Overview
- Since October, waves of intrusions have manipulated networked refrigeration controllers across Europe to force continuous defrost or raise setpoints, causing widespread food spoilage and isolated safety incidents.
- Security analyses and agency alerts identify the root causes as internet-exposed, obsolete controllers from vendors such as Danfoss, Copeland and Dixell, default or weak passwords, and unpatched firmware that allow remote setpoint changes and alarm suppression.
- Researchers using honeypots recorded hundreds of attempts, with Lupovis reporting 256 attack attempts from 91 sources over ten days and independent investigator Fredrik Blix estimating roughly 940 affected shops.
- Authorities have notified businesses — for example the UK NCSC emailed at least one hacked firm — and attribution remains contested with French investigators publicly linking an IRGC-linked unit to French incidents while pro‑Russian groups have also claimed responsibility.
- Officials and experts are urging immediate fixes such as removing internet exposure, segmenting operational networks, replacing legacy units, and developing policy and international norms to protect civilian cold‑chain infrastructure.