A Freezer Was Told to Defrost

On the night of 11–12 October 2026, refrigeration systems in hundreds of French supermarkets turned against the food inside them. Fridges and freezers climbed to as high as 50 °C. Stock was lost, and at several stores the heat melted equipment or set it alight. By Monday the Paris prosecutor had opened an investigation, and the Prime Minister had ordered ANSSI, France’s national cybersecurity agency, to investigate.

Three weeks later it happened again, across borders. On 2 November supermarkets reported refrigeration and freezer failures in Belgium, Luxembourg, the Netherlands, Sweden, Estonia, Ireland and Portugal.

• An ICA store in Sjöbo, Sweden, told customers its fridges and freezers had been hacked and set to 50 degrees.
• Delhaize’s refrigeration contractor in Belgium said a cyberattack had switched evaporators into defrost mode.
• Carrefour said 15 of its 700 stores were affected, mainly freezers.

At the time of writing, nobody has claimed responsibility.

The detail that matters most for cold chain operators is how it was done. According to French reports, the attackers remotely triggered forced defrosting. ANSSI’s alert names Danfoss’s AK-SC and AK-SM controller ranges, and says controllers from at least three manufacturers were penetrated, including Copeland and Dixell.

Nobody broke a compressor or cut a cable. The attackers used a function every refrigeration system has, and that every refrigeration technician uses daily.

The Most Dangerous Command Is a Legitimate One

Defrost is routine. Ice builds up on an evaporator coil, so the controller periodically switches the fans off and the heaters on. It melts the ice, and then returns to cooling after a few minutes, usually when a coil sensor or a timer says the job is done.

Now remove the “few minutes”. An insulated box designed to hold heat out is being heated from the inside, with no time limit. Food in a freezer set to −18 °C does not simply thaw, as it would in a power cut. It is actively warmed, and in some French stores the heaters kept running until equipment melted.

This is why the attack is different from the incidents we covered in February in When the Algorithm Fails. The Transnet ransomware attack, the Astral Foods breach and the Blue Yonder compromise hit business systems: scheduling, ordering, port operations. They stopped product moving. The October and November attacks hit the plant itself. They did not stop the cold chain, they reversed it.

No security tool would flag “start defrost” as malicious. It is a valid instruction, sent through an interface that was built to accept it. The weakness is not a bug in the defrost function. It is the decision to let that function be reached from outside the building.

Monitoring Needs Eyes. Control Needs Hands.

Over the past two years, ColdChainSA has argued two things:

• In AI Won’t Save South Africa’s Cold Chain. Infrastructure Will. we argued that intelligence built on missing data is decoration.
• In June, our guest contributors at Cold Watch argued in Why Real-Time Monitoring is No Longer Optional that interval logging leaves a blind spot an excursion can hide in.

Neither argument is weakened by what happened in Europe. But the attacks force a distinction the industry has been blurring: watching is not steering.

• Watching means a sensor reports a temperature. It needs a one-way path out of the building. If someone hijacks it, the worst they can do is lie to you or go silent, and a good monitoring system notices both.
• Steering means changing a setpoint, starting a defrost, switching a compressor off. It needs a path into the plant. If someone hijacks that, they control the physics.

Most connected refrigeration in the field was not designed with this line in mind. The controller that runs the cold room is often the same box that serves the dashboard, sends the alarms and accepts remote commands. It is usually reachable through a web page, a contractor’s remote-access tool or a cloud portal. Connecting it to the internet gives the monitoring dashboard and the remote control at once, and the remote control is the part nobody priced in.

The Second Witness

If the system that controls the temperature is also the only system reporting it, a compromised controller can both cause the problem and hide it.

This is the strongest case yet for what Cold Watch argued in June. An independent temperature sensor is a second witness to what the controller is doing, provided it has:

• its own power;
• its own communication path (cellular, LoRaWAN or similar, as set out in our IoT architecture guide);
• its own alarm route to a person’s phone.

If the controller is told to defrost, the controller’s own screen may say all is well. A separate sensor will not.

It is the same principle accountants apply when the person who records the money is not the person who banks it. It costs little, and it turns a silent loss into a 2 a.m. phone call.

Connect With Purpose: Every Remote Command Must Earn Its Place

Who actually needs to change a cold room setpoint from outside the building? In most operations the honest answer is the refrigeration contractor, for convenience: it saves a call-out. That convenience is real. But it is often delivered through an interface left open to the internet, behind a factory-default password, on firmware nobody has updated since installation.

The exact way into the French and European systems has not been published. Security specialists suggest the familiar pattern: unpatched controllers with interfaces exposed to the internet. The warnings were already public:

• Claroty’s Team82 researchers published flaws in Danfoss’s AK-SM 800A system manager, including a way past the login and remote code execution. Danfoss fixed them in firmware R4.3.1. The researchers’ title now reads like a forecast: Freeze the Controller, Defrost the Food.
• Separately, Armis disclosed ten vulnerabilities in Copeland’s E2 and E3 controllers, which it named “Frostbyte10”. Copeland has since released patched firmware.
• No investigator has yet tied either disclosure to these attacks. But both show that the industry’s controllers were being probed well before October.

Connecting with purpose means deciding, device by device:

• Can it be read-only? Most monitoring needs nothing more.
• If it must accept commands, from whom, and how? A named person on a secure connection with a log, not a web page anyone on the internet can find.
• What is the worst command it can accept? If the answer is “heat the freezer indefinitely”, there should be a physical limit the software cannot override.

No Hacker Required: A Lesson From Our Own Freezers

The European attacks needed an outsider. Ours did not.

At The Frozen Food Courier®, our holding freezers run on Danfoss refrigeration units with Carel IR33 controllers. Like most cold room controllers, the IR33 can watch a door switch. Open the door and the controller stops the compressor and the evaporator fans, and switches the light on.

Our freezer doors have no door switches. So at a recent service we had an external switch wired into the controllers’ digital inputs to do the same job by hand. Staff flick it before they work inside, and the plant pauses without being powered down. That matters more than it sounds. With the power left on, the compressor oil stays warm and the refrigerant circuit stays charged, so the plant restarts cleanly instead of starting from cold.

The setup instructions we were given contained two mistakes:

• They left out a rule. Each controller has five digital inputs. If any one of them is set to sense an event, all five must be configured. Otherwise the controller reads the unconfigured inputs as an event too.
• They missed the setting that matters. The parameter that actually releases the stop sat outside the block of settings the instructions covered. Following them step by step never reached it.

The switch stopped the compressors and fans exactly as intended, then would not let them start again. The controllers sensed an “event” on the inputs, or rather the absence of the signal they had been told to expect, and held the plant off. Every press of the switch was a legitimate command. The controllers followed their configuration perfectly and locked us out of our own freezers.

We tested carefully, or so we thought. We emptied one freezer, moved its stock into the other, and tried the new settings on the empty unit. After about 45 minutes of testing and checking, everything worked. Then we swapped the units around, installed the switches and tested again. This time the controller locked us out.

What should have been a ten-minute job took four hours, and no alarm raised it. We were watching the installation and realised something was missing. The stock came through unharmed, but only because people were there to notice.

We went back to basics. We checked the wiring and then the switches, which we suspected were faulty. We never checked the configuration sheets, because they were the instructions and we trusted them. Local support told us the controllers were “fried”. They were not. Only when we researched the IR33 in depth did we see that the controllers were doing exactly what they had been set up to do. We corrected the settings and the plant restarted.

Now put that controller on the internet. Controllers like these can be connected for remote monitoring, the very convenience this article is about. Our lockout came from a wrong settings sheet, in daylight, with people on site. A parameter changed from outside would look exactly the same: no error and no alarm, just a controller faithfully doing what it was told. You would find out when the temperature told you, and only if something independent of the controller was watching it.

Notice also where we looked first: the wiring, the switches, the hardware. The settings were the last suspect, and even the support desk took them for a hardware failure. A controller reprogrammed from outside would send any technician down the same path, replacing parts while the real fault sat in the configuration.

The lessons are the same as Europe’s:

• The controller is a single point of control. Whether the wrong instruction comes from an attacker or from a settings sheet, the plant does what the controller says. If there is no way to run the plant without the controller, there is no fallback.
• A change is not finished when it is installed. It is finished when the plant has been through a full stop and restart, on every unit and in its final wiring, with the technician still on site and the new settings written down. Our first test passed, and the second, on the finished installation, did not.
• When a controller misbehaves, check the settings as well as the hardware. A wrong setting, whether from a bad instruction sheet or from an intruder, looks like a broken controller.
• The knowledge to recover sits with very few people. When the instructions are wrong and the support desk misreads the symptoms, the only way back is someone who understands the controller’s logic. It is the skills gap we have written about, in one plant room.

Why South Africa Should Pay Attention

Danfoss, Copeland and Dixell are not obscure European brands, and nor is Carel, whose controllers run our own freezers. They are familiar names on South African plant-room walls: in supermarket back-of-house, in distribution centres and in contract cold stores. The same controllers, the same remote-access habits and the same “set it up and leave it” maintenance culture exist here.

South Africa does have one advantage, which we named in February. Years of load shedding have taught operators to run cold rooms through outages. Generators, UPS units, manual temperature checks and fallback procedures all exist.

But this attack exposes the limit of that rehearsal. A generator restores power. It does not restore a setpoint. A plant that has been told to defrost will keep heating on generator power. The load-shedding drill needs one more step: how do night staff take the controller off the network and put it back under local control? Who knows how to do that, and is it written down beside the panel?

The Next Frontier: Fridges on Wheels

The same question applies on the road. Modern transport refrigeration units increasingly come with two-way telematics, so a setpoint or operating mode can be changed from a phone or a fleet portal. That is useful when a load is booked at the wrong temperature. It is also a remote command path into a moving freezer, often managed by a third party.

The test is the same: does it need to steer, or only to watch? If it must steer, who can, and is every change logged and alarmed?

Seven Questions to Ask Your Refrigeration Contractor This Week

1. Can anyone reach our refrigeration controllers from the internet? Ask for a yes or no, not “it’s secure”.
2. Is the controller software up to date? Ask specifically about the Danfoss and Copeland advisories, and get the date of the last update.
3. Have all default passwords been changed? That includes the contractor’s own service login.
4. Who has remote access, through what, and is it logged? List every company and person.
5. Do we have a temperature alarm that does not depend on the controller? It should have its own power, its own connection and its own route to a phone.
6. Is there a hardwired limit on defrost heaters, and a way to run the plant that does not depend on the controller? Do our night staff know how to use it?
7. After every service or settings change, has the plant been taken through a full stop and restart before you leave? Are the changed settings written down and kept beside the panel?

If the answers are uncomfortable, that is the point of asking them before someone else does.

The Sequence, Again

In March we argued that the cold chain must get the order right: infrastructure first, resilience built in, AI second. The supermarket attacks add a line to that list. Connect what needs watching. Steer only what needs steering, and guard it.

The technology that lets one technician look after fifty stores is the same technology that let one attacker heat hundreds of them overnight. Connectivity is not the enemy. Connectivity without purpose is.

Sources & References

The October and November 2026 attacks

• What to know about the cyberattack that targeted supermarket refrigeration systems in France, CNN, 14 October 2026. Paris prosecutor investigation; ANSSI’s role; the Danfoss AK-SC / AK-SM alert.
• ‘Unprecedented’ Cyberattack Targets French Supermarket Fridges, Time, 13 October 2026.
• Hundreds of supermarkets in France hit by ‘unprecedented’ cyberattack, Al Jazeera, 13 October 2026.
• French supermarket fridges get hacked, heating to 122°F and sparking fires, CNBC, 13 October 2026.
• How did hackers overheat French supermarket fridges?, CBC News, October 2026.
• Supermarkets across Europe hit by new fridge cyberattacks, NBC News, November 2026. The Delhaize contractor: evaporators switched to defrost.
• European grocery chains’ freezers, refrigerators targeted in apparent cyberattacks, ABC News, November 2026.
• More grocery stores in Europe report fridge and freezer temperature spikes, CBS News, November 2026.
• Very cold war: Who’s attacking Europe’s supermarket freezers?, Al Jazeera, 3 November 2026.
• Hackers target fridges in Israel, Europe and the U.S., NPR, 3 November 2026.

Controller vulnerability research

• Supermarket freezers and other food storage could have been hacked following flaws discovery, TechRadar. Armis “Frostbyte10” in Copeland E2/E3 controllers (patched).
• Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers, Claroty Team82. AK-SM 800A flaws, fixed in firmware R4.3.1.
• ICSA-25-140-03: Danfoss AK-SM 8xxA Series, CISA (US Cybersecurity and Infrastructure Security Agency). Earlier authentication-bypass advisory, fixed in R4.2.

ColdChainSA Analysis

• When the Algorithm Fails: Why AI-Dependent Cold Chains Need Human Backup Plans, ColdChainSA, February 2026.
• AI Won’t Save South Africa’s Cold Chain. Infrastructure Will., ColdChainSA, March 2026.
• Why Real Time Monitoring is No Longer Optional in Modern Cold Chains, Cold Watch for ColdChainSA, June 2026.
• Choosing Cold Chain IoT: A South African Operator’s Guide to Monitoring Architecture and Standards, ColdChainSA.
• Cold Chain Workforce Crisis: South Africa’s Invisible Skills Gap, ColdChainSA, February 2026.
• Why Your Cold Chain IoT Sensors Can’t Talk to Each Other, ColdChainSA.

Directory Resources

• Cold Chain Technology & Monitoring Directory, ColdChainSA. Verified temperature monitoring and IoT suppliers operating in South Africa.