Twice in three weeks, unknown actors remotely manipulated the controllers of refrigeration systems at night: first in hundreds of French supermarkets, then in more than a dozen European countries, including Germany and Switzerland. Refrigerated display cases and cold rooms warmed up in defrost mode, and goods spoiled. No malware was needed. All it took were controllers that were publicly reachable from the internet, often with a default password or outdated firmware. Our briefing shows what is established, what NIS2 and the Cyber Resilience Act require of operators and manufacturers, and why the supply chain tips the balance.
The attacks on refrigeration systems were not a high-tech hack but the result of known, avoidable lapses: controllers were exposed to the internet, credentials were left at factory defaults, and updates were missing or no longer available at all for legacy devices. Anyone who operates cold chains, manufactures refrigeration technology or maintains systems remotely should check now whether their systems are reachable and incorporate the result, in a verifiable way, into their risk management under NIS2 and the CRA.
From the Claroty analysis in August to the joint warning by the US agencies. Setpoints are not measured temperatures: how warm it actually got depended on how quickly someone intervened.
Refrigeration systems fail in at least six commissaries, the supermarkets on US military bases. According to Reuters, the Pentagon is treating the cases as a suspected cyberattack; this has not been confirmed, nor has any connection to Europe. [34]
Refrigeration controllers in French supermarkets are remotely put into continuous defrost, with setpoints of up to 50 °C. Affected stores include those of Intermarché, Carrefour, Super U, Monoprix and E.Leclerc. Finance Minister Roland Lescure puts the number at around 700 stores; the public prosecutor’s office is also examining reported fires. [7][8][9][10]
Lupovis and Previdian honeypots register access and login attempts on simulated Danfoss controllers, in Previdian’s case using the factory password of an older model. According to Lupovis, only decoys in Europe were triggered; it remains unclear whether the perpetrators are behind this. [26][27][62]
More than 100 stores are affected. The news agency AFP counts twelve countries, including Germany, Belgium, the Netherlands, Sweden, Ireland, Italy, the UK and Estonia; Belgium is among the most affected. Cases in Switzerland also come to light later. On the same day in France, cold rooms of the blood donation service EFS are manipulated via a refrigeration service provider’s remote monitoring; no blood products are lost. [11][12][13][14][15][17][61]
A Telegram channel of NoName057(16) claims responsibility for the attacks, together with Z-Pentest, in an AI-generated video. According to Swedish fact-checkers, the alleged evidence comes from older data leaks; experts consider the claim unsubstantiated. The Kremlin denies any involvement. [28][29][32]
Lüthi’s Fleischwaren in Köniz reports an attack on the controller of its refrigeration and freezer systems; Volg reports altered parameters in three branches. So far, the BACS has received one mandatory report concerning commercial refrigeration systems; it does not comment on individual cases. [14][15]
According to the analyses published so far, the attacks followed a simple, easily scalable pattern. There are no indications of unknown vulnerabilities; the decisive factor was controllers being directly reachable from the internet.
Web interfaces of refrigeration controllers are found through automated scans and search engines for connected devices.
Unknown actors query versions and try factory passwords; according to Lupovis, only decoys in Europe were triggered. It remains unclear whether these were the perpetrators.
They gain access using unchanged default credentials; with outdated firmware, known flaws such as an authentication bypass are a possible route.
Using standard functions, they switch refrigerated units to defrost mode and change setpoints and alarm limits; in one forensically examined case, commands to mute alarms and lock the keypad were also logged.
The changes are apparently scripted and run simultaneously overnight into a Monday, when no staff are on site. The damage is noticed through alarms or not until the morning.
Functions intended by the manufacturer were sufficient for the manipulation. Malicious changes therefore look like normal operation. Antivirus protection that looks for malicious code is ineffective here. What matters is reachability, access protection and the monitoring of setpoints, configuration changes and logins.
The publicly described steps can be mapped to techniques of the ATT&CK framework for industrial control systems. The mapping is our assessment based on the analyses published so far.
| Technique | Name | Relevance to the attacks |
|---|---|---|
| T0883 | Internet Accessible Device | The controllers were directly reachable from the internet, often via port forwarding or cellular modems. |
| T0859 | Valid Accounts | Valid administrator accounts, often with unchanged default passwords, enabled changes that look like normal operation. |
| T0836 | Modify Parameter | Setpoints, defrost intervals and defrost termination values were changed; in France, according to Le Monde, defrost cycles were extended from one hour to up to eight hours. |
| T0838 | Modify Alarm Settings | Alarm limits and alarm delays were set to extreme values. |
| T0878 | Alarm Suppression | Commands to mute alarms were intended to prevent anyone from reacting in time. |
| T0813 | Denial of Control | In at least one documented case, keypad lock commands were sent that were intended to make on-site intervention more difficult. |
| T0879 | Damage to Property | Spoiled goods and strained equipment; the US agencies additionally warn of fire risk. |
So far, there is no confirmed attribution: no government or authority has named a perpetrator. There is a claim of responsibility, assessments by security researchers and a denial from Moscow.
On November 3, a Telegram channel of NoName057(16) claimed responsibility for the attacks, together with Z-Pentest, in an AI-generated video. According to Swedish fact-checkers, the alleged evidence comes from older data leaks; technical evidence is lacking.
According to US agencies, the group emerged in 2024 from the pro-Russian hacktivist scene and specializes in attacks on industrial control systems. The EU sanctioned the group in July 2026 for attacks on critical infrastructure, such as one on a Danish water utility – not for the refrigeration attacks.
So far, Sekoia sees no technical evidence pointing to Russian-speaking groups. Lupovis notes overlaps with infrastructure attributed to Russian actors but cannot reliably identify the perpetrators. Romania’s cybersecurity agency calls the approach semi-amateurish.
Iran-linked actors have attacked publicly reachable industrial control systems in the past; there is no evidence linking them to the current waves. Sekoia also considers it possible that different groups or copycats are involved.
According to a US indictment, pro-Russian hacktivists disabled the refrigeration at a meat processor in California in 2024. A Danfoss bulletin from October 2025 mentions attacks on stores in Russia and Israel in 2022; the Israeli systems lacked adequate firewall or VPN protection.
The European Commission describes the attacks as a targeted attempt to disrupt the food supply but names no perpetrator. The US fact sheet names neither perpetrators nor manufacturers. The Kremlin dismisses any suggestion of involvement as absurd.
For defenders, the question of who is behind the attacks is secondary. Whether state-directed actors, hacktivists or copycats, they all exploit the same gap: reachable controllers with weak credentials. Anyone who closes this gap is prepared for all of these variants. You should not take claims of responsibility by such groups at face value; US and European authorities explicitly warn of exaggerated or false claims.
The NIS2 Directive does not cover every operator of a refrigerated counter, but it does cover large parts of the cold chain. Activity and size are decisive: as a rule, from 50 employees or more than €10 million in both annual turnover and annual balance sheet total. In Germany, NIS2 has applied since December 6, 2025, through the new BSI Act.
| Area | Who in the cold chain | NIS2 | Note |
|---|---|---|---|
| Food: wholesale and industry | Wholesalers, producers and processors of food | covered | Covered as an important entity from medium size upward. Whether central warehouses of retail chains count as wholesale is not clear-cut. |
| Food: retail | Supermarkets, branches, butcher’s shops | not directly | Retail, storage and transport are not covered. In Germany, however, large retailers can still be particularly important entities via the critical-infrastructure (KRITIS) thresholds. |
| Health | Hospitals, laboratories, pharmaceutical manufacturers | covered | Covered from medium size upward; large entities fall into the stricter category. NIS2 does not explicitly mention blood donation services; in Germany, large ones are covered via the KRITIS thresholds. |
| Manufacturers of refrigeration and control technology | Mechanical engineering, electrical engineering, electronics | covered | Covered as an important entity from medium size upward. Companies that only install and service equipment are not covered as such. |
| Remote maintenance and remote monitoring | Providers that manage their customers’ systems remotely | partly | They can be covered as managed service providers if they manage or maintain their customers’ network and information systems, including remotely. Whether this applies to the remote monitoring of refrigeration systems has not yet been clarified. |
| Transport and logistics | Refrigerated road transport | not directly | Road freight transport is not one of the NIS2 sectors, whereas freight transport by rail, ship or air is. Critical food logistics may also be covered by the rules on the resilience of critical entities. |
Simplified overview, not legal advice. Whether a company is covered depends on its activity, size and national law. Even companies that are not covered are indirectly affected if their customers are subject to NIS2 and pass security requirements on to their suppliers.
Refrigeration controllers, building management systems and remote maintenance access points belong in the asset inventory and the risk analysis, not just servers and workstations.
Replace default passwords, assign personal accounts, secure remote access with multi-factor authentication.
Keep firmware up to date, follow manufacturer advisories, replace or isolate unsupported devices.
No direct internet connection for controllers; access only via secured remote maintenance and separate network zones.
Monitor temperature and configuration changes, route alarms to on-call staff, including at night, and handle incidents in an orderly manner.
Report significant incidents: early warning within 24 hours, notification within 72 hours, final report one month later.
Plan and practice backup refrigeration, manual override and protection of goods for emergencies.
Define security requirements for manufacturers, refrigeration contractors and remote maintenance service providers, set them out in contracts and verify compliance.
Management must implement the measures, oversee their implementation and take part in training regularly; it is liable for culpable breaches of duty. Fines go up to €10 million or 2 percent of worldwide annual turnover, and up to €7 million or 1.4 percent for important entities, whichever amount is higher in each case.
The German NIS2 Implementation Act has applied since December 6, 2025. The BSI expects around 29,500 entities to be affected; by the end of September 2026, just over 20,000 had registered. Large retail and logistics companies as well as blood donation services can be particularly important entities via the KRITIS thresholds.
Switzerland is not bound by NIS2. Since April 1, 2025, however, operators of critical infrastructure – including hospitals, suppliers of essential everyday goods and manufacturers of remote maintenance and OT products – must report cyberattacks on their own systems to the BACS within 24 hours of discovery and submit any missing information within 14 days. Smaller suppliers are exempt, and voluntary reports are explicitly welcome. Manufacturers supplying the EU are already subject to the CRA’s reporting obligations; a dedicated Swiss cybersecurity act is in preparation.
Austria transposes NIS2 through the NISG 2026, which has applied since October 1, 2026; initial registration runs until January 1, 2027. According to the Austrian Economic Chamber, around 4,000 companies are affected. In October, CERT.at found only four publicly reachable refrigeration system interfaces.
Learn moreNIS2 consulting NIS2 at a glance KRITIS consulting
The Cyber Resilience Act governs the cybersecurity of products with digital elements. In their FAQ, the Commission services explicitly include smart refrigerators, industrial IoT devices and machinery among the examples. The CRA places obligations on manufacturers, importers and distributors, not on operators. Refrigeration controllers are expected to fall into the default category, in which manufacturers may assess conformity themselves. In the BSI’s assessment, based on current knowledge, access to the affected controllers was apparently already inadequately secured at the time of delivery; ideally, this should be caught in the conformity assessment in the future.
The regulation has entered into force; its obligations apply in stages.
The rules on the notification of conformity assessment bodies apply.
Manufacturers must report actively exploited vulnerabilities and severe incidents and inform affected users, including for older products and beyond the end of support.
All essential requirements apply to every product placed on the market from then on, even if the model is older. From that date, fines of up to €15 million or 2.5 percent of worldwide annual turnover can be imposed.
Manufacturer obligations do not apply only to controller manufacturers. Anyone who assembles components into a new connected product and places it on the market, sells a product under their own name or substantially modifies it is considered a manufacturer in their own right under the CRA. Refrigeration contractors and manufacturers of refrigerated display cabinets should therefore clarify their role.
Early warning within 24 hours, notification within 72 hours, final report 14 days after a fix has been made available or, for incidents, one month after the notification. The deadline runs from the point of awareness following a prompt initial assessment, including awareness prompted by information from customers, authorities or the media. Reports are submitted via the ENISA Single Reporting Platform to the competent CSIRT – in Germany, the BSI; manufacturers without an establishment in the EU, such as those based in Switzerland, report to the CSIRT in the country of their authorized representative or, failing that, of their importer or distributor.
Secure default configuration, protection against unauthorized access, for example through authentication, and the smallest possible attack surface. The CRA does not contain an explicit ban on default passwords; however, according to the European Commission’s guidance, design flaws must not be compensated for by shifting risks onto users.
Security updates without delay and, in principle, free of charge. The support period is based on the expected period of use and is at least five years; its end must be stated at the time of purchase.
Document components in a software bill of materials (SBOM), test regularly, disclose vulnerabilities in a coordinated manner and remediate them without delay.
For devices placed on the market before December 11, 2027, only the reporting obligation applies, with no obligation to retrofit; this also applies to devices that are still being purchased today. Anyone operating such devices must manage the risk themselves: harden, isolate or replace them.
A vulnerability must be reported if there is reliable evidence of malicious exploitation. The regulation’s recitals cite weaknesses in identification and authentication as an example; whether the misuse of default passwords falls under this in an individual case requires legal review.
The CRA places obligations on manufacturers, not operators. For operators, it is nevertheless a lever: anyone procuring refrigeration equipment can contractually require CRA conformity, a software bill of materials, a fixed support period and commitments on vulnerability handling, thereby covering part of the NIS2 requirements for the supply chain.
Learn moreCRA consulting CRA reporting obligations CRA at a glance
A refrigeration system is rarely a product from a single source. The controller comes from the manufacturer; it is installed and maintained by the refrigeration contractor, who often looks after it remotely on an ongoing basis. Many affected stores were not direct customers of the manufacturer at all, but of the refrigeration contractors. This is precisely where NIS2 comes in: covered entities must take into account the security risks at direct suppliers and service providers.
Controller, firmware, web interface
Planning, installation, commissioning
Service, breakdown service, cloud portals
Store, warehouse, clinic, production
End customers, authorities
Cold rooms at three sites were manipulated via a refrigeration service provider’s remote monitoring. The service provider blames a component from a third-party vendor, in other words a risk at the supplier’s supplier. [12]
On October 13, Danfoss had advised Dutch customers to disconnect the systems from the internet. After the attack in France, most businesses had responded, but a few had not. According to the manufacturer, the systems that were hit were not on a secured network and used a default password. [44]
According to Coopérative U, affected stores were not direct Danfoss customers but customers of refrigeration contractors that had supplied the system. In such cases, maintenance and remote access are often in the hands of third parties, while the decision to replace equipment frequently rests with the individual store. [45]
At an AWO supermarket in Wetter-Volmarstein, according to dpa, the attack targeted the company that maintains the refrigeration systems remotely. In Lilienthal near Bremen, an affected store had to throw away goods worth more than €360,000. [13]
NIS2 explicitly requires measures for supply chain security, including the relationships with direct suppliers and service providers. The vulnerabilities of each direct supplier, the quality of its products and its security practices must be taken into account. According to the BSI, anyone who makes OT systems publicly reachable from the internet without adequate protection is in principle acting in breach of their obligations; the BSI recommends that operators actively demand measures from integrators and service providers.
Learn moreSupply chain security at a glance Supplier management OT and industrial security
Answer the questions for your sites. The evaluation runs only in your browser and does not replace an audit, but it shows where you should start.
Answered: 0 of 6 questions. The evaluation appears as soon as all questions have been answered.
Your answers are neither stored nor transmitted.
The steps combine the recommendations of the US agencies, CERT-FR, the BSI and the BACS and supplement them with our experience from OT assessments and GRC projects.
If your refrigeration systems have been manipulated: disconnect remote access, document the current state and timestamps with screenshots, measure product temperatures directly and assess the goods, restore setpoints from a backed-up configuration and reconnect the device only after hardening; a reset to factory settings alone is not enough. Check your reporting obligations, for example under NIS2 to the BSI or, in Switzerland, to the BACS; file a criminal complaint – in Germany with the police Central Contact Point for Cybercrime (ZAC) in your federal state – and inform your insurer early. Our CSIRT supports you around the clock.
The attacks show where things fall short: refrigeration equipment is often missing from the inventory, from supplier management and from the outside-in view. VamiGRC embeds NIS2 and the CRA in day-to-day operations, VamiAppSec supports manufacturers with software and product security, and VamiRedteam keeps an eye on your authorized attack surface around the clock.
Agentic GRC platformVamiGRC is VamiSec’s agentic GRC platform. Operators use it to implement NIS2 and keep track of their suppliers, while manufacturers manage their CRA obligations – both working from the same assets, suppliers and evidence. AI agents handle the routine work according to your approval rules; your team decides.
VamiGRC is an agentic integrated management system for manufacturers and operators: NIS2 for your organization and the CRA for your products in one system. ISMS, PIMS, AIMS, CSMS, and BCMS share the same assets, suppliers, risks, and evidence on one GRC graph; risks and measures are assessed in euros. AI agents handle the routine work according to your approval rules.
Free of charge until go-live: one month of Proof of Value with demo data or your real data, then, after a binding order, guided implementation – the license only starts at go-live. All packages include unlimited user accounts.
For manufacturers of controllers, firmware and connected refrigeration technology: VamiAppSec brings security testing into the CI/CD pipeline you already use and makes vulnerability handling under the CRA manageable. The language model assists; your team makes the decisions.
For operators: the core use case of VamiRedteam is 24/7 Zero-Day Vulnerability Management. Three AI agents monitor your authorized attack surface around the clock, match newly disclosed vulnerabilities against it and check what is actually exploitable. This way, publicly reachable systems and new flaws are noticed promptly rather than only at the next pentest.
Whether it is an outside-in view of your refrigeration equipment, NIS2 classification, a CRA roadmap or supplier management, Valeri Milke and the VamiSec team help you derive concrete next steps from this briefing.
“IT security and compliance without AI is a vulnerability.”
Overnight into October 12, 2026, unknown actors manipulated the refrigeration controllers of hundreds of French supermarkets; the government cited around 700 stores. Overnight into November 2, a second wave followed, with more than 100 affected stores in more than a dozen European countries, including Germany and Switzerland. Refrigerated units were put into defrost mode and setpoints raised; goods spoiled.
Based on current information, they got in through controllers that were directly reachable from the internet, mainly Danfoss system managers of the AK-SM and AK-SC series as well as Copeland and Dixell XWEB supervisors. Unchanged default passwords have been documented in several cases; with outdated firmware, known flaws are a possible route. No malware was used.
That remains unclear. A channel of the pro-Russian group NoName057(16) has claimed responsibility for the attacks together with Z-Pentest, but there is no evidence for this. No government or authority has named a perpetrator; the Kremlin denies involvement.
Yes. In Germany, the police are investigating several cases, including in North Rhine-Westphalia, Lower Saxony, Bavaria and Rhineland-Palatinate; the BSI has confirmed isolated incidents at supermarkets. In Switzerland, a butcher’s shop in Köniz and three Volg branches were hit.
Food retail as such does not. In the food sector, NIS2 covers wholesale and industrial production and processing; it also covers healthcare and many branches of industry, including manufacturers of refrigeration and control technology. In Germany, however, large retail companies can still be covered via the critical-infrastructure (KRITIS) thresholds.
The CRA requires manufacturers of connected products, including refrigeration controllers, to provide a secure default configuration, protection against unauthorized access, security updates throughout the support period and structured vulnerability management. These requirements apply from December 11, 2027. The reporting obligations for actively exploited vulnerabilities, however, have applied since September 11, 2026, including for older products.
Under the CRA, manufacturers must report actively exploited vulnerabilities and severe incidents: early warning within 24 hours, notification within 72 hours, final report 14 days after a fix has been made available or, for incidents, one month after the notification. Whether the misuse of default passwords counts as an actively exploited vulnerability in an individual case requires legal review.
That depends on your role. Companies in Germany that are subject to NIS2 report significant incidents via the BSI reporting portal: early warning within 24 hours, notification within 72 hours, final report one month later. Businesses that are not covered, such as individual supermarkets or butcher’s shops, are not required to report; they can inform the BSI voluntarily and should file a criminal complaint with the police Central Contact Point for Cybercrime (ZAC) in their federal state. In Switzerland, operators of critical infrastructure report to the BACS within 24 hours; all others can report voluntarily. Manufacturers report actively exploited vulnerabilities under the CRA via the ENISA Single Reporting Platform.
A decisive one. The controllers come from the manufacturer, while installation, maintenance and remote access are usually in the hands of refrigeration contractors and service providers. At the French blood donation service EFS, the attack came through a service provider’s remote monitoring. NIS2 therefore requires suppliers and service providers to be included in risk management.
Check your router for port forwarding, NAT or UPnP rules that point to controllers, and open the site’s public IP address from outside, for example on a smartphone with Wi-Fi switched off: a controller login page must not appear there. You can also check whether the address is listed by search engines such as Shodan or Censys. Cellular modems in the control cabinet often have their own internet connection, so ask your refrigeration service provider about all remote access points. Also check passwords, firmware and end of support, and test whether temperature alarms reach on-call staff at night. VamiSec supports you with an external check and an inventory of your suppliers.
With VamiGRC, you implement NIS2 and the CRA in one system and manage your suppliers. With VamiAppSec, manufacturers embed security testing in their development and prepare CRA reports. With VamiRedteam, you keep an eye on your authorized, externally reachable attack surface around the clock. These are complemented by OT and IoT pentests, NIS2 and CRA consulting and our CSIRT for emergencies.
The information is based on publications by authorities, manufacturers, security researchers and the media up to November 8, 2026. Claims of responsibility and assessments are identified as such; setpoints are not measured temperatures.
This briefing is no substitute for legal advice. Which obligations, if any, apply to your company depends on the individual case.
Arrange a no-obligation initial consultation: we will clarify your starting point and the next steps.
