Cyberattacks targeting refrigeration equipment across Europe have exposed weaknesses in the systems used to control industrial machinery, demonstrating how interference with relatively simple operating parameters can cause extensive physical damage without requiring attackers to compromise an organisation’s wider IT infrastructure.
Supermarkets in Belgium, Sweden, Ireland, Luxembourg, the Netherlands, and Estonia reported disruption on 2 November, with attackers reportedly manipulating temperature settings and defrost cycles. Some refrigeration units were subjected to settings as high as 50°C, leaving retailers to discard chilled and frozen goods, while similar attacks in France during October had already affected hundreds of stores.
British meat suppliers have also reported interference with refrigeration systems using Dixell XWEB controls, including altered defrost cycles and elevated temperature settings. The Association of Independent Meat Suppliers urged businesses to inspect their equipment, although the National Cyber Security Centre (NCSC) said it was unaware of any affected UK supermarkets.
The recurrence of similar incidents within weeks has intensified concerns about the security of remotely managed industrial equipment, particularly where operational systems remain accessible through internet-facing interfaces or maintenance connections that fall outside an organisation’s central cybersecurity controls.
Patrick Lamplmair, CTO and co-founder of Tributech, believes the pattern demonstrates how readily attackers can exploit weaknesses in equipment that performs essential physical functions.
“Three weeks after France, supermarkets in Belgium and Sweden have been hit in the same way. This is no longer a one-off incident. It is a method that works, and attackers will keep using it until it stops working.”
With refrigeration, the consequences of unauthorised intervention can materialise within hours. A controller instructed to change its temperature setpoint or initiate repeated defrost cycles may continue operating exactly as programmed, yet the resulting conditions can render an entire stock of perishable goods unusable, triggering shutdowns, food safety investigations, and disruption extending well beyond the affected equipment.
“The spoiled food is only part of the bill. Stores close, staff spend days cleaning and restocking, food safety checks have to be repeated, and customers lose confidence. Across hundreds of sites, one weak controller becomes a board-level risk,” Lamplmair said.
Unlike a conventional IT incident, where restoring systems from backups may allow an organisation to resume operations, interference with industrial equipment can produce irreversible physical consequences. Once temperature-sensitive products have been exposed to unsuitable storage conditions, recovering the controller’s original configuration cannot restore the affected inventory or establish that it remains safe for consumption.
Martin Riley, CTO at UK critical infrastructure cybersecurity specialist Bridewell, said the characteristics of food production and distribution make refrigeration particularly vulnerable to attacks designed to cause immediate disruption.
“In most of IT security we protect confidentiality first. We worry about data being stolen. In operational technology that priority flips. Availability and integrity come first, because the process has to keep running and keep running correctly.”
Remote access and the legacy controller problem
That dependence on uninterrupted physical processes is compounded by the way industrial equipment is installed, maintained, and monitored. Supermarket refrigeration, cold storage installations, and manufacturing machinery are frequently supported by specialist contractors, whose ability to diagnose faults and adjust operating parameters remotely reduces maintenance costs and avoids repeated site visits.
Across large, distributed estates, however, the connections established for legitimate operational purposes can leave hundreds of devices accessible through different networks, management platforms, and third-party service arrangements. Equipment may continue to function reliably for years while its communications interfaces, authentication mechanisms, and software support receive considerably less attention than the machinery itself.
Riley described remote maintenance as an important source of exposure, particularly where responsibility for connected equipment is divided between operators, original equipment manufacturers, and specialist service providers.
“That convenience has quietly created a very large, very visible attack surface that often sits outside the security team’s view.”
Following October’s incidents, France’s national cybersecurity response organisation, CERT-FR, identified compromises involving Danfoss AK-SM and AK-SC refrigeration controllers, alongside Copeland and Dixell XWEB systems. Its recommendations included removing publicly accessible management interfaces, restricting remote connections, updating firmware, and replacing default credentials.
Research published by internet intelligence company Censys on 2 November identified more than 1,000 publicly accessible Danfoss StoreView instances worldwide. In France, the number of visible instances had fallen from 1,825 before October’s incidents to 220, although only 41% of those remaining appeared to be operating with patched firmware.
Internet exposure does not establish that a particular device has been compromised, but the continuing visibility of industrial management interfaces after vulnerabilities have been disclosed illustrates the difficulty of securing equipment distributed across numerous sites and maintenance arrangements.
The problem is especially persistent where controllers remain operational long after their original cybersecurity protections have become outdated. Industrial control equipment can have a considerably longer working life than conventional IT hardware, and replacing a controller that is integrated with existing machinery may require modifications to communications interfaces, control logic, installation arrangements, and maintenance procedures.
Clara Sipes, a market analyst specialising in industrial automation at Interact Analysis, said ageing controllers can remain embedded in operational environments even when their manufacturers have stopped providing security updates.
“Some legacy refrigeration controllers remain in use after security support has ended, meaning newly identified vulnerabilities no longer receive software updates. While the equipment still functions, continued use can carry a growing risk.”
For manufacturers and operators working to avoid production interruptions, replacing functioning control hardware can introduce engineering costs and operational risks of its own, particularly where existing installations depend on proprietary interfaces or established equipment configurations.
“Replacing a functioning controller involves more than purchasing new hardware. Customers may need OEM compatibility checks, engineering support and installation downtime, helping explain why legacy equipment can remain in use despite known security risks,” Sipes said.
Unsupported controllers therefore require protective measures that account for their technical limitations while replacement programmes are developed. Restricting external connectivity, isolating vulnerable devices, and monitoring changes to operating conditions can reduce exposure, although older equipment may lack the capabilities needed to support more sophisticated authentication and control mechanisms.
Verifying commands at the equipment itself
For Lamplmair, the refrigeration incidents also raise a deeper question about the assumptions built into industrial control architectures, particularly whether equipment should accept instructions simply because they have arrived through an apparently authorised communications route.
“The first steps are basic: know which assets are connected, remove direct internet exposure and patch. But patching will always lag behind attackers. The lasting fix is to stop trusting the network and verify at the asset itself.”
Conventional network security measures are intended to prevent unauthorised users from reaching industrial devices, while authenticated remote access establishes which users or systems are permitted to connect. Neither necessarily establishes whether an individual instruction has been modified, whether its origin can be independently verified by the receiving equipment, or whether the requested operation is appropriate for the physical process.
In a refrigeration installation, those distinctions become important when a remote command changes a temperature setpoint or initiates a defrost sequence. A controller may receive an instruction through a legitimate connection and execute it without identifying that the requested operating state falls outside the conditions required to preserve stored products.
Lamplmair argues that command authentication and integrity checks should be combined with validation against the operating limits of the equipment itself, providing an additional safeguard even where another layer of the control system has been compromised.
“Each command should prove its origin and that it was not altered, and each setpoint should be checked against physical limits before it runs. A freezer should never accept an instruction to heat to 50°C, no matter who sends it.”
Implementing that principle requires more than applying a universal temperature threshold. Refrigeration equipment must accommodate legitimate defrost cycles, maintenance procedures, and changes between operating modes, with permitted instructions assessed against the relevant process conditions and the authority of the system or individual requesting them.
Authentication, authorisation, command integrity, and operating-limit validation perform different functions within such an architecture. A cryptographically authenticated instruction can establish its origin without guaranteeing that the requested action is safe, while independent process monitoring can identify abnormal behaviour even where the underlying controller has accepted the command.
Industrial systems already employ interlocks, safety controls, and operating constraints to prevent equipment entering hazardous conditions, although the availability and independence of these safeguards vary considerably between applications. Extending the verification of digitally transmitted instructions introduces another consideration into control-system design, particularly as remote connectivity becomes a standard feature of machinery that was previously managed primarily on site.
The extent to which these protections can be introduced into existing installations depends on the controller hardware, software architecture, and available interfaces. Retrofitting additional command validation may be difficult where legacy equipment lacks support for suitable authentication mechanisms, making the security capabilities of replacement systems increasingly relevant to procurement and engineering decisions.
Manufacturers of connected equipment are also facing more demanding regulatory expectations. Under the European Union’s Cyber Resilience Act, requirements to report actively exploited vulnerabilities and severe security incidents took effect on 11 September 2026, while the legislation’s principal product cybersecurity obligations are scheduled to apply from 11 December 2027.
The framework introduces obligations covering secure product development, vulnerability management, and cybersecurity support throughout a product’s lifecycle. Although it does not mandate a particular method of authenticating industrial commands, it places greater responsibility on manufacturers to address cybersecurity risks as part of product design and continued support.
Lamplmair believes manufacturers and operators should be considering those responsibilities before the next generation of connected machinery enters service.
“This must be designed in from the start, not added later. Under the EU Cyber Resilience Act, manufacturers of connected products are becoming legally responsible for exactly this. Operators should ask their suppliers now how commands to their equipment are verified.”
The relationship between equipment suppliers, maintenance contractors, and asset owners is consequently becoming an increasingly important part of industrial security planning. Remote access permissions, software support arrangements, vulnerability remediation, and responsibility for monitoring abnormal operations all need to be understood across the working life of an installation, particularly where multiple organisations can interact with the same control equipment.
Riley also recommends examining the physical process rather than relying exclusively on network security alerts, since interference intended to damage products or interrupt production will frequently involve changes to operating parameters that can be independently monitored.
“Monitor the process, not just the network. An attacker who wants to spoil product has to change a setpoint or trigger a defrost. That is the behaviour to detect.”
Unexpected configuration changes, repeated defrost commands, remote access outside maintenance windows, and operating temperatures moving beyond permitted ranges can provide early indications of interference. Their usefulness depends on the quality of the monitoring arrangements and the speed with which operators can investigate and respond, particularly at sites where maintenance responsibilities are outsourced.
Where equipment has already been compromised, restoring normal service may require more than isolating the affected controller. Operators must establish whether its configuration can be trusted, whether physical processes have remained within acceptable limits, and whether products or materials require inspection or quarantine before operations resume.
Food is one of the UK’s 13 recognised critical national infrastructure sectors, although that designation does not mean every individual supermarket or refrigeration installation is classified as a critical national infrastructure asset. The disruption nonetheless exposes dependencies across food production, processing, refrigerated distribution, and storage, where the consequences of equipment failure can extend through multiple organisations and affect the availability of essential goods.
Comparable dependencies exist across industrial manufacturing, utilities, and energy infrastructure, where remotely managed control equipment regulates processes whose physical consequences cannot simply be reversed by restoring data or restarting software.
As operators assess exposed equipment and manufacturers prepare for more demanding product cybersecurity requirements, the ability to verify what industrial controllers are being instructed to do will sit alongside network protection and secure remote access in decisions about equipment design, maintenance, and replacement. A control system that can authenticate a connection but cannot distinguish a legitimate operating instruction from one that compromises the process remains exposed to precisely the kind of physical disruption demonstrated by the refrigeration attacks.
