The controller became the attack surface
Reports describe attackers changing refrigeration settings at more than 100 businesses across Europe. Some units were reportedly pushed into defrost mode or had their temperature settings raised. In a few cases, equipment reached about 50°C (122°F), leaving stores with spoiled or unsellable stock.
The technical detail matters, but so does what we don’t know. Investigators have not publicly confirmed one entry method, a specific vulnerability, or who was behind the attacks. Reporting on some affected Dutch systems says they were not on a secure network and still used default passwords. That is a serious clue, not proof that every affected store had the same weakness.
Reuters’ reporting and SecurityWeek’s coverage describe disruption across multiple countries. The reported totals and locations vary, so treat the numbers as an estimate rather than a final incident count.
This is an operational technology problem
Refrigeration controllers are part of a business’s operational technology, the systems that make physical equipment behave. If an attacker can change a temperature target or defrost schedule, they may not need to steal a password database or encrypt a server to cause real damage. They can interfere with the process the business depends on.
That changes the response. A controller’s management interface should not be exposed directly to the public internet. Remote access for a refrigeration contractor should go through a protected connection, ideally a VPN with strong authentication, and be limited to the people and devices that actually need it.
There is useful background in CERT-FR’s October alert, which covers earlier compromises involving named refrigeration-controller product lines and recommends isolating management access, reviewing settings, and securing credentials. It is not a forensic report on this newer wave, so don’t assume every model or store was affected in the same way.
The uncomfortable lesson: if a remote controller can change the conditions your inventory needs to survive, it belongs in your security plan.
What a store owner should check now
Ask your refrigeration provider to walk through the access path with you. Specifically:
- Find every controller and remote-access route. Include equipment managed by contractors, not just devices your IT provider installed.
- Remove direct internet access. Use a secured remote connection and restrict it to approved users and devices.
- Replace default credentials and apply supported firmware updates. If a controller is no longer supported, isolate it and plan a replacement with your service provider.
- Check temperature targets, defrost schedules, and alarms. Compare settings with the intended operating schedule, and make sure staff know how to spot unusual readings.
- Keep a fallback procedure. Agree on who to call and how to check temperatures manually if remote monitoring or the controller starts behaving strangely.
If you suspect a controller has been changed, coordinate with your refrigeration contractor before reconnecting or resetting it. Preserve the equipment’s current state where practical, isolate its network access, and have the contractor verify the configuration before restoring remote access.
If refrigeration controls are connected to your business network, the first job is to find out exactly how they can be reached.
Book a 15-minute security check
We’ll help map the access path and identify the first fixes, with no obligation.