Refrigerator Attacks and Cold Chain Cybersecurity

At 2 a.m. on November 2, freezers at an ICA store in Stockholm reached 50 °C. The manager only discovered it hours later, when the food was already lost. There was no power outage or compressor failure. Someone remotely accessed the refrigeration controller and commanded the equipment to heat up.

It was the second wave of attacks of this kind in Europe in less than a month. The message applies to any operation storing temperature-sensitive products, including hospitals, laboratories, and blood banks in Brazil.

What happened in France and the rest of Europe

The first wave came in the early morning of October 11-12 in France. According to the French Economy Minister, about 700 of the country's 10,000 supermarkets were affected, including Intermarché, Carrefour, Monoprix, and Coopérative U stores. Tons of food went to waste and some stores reported fires.

On November 2, the attack repeated in several European countries, including Belgium, Sweden, Luxembourg, and Estonia. Delhaize, Carrefour, Colruyt, ICA, and Coop are among the affected chains, and a single Belgian store calculated losses of 100,000 euros. In another report published by CNN Brasil, citing Reuters, a merchant lost 15,000 euros in meat after refrigerators rose to 18 °C.

These figures come from retailers and employees, not from forensic analysis, and authorship remains under investigation. The mechanism described, however, is the same in both waves.

How a defrost command becomes inventory loss

Defrost heats the evaporator to melt accumulated ice. While the cycle runs, refrigeration stops or decreases. It's a normal function. The problem starts when someone from outside activates defrost unnecessarily or leaves it on for hours.

That's what the attackers did. The compromised controllers, mostly from Danish manufacturer Danfoss, were accessible over the internet so technicians could adjust parameters remotely. Danfoss confirmed that the affected models were obsolete or unpatched, although the fix has been available since August 2025. The official French alert also cited Copeland and Dixell equipment.

The most insidious part is that the controller continues to execute an order it considers legitimate. To the system, everything is running as programmed. To the product, temperature is rising.

Why controller readings alone aren't enough

In most operations, the same system that commands cooling also measures temperature and triggers the alarm. When the attacker takes over the controller, they also take the panel that should warn you. It's like leaving the thief guarding the security camera.

An independent sensor solves much of this. It measures through another device that doesn't receive orders from the controller. If the command shows normalcy and the sensor shows the chamber heating, the discrepancy triggers an alert. Knowing how to separate one from the other is part of the work, and we address this in human error versus technical failure.

This separation only truly protects if both paths don't share the same weak points. If sensor, controller, and alerts use the same network, same passwords, and same gateway, one breach takes everything down at once.

The alert threshold also needs to match the product. Vaccine, blood derivative, and reagent have different ranges. A single value for all inventory generates too many alarms or lets critical issues slip through. We've already discussed how alarm fatigue causes failures in hospitals and the most overlooked environmental parameters in pharmaceutical storage.

What to do to reduce exposure

Refrigeration controller is operational technology, and almost no one treats it that way. The starting point is knowing what exists and who accesses it.

1. Inventory each controller: model, software version, location, responsible party, remote connections, and supplier.

2. Remove control interfaces from the open internet. If maintenance needs remote access, use a controlled access point with multifactor authentication and individual accounts for each technician.

3. Separate equipment network from corporate network and allow only the communication each one needs.

4. Update firmware in a planned maintenance window and test first. Blind updates can stop an important function, and never updating leaves the door open. Also see how to avoid firmware errors in sensors.

5. Log access, configuration changes, and defrost activations with synchronized clocks.

The problem isn't just French. Greece's cybersecurity authority found over 300 exposed systems in the country, most of them refrigeration controllers.

Who answers the alert at 2 a.m.?

The Stockholm case makes clear that an alert without on-call staff is useless. Define who receives the overnight notification, who confirms the condition, and who authorizes product transfer. Test these channels from time to time. A message that lands in someone's email while they're off duty isn't a response.

Have the contingency plan ready: qualified backup equipment, who does the transfer, and how to record temperature in transit. The decision to release, segregate, or discard falls to the quality procedure, reviewing the product and excursion history. Well-configured automated reports make this analysis much faster.

If there's suspicion of intrusion, preserve records before restarting or reconfiguring anything. Call information security and maintenance together, because a hasty reset can erase the evidence.

Where DROME comes in

DROME is the second layer those supermarkets were missing: monitoring that doesn't depend on the control system. Our sensors measure independently and don't receive commands from the chamber controller. If someone invades the panel and turns on defrost, the controller might show normalcy. The DROME sensor shows temperature rising, and the alert goes out immediately.

The hardware is ours, developed and calibrated in-house. The STE Satellite Sensor covers temperature and the SUL, with PT100 probe, monitors ultra-low freezers. The CTD Concentrator transmits via cellular modem, runs up to 12 hours on battery, and stores readings in buffer for up to 20 days. If power or local network goes down, data keeps arriving and history stays complete.

With DROME Predict, the platform goes beyond alarms. Artificial intelligence learns each equipment's behavior and anticipates failures 30 to 60 minutes in advance—enough time to transfer inventory calmly. And when the problem is sudden, like forced defrost, the alert arrives on the first out-of-range reading.

Everything is logged with audit trail ready for RDC 430 from ANVISA and 21 CFR Part 11 from FDA. Over eight years inside hospitals and laboratories, over 60 active customers, and 1.25 billion readings per year across networks like Rede D'Or and DASA and operations like Hemobrás. Learn about our cold chain and environmental monitoring solution.

European supermarkets discovered the problem when they opened their doors in the morning. With DROME, the on-call team knows while there's still time to save the inventory. Schedule a demonstration and see how it works in your operation.

Frequently asked questions

How does a hacker attack heat a cold storage chamber?

With remote access to the controller, the attacker activates defrost or changes the setpoint. Refrigeration stops, the evaporator heats, and temperature rises until it compromises products.

Is the controller reading enough to confirm actual temperature?

No. It comes from the probe connected to the controller itself, which may be poorly positioned, faulty, or under the same compromised control. An independent sensor with separate network and power provides a second opinion.

What temperature should trigger the alert?

It depends on the product and storage stage. Use the manufacturer's range and your operation's quality procedures, not a single value for everything.

Would DROME detect an attack like Europe's?

Yes. DROME sensors don't depend on the controller, so they measure actual heating even when the compromised panel shows normalcy. The alert triggers on the first out-of-range reading and reaches on-call staff anytime, including overnight.

What if power or internet at the site goes down?

The CTD Concentrator keeps working for up to 12 hours on battery and sends data via cellular modem, independent of customer network. Readings are stored in buffer for up to 20 days, so no record is lost.