When Hackers Make Freezers Heat Up

One way to sabotage a freezer is to use a feature its manufacturer built in. Defrosting removes frost that builds up on the equipment. Tampering with those settings can make a system designed to preserve food heat up instead. That is what happened in France overnight on October 11–12, 2026. The French investigators recorded at least 15 instances of fire breaking out. French Cyber Crisis Coordination Centre (C4) report.

What we know as of November 10

1. October 11–12, France. France’s foreign ministry said the targeted controllers were deployed at more than 700 retail sites. It reported equipment damage and estimated food losses in the tens of millions of euros. French foreign ministry statement.
2. November 1–2, Europe. Another wave affected refrigeration systems across several EU member states. On November 4, ENISA and its partners urged operators to reduce exposure immediately. Their statement named no perpetrator. Joint EU statement.
3. November 5, global warning. CISA, the FBI and three other U.S. agencies warned of malicious activity targeting refrigeration and cold chain monitoring systems worldwide. Healthcare, food production and refrigerated transport use these technologies. The advisory gave neither a global victim count nor a common attribution. Joint U.S. advisory.
4. November 9, French attribution. France attributed the October 11–12 sabotage to Iran, via Shahid Kaveh, a unit affiliated with Iran’s Islamic Revolutionary Guard Corps. Among the evidence, the C4 linked attack infrastructure to industrial reconnaissance activity associated with the unit. The report confines this attribution to the October operation in France. C4 attribution evidence.

The C4 also notes that Shahid Kaveh claimed earlier sabotage targeting, among other systems, Israeli refrigeration equipment in March and April 2026. That claim provides international context. The French attribution for October rests on separate investigative evidence, and the November wave in Europe requires its own investigation. C4 report · Joint EU statement.

From a web interface to the freezer aisle

A refrigeration technician can diagnose a fault remotely before a store loses its stock. The same management console can also change temperature setpoints and control defrost cycles across several units. When the administration interface is reachable from the public internet, attackers can find it and try to reach those controls. France’s CERT-FR recorded compromises affecting Danfoss AK-SM and AK-SC systems as well as Copeland and Dixell XWEB. CERT-FR alert.

The way in can vary by site. On the Danfoss AK-SM 800A, Team82 researchers demonstrated that a hidden access mechanism could bypass authentication and that a second flaw could then allow command execution. Danfoss fixed the flaws. The demonstration shows why a strong password alone offers little protection against this bypass. The public C4 report describes target discovery and changes to settings, while the entry method for each site remains unspecified. Claroty Team82 research · C4 report.

6,695 → 3,124. From October 9 to November 5, Censys observed a 53% drop in the number of internet-reachable hosts it associated with the Danfoss StoreView and Copeland/Dixell XWEB product families. The scan measures what could be seen from the internet. It cannot tell us how many stores were compromised or why any host disappeared. Censys measurements.

Where safeguards could have interrupted the attack

These measures address documented attack paths and their physical effects. How much they help depends on the configuration at each site. Before cutting off remote access, verify that local cooling and alarms will still work. U.S. agency mitigations · NIST guide to operational technology security.

Test the supplier’s access. In a test environment, ask the maintenance provider to show what one account can change in one store, then in the next. An account shared across the entire fleet can turn a local incident into simultaneous outages. Give temperature monitoring and configuration changes separate permissions, require a change log for each site and verify that access can be revoked while monitoring continues.

Three plasma storage sites and no reported losses

On November 2, attackers changed temperature and defrost thresholds at three plasma storage sites of the French Blood Establishment (EFS). In a statement reported by the Associated Press, the EFS said monitoring caught the changes early enough for staff to secure or transfer the products. It reported no loss of blood products. The public account gives no details about how the alerting system was built. It shows what early detection and a timely response can achieve. EFS statement reported by the AP.

A conventional alarm waits for the temperature to cross a threshold. An alert on a setpoint change can go out before the cold room even begins to warm. And if the telemetry goes quiet, the absence of new readings should trigger an alert of its own. That is where a separate sensor and alert channel are most valuable. U.S. advisory on loss of visibility and setpoint deviations.

For an operator, the most revealing drill happens overnight. Simulate the loss of remote monitoring and a temperature excursion without putting stock at risk. Who gets the alert, who takes a reading on site and where can affected lots go? Rehearse holding those lots, preserving temperature records and logs, and restoring a known-good configuration. The quality team decides what happens to the products based on their thermal history and storage requirements. Restoring a controller and releasing stock are separate decisions.

At three in the morning, if the monitoring screen can no longer be trusted, what other signal will wake the right person?