By Berend Booms | Associate Editor | Future of Assets

At half past three on the morning of November 2, butcher Luc De Laet was woken by one of his employees and hurried to his shop in Hove, south of Antwerp. He arrived to find the fridges at up to 18°C. Someone had changed the settings from the outside: the fridges have a system that blows a little warm air to stop ice from forming, but it had been set to keep blowing warm air and never switched back to cooling. According to De Laet, around €15,000 worth of meat was ruined.

Try to imagine showing up to your own shop in the middle of the night, looking at a fridge full of your product that someone in an unknown place had turned into your problem. De Laet called it “very scary,” and he’s far from the only one who got this jump scare.

One night, many countries

That same night, refrigeration controllers were tampered with in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. Delhaize store managers woke up to a text message around 4 a.m. informing them of the issue, with some stores bringing in refrigerated trucks to try to save some of their stock. Carrefour Belgium disclosed that 15 of its more than 700 stores had been hit, with a spokesperson saying “it’s a cyberattack, there is no other reason.” Musgrave was forced to pull chilled and frozen food from 13 of its SuperValu stores in Ireland, and in the Netherlands, Danfoss counted at least 17 businesses affected.

And this was already the second wave. Three weeks earlier, it had happened in France. On the night of October 11, freezers in hundreds of supermarkets across the country were forced into defrost, some set to temperatures as high as 50°C. Roland Lescure, France’s minister of finance, told parliament that about 700 of the country’s 10,000 supermarkets were affected by the attack, which he said “touches the heart of our food security.”

The weaponization of food

Christophe Hansen, the EU’s commissioner for agriculture and food, called the most recent wave of disruption “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it.” Irish cybersecurity expert Conor Flynn called it the “weaponization of food,” and warned that mass distribution warehouses and emergency food stocks could be next. What baffles me is how little effort it took. Nobody had to touch a single product; changing a setpoint was enough to cause mass disruption.

A fridge is an IT asset now

Back in August, before any of this happened, researchers at Claroty described a hidden ‘code-of-the-day’ login in Danfoss’s AK-SM 800A controller, identifying 2765 of these devices that were reachable from the public internet. Danfoss had already released fixed firmware for these, and most of the units hit in France were older models that had been phased out or had reached end of life. Vincent Strubel, head of France’s national cybersecurity agency ANSSI, explained the vulnerability as being elementary security flaws, such as equipment directly accessible through the internet and weak passwords.

We’re not dealing with some weird, novel concept here; most of what we’re seeing play out feels really familiar. A refrigeration controller is an asset. It runs firmware that needs updating, and it sits on a network where a weak password is an open door. Yet in many asset registers, it shows up as a line item under the cooling rack. The advice from national cybersecurity agencies reads like an asset management checklist: find every connected device, then either disconnect it or keep it updated. Strictly speaking, firmware updates are maintenance; a controller that no longer receives the required security fixes should be considered end of life, even if the compressor runs fine.

Blaming the customer is too easy

Danfoss has pointed to outdated software as the core weakness and says the customers hit were the ones who had not updated. In the Netherlands, the affected systems were not on a secured network and still used a default password. Danfoss had warned Dutch customers on October 13 and says the attacks could have been prevented.

That’s largely true, but I find that framing to be incomplete. Supermarkets often outsource refrigeration to contractors, so the controller ends up sitting somewhere between facilities and IT, with nobody really having ownership. One refrigeration contractor said that a software update alone is not enough; the installations need physical changes that cost money. That raises the question of who’s going to foot the bill. And that code-of-the-day login was a design choice made long before any store manager got involved.

Looking at some of the stores that got hit, even heeding the warning and trying to apply the fix may not have been enough: the Selver store hit in Estonia was the last where the new system had not yet been taken into use, and Coop Sweden had scheduled an upgrade for Wednesday, November 4, prompted by the French attacks; the attackers arrived two days earlier. These are organizations that are doing the work, but got caught in the gap between knowing the danger, planning the fix, and finishing the work.

Should we just pull the plug?

Disconnecting everything is tempting, but I don’t think it is the answer. Remote access offers a wealth of benefits: it lets technicians diagnose a fault without having to physically be at the location, tune defrost cycles effectively, and spot a struggling compressor before it breaks down. It also means someone is watching around the clock, and in these attacks, monitoring is what raised the alarm more than once.

So I think the benefits still outweigh the risks, on one condition: the connection has to be treated as part of the asset. In practice, this means having a secured network or VPN instead of a public IP address, a password that is changed regularly, up-to-date firmware, and a replacement strategy for anything the manufacturer no longer supports.

On the same Monday morning, November 2, the attack reached a Selver supermarket in Estonia. Someone got into the controls of an older Danfoss refrigeration system and set the freezer to a temperature of +50°C. But this time, the refrigeration partner caught the attack almost straight away and responded within ten minutes. The freezer had warmed by two to three degrees; it was back to its normal temperature within about fifteen minutes.

Try to imagine being the person who saw that alert come in and then got on with the rest of the morning. Nobody was called out of bed, and nothing was spoiled. Someone tried to turn up the heat, but keeping a cool head is how you keep your stock on ice.