Dan HorscroftEurope’s supermarket fridge hacks are a visibility problem

Key takeaways

• Since October, hackers have remotely heated supermarket fridges and freezers in hundreds of stores across Europe. In France alone, losses were estimated at tens of millions of euros. No ransom was demanded and no data theft has been reported.

• The hackers targeted old refrigeration controllers exposed to the internet, often with default or predictable logins. Many were past end-of-life and managed by outside contractors, which made them effectively shadow IT, outside most security teams’ view.

• Whoever is behind it, the fix starts in the same place: knowing every device on your network and whether it’s protected.

What happened in the supermarket fridge hacks?

The attacks may have started in late August, when freezers failed at grocery stores on at least six US military bases. US officials have said the Pentagon is treating them as a suspected cyberattack, though nothing has been confirmed. Then in October, hundreds of supermarkets in France saw fridges and freezers spike in temperature overnight. On 2 November it happened again, across stores from Ireland to Estonia.

The French blood service’s cold stores were targeted too. In the UK, the NCSC said it was aware of a couple of incidents as well.

Who is behind the fridge hacks?

Nobody knows yet. Jon Abbott, ThreatAware’s CEO, told The Observer that “the attackers simply broke the fridges, so there’s no financial leverage… it has the hallmarks of something more deliberate than ordinary cybercrime.” What’s already clear is how exposed these systems were, and that’s the part every organisation can do something about.

Why were the fridges so easy to attack?

By most accounts, these weren’t sophisticated attacks. France’s national cybersecurity agency found that the refrigeration controllers targeted had been exposed directly to the internet. The UK’s NCSC said default passwords had even been published in one refrigeration company’s manuals, and security researchers had already found a hidden login on some models whose password was derived from the current date.

The bigger problem is age. As Jon put it, “Many of these controllers are years past end-of-life, so even where flaws exist, there’s no patch coming.” Two of the models involved were retired in 2016 and 2021 and no longer receive security updates. The vendor told customers to replace the older one back in 2016.

The bigger problem is age. As Jon put it, “Many of these controllers are years past end-of-life, so even where flaws exist, there’s no patch coming.” Two of the models involved were retired in 2016 and 2021 and no longer receive security updates. The vendor told customers to replace the older one back in 2016.

The exposure was also wide. Researchers counted thousands of these refrigeration controllers reachable from the internet, including more than 800 linked to British retailers. Even after the first wave, many were still online when the attackers came back in November.

That second wave also hit the French blood service, with a very different result. Its temperature alarms went off, an on-call technician responded, and nothing was lost.

Why didn’t security teams see the risk?

In many supermarkets, refrigeration controllers are shadow IT. They aren’t in risk assessments, and they’re often managed remotely by external contractors. These devices had owners, usually facilities teams or a contractor, but nobody had flagged them as a cyber risk. That’s a big part of why the attacks worked.

But fridges just happen to be the operational technology that made the news. The same is true of building management systems, CCTV, door access controllers and any kit a supplier connects to your network to support it remotely. Devices like these typically can’t run an EDR agent, so they don’t show up in the tools most security teams rely on.

This is the Cyber Hygiene Gap. It’s the distance between the estate you think you have and the one you actually run. It’s why the UK’s cybersecurity chief, Richard Horne, called the fridge hacks “just the foothills." The next target will be another device nobody is watching.

What should security teams check now?

On 5 November, five US agencies including CISA and the FBI issued joint guidance on refrigeration controllers. They told organisations to take them off the public internet, change default passwords, patch, and replace end-of-life units. That’s good advice, but you can only act on devices you know about. These three checks apply well beyond fridges.

1. Find everything facing the internet. Run an external exposure check and match every result against your inventory. Anything you can’t identify is the first priority.

2. Find the unmanaged devices security has missed. Look for devices your network tools can see but no other system knows about. Not in your CMDB, not managed, or no security owner. Include anything a contractor or supplier runs on your network.

3. Check that controls are working, not just installed. An agent that has stopped reporting looks fine in its own console. Confirm every device that needs a control has it deployed, running and configured correctly.

If any of these checks take more than a day to answer, that’s a finding in itself, and you need to take steps to address it immediately.

Are devices like these on your network?

Most people reading about these attacks will think, “We don’t run supermarket fridges.” Fair enough. But almost every organisation has something similar, like a building system a contractor installed years ago that nobody on the security team has looked at since. Those are the gaps attacks like this exploit.

The French blood service lost nothing because someone was watching. For most organisations, that starts with cyber asset visibility, which means knowing what’s actually on your estate. It’s the work we do every day at ThreatAware. We bring together what your existing tools already know, so you can see every device and whether it’s protected. If you’d like to see where your gaps are, we’re always happy to talk.