz0

The fridge was on the Internet

·7 mins·
Sicurezza Ot-Security Ics Refrigeration Danfoss Nis2
Table of Contents

On the night of 11 October someone switched on the defrost heaters in the refrigerated cabinets of a few hundred French supermarkets. With the food still inside. By morning the freezers read 50 °C, even more in Normandy, and in some stores the equipment had melted. The French finance minister spoke of roughly 700 stores out of 10,000; Les Mousquetaires, the group behind Intermarché, puts the damage in the tens of millions of euros.

Three weeks later, on 2 and 3 November, the same thing happened in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Portugal, Estonia and Italy, where at least four Coop stores run by the Radenza group in Sicily were hit. SecurityWeek counts more than a hundred stores.

I’ve spent the last few days piecing the story together from official sources so I could use it in a course on industrial control system security. The more I read, the more it looked like a textbook case: no new technique, just mistakes that anyone working in OT has known about for twenty years.

What happened, briefly
#

Every supermarket has a controller that runs all its refrigerated cabinets: temperatures, alarm thresholds, defrost schedules. The ones involved here are mostly Danfoss AK-SM and AK-SC units, plus some Copeland supervisors and Dixell xweb. They have a web interface, designed so the refrigeration contractor can work on them remotely instead of sending a technician.

In thousands of cases that interface was answering directly on the Internet. In August Claroty counted 2,765 of them on Censys, and on 2 November about a thousand were still visible.

There were at least three ways in.

  • Factory credentials. Danfoss itself told Dutch broadcaster NOS that the affected systems in the Netherlands weren’t on a protected network and were using default passwords.
  • The “code of the day”. It’s a hidden service password, derived from the device’s date and meant for support staff. Claroty Team82 reconstructed the algorithm and published it in August 2026 together with two more AK-SM 800A vulnerabilities: CVE-2025-41450 (authentication bypass, CVSS 8.2), CVE-2025-41451 (command execution) and CVE-2025-41452 (denial of service). Patches already existed: 4.2 since March 2025 and R4.3.1 since August 2025.
  • End-of-life hardware. The AK-SM 800 hasn’t had an update since May 2021, the AK-SC 355 since 2016. No patch will ever come for them.

Which route was actually used hasn’t been made public. On the older models no numbered vulnerability was probably needed at all.

Once inside, the attackers didn’t install anything: they used a normal feature. Defrost exists to melt the ice on the evaporator; triggered on command, with the thresholds changed, it heats the food.

Three things I’m taking away
#

There was nothing to detect. No malicious file, no odd process, no signature. A legitimate command, sent with valid credentials to a device that accepts it. The tools IT usually relies on, antivirus and EDR, have nothing to work with here. The only thing that could notice was whoever watches the process: in Estonia a Selver freezer rose two or three degrees and ten minutes later everything was fine, because someone saw the alarm and reacted. The control that worked best, across all of Europe, was an alert technician.

The system didn’t belong to IT. The controller is installed and managed by the refrigeration contractor, who connects it however suits them. ICA in Sweden said so explicitly: all the affected stores were connected to an external control system, outside the central network, which in fact wasn’t touched. It’s the pattern I see in almost every company with physical plant: each system has its own vendor, each vendor its own way in, and nobody has the full list. When the asset inventory gets done, these devices aren’t in it, because as far as IT is concerned they don’t exist.

Patching wasn’t enough. Even in the best case, a firmware update would have closed Claroty’s CVEs on one model only. The other two needed replacing, and Stephan Moelans, managing director of Sabcobel, the Belgian installer that looks after Delhaize stores, said plainly that many sites need expensive physical changes. An end-of-life device reachable from the Internet stays compromisable, and according to CERT-FR not even a factory reset makes it safe. You either isolate it or replace it, and both cost money.

What the authorities said
#

CERT-FR published alert CERTFR-2026-ALE-012 on 12 October, updated on the 13th and 16th. The key sentence is blunt: exposing a management interface to the Internet goes against good practice. The recommendations are the expected ones (remove the exposure, VPN-only access, updated firmware, changed passwords, “Strict” security level on Danfoss units) plus one that caught my eye: check your insurance terms before cutting off data transmission to the vendor.

Italy’s ACN published bulletin BL01/261013/CSIRT-ITA on 13 October, “Urgent verification and mitigation measures for food retail and cold chain operators”, and updated it on 3 November after the Italian cases. Two of its recommendations apply to any facility, not just refrigeration:

  • coordinate every change between IT security, facility managers and maintenance contractors, so that removing network access doesn’t shut the equipment down;
  • check actual temperatures with instruments that are independent of the supervisory system.

The second is the most important point in the whole affair, and the least quoted. If the system controlling the plant is compromised, what it displays can be fake too. Stuxnet showed operators recorded values while the centrifuges were tearing themselves apart. A hundred-euro thermometer, connected to nothing, is a security control.

Who did it
#

Nobody knows. No one has claimed it. Belgium’s Centre for Cybersecurity said it may never be determined. Ken Munro of Pen Test Partners pointed out that, given how easy it was, it could just as well be kids messing around.

Then there’s an American thread. Reuters reported on 29 October that the Pentagon is treating the failure of freezers in at least six US military commissaries in late August as a suspected cyberattack: there too, units in defrost with food inside. Defense One cites officials who suspect Iran-linked groups, with the caveat that the assessment could change. The brand of the controllers at the bases hasn’t been disclosed, though, and without that the link to Europe remains a hypothesis.

I wouldn’t commit either way. For anyone defending a facility it makes little difference anyway: if a bored teenager and an intelligence service can do the same thing with the same effort, the problem isn’t the attacker.

If you run a facility, tomorrow morning
#

You don’t need to be a supermarket. Generators, UPS units, air handling units, switchboards with power analysers, CCTV systems: almost all of them have a web page and a contractor who logs in from outside. The questions to ask are few.

  1. Which of our devices have a management interface reachable from the Internet? Not the ones we think, the ones that show up when we search Shodan or Censys for our public addresses.
  2. Who logs in, with which account, from where? If the answer is “the contractor, with the password they’ve always used”, the job is already clear.
  3. Which ones are end of life, and is there a plan to replace them?
  4. If a system started behaving strangely tomorrow morning, would we notice through something that doesn’t go through that same system?
  5. If we had to cut the vendor connection tonight, what would stop, and who makes the call?

The fifth question is the one nobody asks in advance. In France, on the evening of 12 October, plenty of people had to ask it in a hurry.

Sources
#

Originally written in Italian, translated with AI assistance and reviewed by the author.