---

Discussion

Omar Seidren:

The common feature was a loss of control over refrigeration equipment. Chilled and frozen units warmed up, so retailers removed or discarded products. In Belgium, a refrigeration-company executive said affected evaporators had been switched into defrost mode, the cycle that temporarily warms a unit to remove ice. That resembles the mechanism reported in France, but it does not reveal how attackers entered. These are operational-technology systems: software that changes the physical world.

Sam Dewinski:

The history shows this is not an entirely new category. Danfoss reported that 16 Russian supermarkets using older AK-SM 800 controllers were targeted in 2022, and that 40 Israeli stores were hacked that year, also involving those controllers and inadequate firewall or virtual-private-network protection. Those accounts come from the manufacturer, so they are important but not a complete independent forensic chronology. They establish recurrence, not a single historical campaign.

Sam Dewinski:

There is also an adjacent precedent. The U.S. Justice Department said that, in November 2024, the Russia-linked Cyber Army of Russia Reborn attacked a Los Angeles meat-processing facility. The reported consequences included spoiled meat and an ammonia leak. That demonstrates that food-sector operational technology can be targeted for physical disruption, not merely data theft. But it was not a supermarket refrigeration-controller case, and it does not connect that group to Europe.

Red Velhouse:

Let us move to France, where the larger incident happened first. What do investigators know about that episode?

Omar Seidren:

On October 11 and 12, French retailers reported unauthorized changes to refrigeration systems at hundreds of supermarkets and other stores. Reports described continuous defrosting and sharply rising temperatures. France's national cyber agency, the National Agency for Information Systems Security, known as ANSSI, said through its Computer Emergency Response Team France, or CERT-FR, bulletin that it was aware of compromises involving Danfoss AK-SM and AK-SC systems, along with Copeland and Dixell XWEB controllers. It advised operators to remove internet exposure, review defrost schedules, use protected networks or virtual-private networks, update firmware and replace unsupported equipment where necessary.

Omar Seidren:

Researchers later found authentication-bypass, command-injection and web-configuration flaws in one Danfoss controller family, and Danfoss released firmware addressing them. That establishes a plausible route into exposed systems, not proof that those flaws caused these attacks. Other possibilities include weak or reused credentials, exposed administrative interfaces or contractor access. The complete entry chain remains unknown. Technically, a legitimate defrost command can look like an operator action even when the operator is an intruder. The machine may simply obey the wrong person.

Red Velhouse:

The November incidents looked similar. Does that similarity point to one campaign?

Omar Seidren:

It points to a shared technical problem more confidently than to shared authorship. Retailers again reported rising refrigeration or freezer temperatures, and a Belgian representative again described evaporators switched into defrost mode. Shared controller families, exposed remote-management systems and similar command effects make a common vulnerability or copycat activity plausible. But investigators have not released matching malware, command infrastructure, source addresses, credentials or controller artifacts linking the two waves.

Sam Dewinski:

That distinction matters historically. Older controllers may be exposed in several countries, allowing different attackers to discover the same weakness. A repeated effect can therefore represent a recurring vulnerability rather than recurring authorship. The past shows that the capability is real; it does not identify the people using it now.

Omar Seidren:

The exposure data shows why multiple attackers are possible. Forescout identified nearly 13,000 internet-exposed refrigeration-management service observations across more than 6,000 public Internet Protocol addresses in 99 countries and territories. Those are not confirmed compromises, and they do not all belong to supermarkets. About 80 percent of observed Danfoss StoreView systems were running firmware older than the version addressing known flaws. Remote access helps contractors monitor faults and change settings without visiting every store; the same convenience creates another security boundary to defend.

Ann Tofado:

That division of responsibility has political and institutional consequences. A retailer may own the store, a refrigeration contractor may control the software, an information-technology provider may manage the network, and a manufacturer may control firmware support. When something goes wrong, responsibility for patching and monitoring becomes fragmented. The policy problem is clear even when the identity of the intruder is not.

Red Velhouse:

Has any group or government been identified as the likely actor?

Ann Tofado:

Not publicly. No individual or group has claimed responsibility for the French attack or the November European incidents, and authorities have not established whether the events were conducted by the same actor. Political discussion about hybrid threats or attacks on food security may explain concern, but a political characterization is not forensic attribution.

Sam Dewinski:

There are nearby claims, but they belong in a different category. Forescout tracked more than 20 refrigeration-related attacks claimed by hacktivist groups since January 2026, including claims associated with pro-Russian groups such as NoName057(16) and the Z-Pentest Alliance. Those are researchers' records of claims, not a verified list of successful intrusions. A Telegram post can show that somebody wanted credit without proving control of the affected system.

Ann Tofado:

The 2022 Russian cases offer the same caution. Danfoss said Anonymous publicly encouraged disruption of Russian infrastructure, but that does not prove Anonymous carried out the specific supermarket compromises. Likewise, the Justice Department has alleged that Cyber Army of Russia Reborn, also called CARR or Z-Pentest, was founded, funded and directed by Russia's military intelligence service. That is a significant government allegation, but it does not make CARR the default suspect here.

Red Velhouse:

Was there a ransom demand, a payment request or a data-theft threat?

Ann Tofado:

None has been publicly reported for the French attack or the November incidents. There has also been no confirmed public data-theft component connected to the French case. That makes conventional ransomware less strongly supported, although an undisclosed or delayed demand cannot be ruled out.

Omar Seidren:

The observed behavior also differs from ordinary ransomware. The apparent action was to change legitimate refrigeration commands and cause immediate temperature disruption, spoilage and emergency response. There was no publicly documented encryption of business data. If an attacker reaches a web interface, a valid command may look like normal operation, leaving less distinctive evidence than conventional malware.

Red Velhouse:

If financial extortion is not the strongest explanation, what motives remain plausible?

Ann Tofado:

Several explanations remain open. Opportunistic exploitation is one: someone finds exposed controllers and experiments because access is available. Copycat activity is another, after the French incident made the method visible. Politically motivated disruption is plausible because supermarkets are visible consumer institutions, and spoiled food can affect public confidence. Capability testing is also possible. These are assessments, not findings; the public evidence is much stronger on insecure exposure and physical disruption than on motive.

Sam Dewinski:

The comparison with the 2024 attack on the Russian supermarket chain Verny clarifies the distinction. That incident disrupted the website, mobile application, card payments and online orders. Management suspected extortion, but no ransom demand or specific perpetrator was publicly established. It looks more like conventional supermarket cybercrime. The refrigeration incidents impose immediate physical and inventory losses without first encrypting data, which is a different pattern.

Red Velhouse:

What evidence would most change that assessment?

Omar Seidren:

Investigators would look for a repeated exploit chain, identical command sequences, reused credentials, source-infrastructure overlap, malware or scripts, and consistent controller logs across countries. Matching unusual artifacts would make a common operator more plausible; different access methods and separate infrastructure would favor copycat or opportunistic activity. Independent temperature sensors and preserved controller logs matter because a compromised interface can falsify or obscure its own story.

Sam Dewinski:

A responsibility claim would help only if it came with verifiable evidence. Groups sometimes claim attacks they did not conduct or exaggerate effects. A claim matched by unique logs, infrastructure or operational details would be stronger. A claim by itself belongs to the history of propaganda and signaling, not automatically to the history of confirmed cyber operations.

Ann Tofado:

The same hierarchy applies to state attribution. A government statement may reflect intelligence unavailable to the public, but audiences should know whether it is an assessment, a prosecutorial allegation, a technical finding or a final judicial determination. In the CARR case, the Justice Department's allegation is more substantial than an anonymous online rumor. It still does not connect CARR to the European supermarket cases.

Red Velhouse:

So where does the evidence leave us: a recurring campaign, or a recurring vulnerability?

Sam Dewinski:

The safest conclusion is a recurring class of attack rather than an identified campaign. Refrigeration compromises were documented in Russia and Israel in 2022. Researchers have tracked hacktivist claims in 2026, and U.S. authorities have accused a Russia-linked group of a destructive attack on a food-processing facility. Those precedents show that the target is real and the capability is not unprecedented. They do not establish responsibility for the current European cases.

Omar Seidren:

Technically, internet-accessible or weakly protected refrigeration management can produce real-world disruption with surprisingly little machinery. The vulnerabilities researchers found are relevant, but not proof of use. The missing pieces are the entry method, attacker infrastructure and forensic linkage. Until those appear, we should not turn a shared controller family into a shared culprit.

Ann Tofado:

Politically, food infrastructure deserves serious protection without waiting for a perfect attribution. The policy questions are who must secure legacy equipment, how contractors and retailers divide responsibility, and whether European rules provide timely incentives for lifecycle support. The observable harm is operational disruption and spoilage; the strategic purpose remains unresolved.

Red Velhouse:

The unresolved issue is whether Europe treats connected cold-chain equipment as a convenience or as infrastructure whose failure can affect businesses and consumers. Watch for a confirmed entry method, forensic evidence linking or separating the incidents, a responsibility claim backed by technical proof, and any new demand or attribution. Until then, the technical risk is established, while the campaign and motive remain open questions.

Red Velhouse:

The current European incidents are not the first attacks against refrigeration or food-sector operational technology. Earlier Russian and Israeli cases, hacktivist claims, and the U.S. meat-processing precedent show a recurring risk. But the public record has not identified a common perpetrator for the French and November attacks, and it has not established whether the incidents were centrally coordinated. The strongest evidence concerns exposed systems and physical disruption; opportunistic exploitation, copycat activity, political disruption and capability testing remain competing explanations. Watch for preserved controller logs, verified infrastructure links, evidence-backed claims and any new demand or attribution. Sources and references for this discussion are available with the episode at Factolio.com.

---

Sources and References

These sources supported the factual material used in this discussion. Factolio’s panel discussion is AI-generated from researched evidence and is written in original language.

1. Reuters — New cyberattack on supermarket fridges sweeps across Europe (NEWS)
2. Associated Press — Supermarket freezers in several European countries hit by apparent cyberattacks (NEWS)
3. Recorded Future News — Second wave of suspected cyberattacks hits supermarket freezers across Europe (NEWS)
4. Recorded Future News — Cyberattack disrupts refrigeration at hundreds of French supermarkets (NEWS)
5. Euronews — Cyberattacks hit supermarket fridges and freezers in Europe, Belgium launches investigation (NEWS)
6. CERT-FR / ANSSI — Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (PRIMARY)
7. Claroty Team82 — Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers (ANALYSIS)
8. Danfoss — DSA-2025-03-01: Improper Authentication vulnerability in Danfoss AK-SM8xxA Series (PRIMARY)
9. Danfoss — Tech Insider October 2025 edition (PRIMARY)
10. Forescout Vedere Labs — Cold Chain, Open Control: Exposed Refrigeration Systems Reveal Global Risk (ANALYSIS)
11. European Commission — Cyber Resilience Act (PRIMARY)
12. European Commission — Cyber Resilience Act – Reporting obligations (PRIMARY)
13. U.S. Department of Justice — Justice Department Announces Actions to Combat Two Russian State-Sponsored Cyber Criminal Hacking Groups (PRIMARY)
14. Recorded Future News — Cyberattack disrupts operations of supermarkets across Russia (NEWS)
15. Reuters — Investigators hunt French supermarket fridge hackers, no claim of responsibility (NEWS)
16. Computer Weekly — Cold-chain cyber attacks highlight lack of OT security in retail (NEWS)
17. Censys — European refrigerator controller redux: A new wave of refrigeration attacks (ANALYSIS)
18. Associated Press — Cyberattacks hit European supermarket chains and disrupt refrigeration systems (NEWS)