Nobody broke into a server room. Nobody stole a database. Attackers simply logged into refrigeration controllers and told them to defrost, and kept them there.
On October 11, refrigeration controllers at up to 700 French supermarkets were switched into defrost mode overnight. Some cases climbed past 50°C (122°F). A few caught fire. On November 2, the same trick hit stores across Belgium, Luxembourg, the Netherlands, Sweden, Ireland, Estonia and beyond, including dozens of Delhaize locations and 15 Carrefour stores in Belgium. Ahold Delhaize now expects the incident to cut its fourth-quarter sales by up to €250 million.
Then, overnight into Monday, November 2, attackers turned to three plasma cold-storage sites run by France's national blood service, the Établissement français du sang (EFS), and pushed temperature and defrost thresholds to extreme levels.
On November 5, CISA, the FBI, HHS, USDA and the Department of Transportation published a joint advisory on exactly this activity. It's short, practical, and worth your five minutes. Here's our read on it.
This wasn't a sophisticated attack
That's the uncomfortable part. Security researchers have pointed out that many of these controllers sit directly on the public internet, with built-in support logins whose passwords were not hard to come by. In the Belgian cases, attackers went straight into individual stores' systems rather than through the refrigeration contractors.
The federal advisory names three ways in: authentication bypass, arbitrary code injection, and weak configurations. Once inside, an attacker can change temperatures, which risks spoiled inventory, shortened equipment life, fire, and unsafe product reaching customers. They can also cause a "denial of view," where you simply can't see what your units are doing.
There's a structural issue too. Many grocers outsource refrigeration to third parties, so the people responsible for the food often don't control the security of the equipment keeping it cold. If that sounds like your HVAC, access control, or building management setup, you're not alone.
The part that went right
The blood bank story is the one worth studying, because it ended well. EFS's monitoring and alarm systems flagged the anomalies quickly. Staff on duty moved blood products to refrigerators that weren't connected to the compromised systems. No blood products were lost, no health impact was identified, and collection and distribution kept running.
Two details stand out. First, it was EFS's own alarms that caught the problem, not the vendor's. Second, they had somewhere else to put things: storage that wasn't tied to the same network. Detection plus a fallback turned a potential crisis into a bad night.
What the advisory recommends, in plain English
The joint advisory lists eight mitigations, all mapped to CISA and NIST's Cross-Sector Cybersecurity Performance Goals. None of them require new technology. Most are a few hours of focused work.
That last one deserves a second look. A freezer has no legitimate reason to be set to 50°C. A hard limit on setpoints, plus an alert when someone tries, would have blunted much of what happened in Europe even where an attacker got in.
It's not really about fridges
Swap "refrigeration controller" for thermostat, badge reader, camera DVR, or building automation panel and the story barely changes. Any device someone installed, connected for convenience, and then stopped thinking about is a candidate.
If you want a quick place to start, ask three questions:
If any of those answers are fuzzy, that's normal, and it's fixable. It's also the kind of inventory NetZeal helps clients work through every day. If you'd like a second set of eyes, reach out.
