Since August, attackers have been tampering with commercial refrigeration systems in the U.S. and Europe. Freezers in supermarkets and military commissaries were driven warm. Evaporators were forced into defrost. Product spoiled overnight, and several French stores reported equipment fires. This week, the FBI and CISA, joined by the departments of Health, Transportation, and Agriculture, warned of an ongoing threat to industrial refrigeration systems across critical infrastructure sectors.
It would be easy to file this under retail. That would be a mistake. Strip away the freezers and the pattern is familiar: a known-vulnerable product, exposed to the internet and maintained by a third party, compromised at scale. Every utility, water system, pipeline operator, and manufacturer has that same pattern somewhere in its environment.
What Happened in the Refrigeration Cyberattacks?
In August, Claroty's Team82 disclosed critical vulnerabilities in two widely deployed refrigeration control platforms, the Danfoss AK-SM 800A and the Copeland XWEB Pro. That same month, refrigeration failures hit at least six U.S. military commissaries. The Pentagon is now treating those failures as a suspected cyberattack.
On the night of October 11, internet-exposed refrigeration management systems at more than 700 French supermarkets were manipulated. Temperatures were raised, notc shut off, and staff did not notice for roughly six hours. Losses ran into the tens of millions of euros. On November 2, a second wave hit more than 100 stores across nine European countries.
No group has claimed the European attacks. Pro-Russian hacktivist groups, however, have claimed more than 20 attacks on refrigeration systems since January.
Why Are the Refrigeration Attacks a Supply Chain Problem?
The French controllers were exposed to the internet for ease of access. Support technicians reached them directly through a web interface to perform remote maintenance, and the systems were never placed behind a VPN or any other access control the store operators managed. That shortcut made life easier for the technicians. It made life just as easy for the threat actors.
The vulnerabilities in these controllers were public two months before the French attack, yet the internet exposure went unaddressed. A vendor-managed remote access path needs to be documented and tracked in the asset owner's risk register to ensure it is properly secured. In this case, the risk was never documented, so when the disclosure came, there was nothing to connect it to. Had the risk of the exposed units been documented and tracked, the August disclosure would have been the trigger to act: pull the devices off the internet, put access behind a VPN, and patch. Instead, the first sign of a problem was warm freezers.
What Hacktivist Attacks on HVAC and Cooling Systems Teach Critical Infrastructure Leaders
-
Your OT inventory ends where your vendor's begins. Cooling, HVAC, building management, and other "non-critical" OT are often installed, connected, and maintained by third parties outside security's line of sight. If a product sits on your network or supports your operations, it belongs in your inventory at the product and version level.
-
Vendor convenience is a risk decision. Remote access that bypasses your controls is a design choice someone made. Require suppliers to disclose how they connect, broker and monitor that access, and keep it off until it is needed. Utilities already apply this discipline to BES Cyber Systems under NERC CIP-005 and CIP-013. It should extend to the systems the standards do not cover.
-
Disclosure starts the clock. Once a flaw in a widely deployed controller is public, adversaries begin scanning. Three questions need answers within days, not quarters: where do we run this product, is it reachable, and who is patching it? Answering them requires mapping vulnerabilities to products, and products to suppliers, before the advisory lands.
-
Monitor for manipulation, not just outage. These attackers raised temperatures instead of shutting systems down, and the damage built silently for hours. Independent physical alarms and safety limits that cannot be overridden from the network close the gap between compromise and detection.
-
Low sophistication still produces high consequence. Hacktivists do not need zero-days when exposed management interfaces and known vulnerabilities are available. Overlooked assets get targeted because nobody is watching them.
Why Do Attackers Target Overlooked OT Assets?
Critical infrastructure leaders focus on the crown jewels, and they should. Adversaries, though, are probing the edges: the controller a contractor installed, the remote portal a service provider depends on, the device nobody classified as critical until it failed. The refrigeration attacks preview how hybrid campaigns will pressure every sector that runs on connected equipment.
Fortress Information Security helps critical infrastructure organizations see the products and suppliers inside their operations, map known vulnerabilities to the assets they actually run, and act before a public disclosure becomes an incident. The lesson from Europe is not to worry about freezers. It is to know what your suppliers have connected to your operations, and to know it before an adversary does.
