The Freezer Hack Was Never About Fridges

The Freezer Hack Was Never About Fridges

On the night of 11 October, someone switched hundreds of French supermarkets’ freezers into defrost mode and pushed the temperature to 50°C. By Monday morning, staff were opening freezer doors to blasts of hot air, pools of water and spoiled stock. Some stores caught fire. Around 700 food retailers were affected and single stores reported losses of several hundred thousand euros.

The timing was no accident either. A Sunday night meant closed stores, skeleton staff and maintenance contractors off shift. By the time anyone could respond, the damage was done, and the attack had played out in exactly the hours when nobody was watching.

It is tempting to file this under “strange cyber stories”. That would be a mistake. Nobody breaks into refrigeration controllers across a country to ruin some yoghurt. The freezers were the means. The target was something much bigger.

The real targets: the supply chain and public confidence

Investigators have not yet said who was behind the attack or why. But the way it was carried out points to the logic behind attacks on this kind of infrastructure.

Supply chain disruption. Food retail runs on tight margins and just-in-time logistics. A store cannot simply restock its entire fresh and frozen range overnight. Hitting hundreds of stores at once strains distribution centres, suppliers and transport, and the disruption spreads far beyond the stores themselves. The attackers also stretched defrost cycles from one to eight hours so alarms fired late. That is not vandalism; it is someone who understood how the cold chain works and how to break it quietly.

Food safety rules make the impact worse. Once the cold chain is broken, chilled and frozen products cannot be sold, whatever they look like. Every affected cabinet had to be emptied, cleaned and restocked, and suppliers had to divert deliveries at short notice. The cost of the disruption keeps growing long after the freezers are cold again.

Consumer panic. The second effect is psychological. Empty chiller cabinets, “cold chain broken” signs and photos of food being binned send a simple message: the systems that feed you are not safe. Shoppers begin to question whether chilled food is safe to eat, whether shortages are coming, and whether the authorities are in control. The EU’s food commissioner condemned the attack within a day, which shows how quickly a technical incident becomes a political one.

Panic feeds on itself. Images of empty shelves travel faster than explanations, rumours fill the gap, and shoppers who fear shortages buy more, creating the very shortages they feared. An attacker doesn’t need to cut off the food supply. Making people believe it could be cut off is often enough.

This pattern fits a wider trend. Attackers, whether criminal, activist or state-linked, increasingly target operational technology because the effects are physical and visible. A data breach makes headlines for a day. Spoiled food and burning stores make people feel the impact in their own lives.

How easily it could have been avoided

The uncomfortable truth is that these advanced attacks  walked through doors that were left open.

  • Controllers were on the open internet. More than 1,700 instances of the affected software were exposed in France before the attack. Anyone with a scanning tool could find them.
  • Many used default passwords. Security researchers reported that many units appear to have been running with factory credentials.
  • Many were never patched. One of the affected companies said most impacted systems were older models, and many were end-of-life units it no longer updates.
  • Nobody owned remote access. Contractors need to service equipment remotely, so routers, VPNs and port-forwards accumulated over years without anyone keeping track.

Each of these has a straightforward fix. Take controllers off the public internet and route remote access through a secured gateway. Give every device and every contractor a unique, cryptographic identity instead of a shared password, so access can be scoped to specific stores and revoked centrally. Patch what can be patched, and put a protective layer in front of what can’t. Finally, monitor for abnormal behaviour, such as a freezer setpoint jumping to 50°C or a defrost running for eight hours, so an alarm fires even when an attacker logs in with valid access.

None of this is exotic. Device identity, certificate-based access and network segmentation are standard practice in banking, energy and industrial plants, and are set out in frameworks such as IEC 62443. The tools exist and are proven. Retail refrigeration simply hadn’t been treated as critical infrastructure until now.

Thousands spent, millions saved

Compare the two sides of the ledger. Securing a store’s remote access costs a secure gateway, device identities and some configuration work: a modest per-store figure that is a rounding error in a supermarket’s annual budget. The cost of not doing it was spoiled stock, fire damage, emergency call-outs, lost sales and store closures, with retail executives warning the bill could run into the millions. Some of those losses may not be insured.

The bigger cost is reputation, and it falls on two groups.

Supermarkets sell trust as much as food. Shoppers who saw empty freezers and binned produce will remember which chains were hit. Regulators and insurers will now ask every retailer the same question: who can change a freezer setpoint in your stores tonight, and how would you stop them?

Hardware suppliers are now named in global headlines next to the word “hack”. From December 2027, the EU Cyber Resilience Act will require manufacturers of connected products to ship them secure by design and support them with security updates. Suppliers that build strong device identity and secure remote access into their controllers can turn this incident into a selling point. Those that don’t risk being remembered for it.

The opportunity is real. Retailers will now ask suppliers hard questions in every tender: how are devices authenticated, how is contractor access controlled, and how long will the product receive security updates? Suppliers with clear, credible answers will win those contracts.

Device Authority works with device manufacturers to build those answers in from the start, so strong identity, secure provisioning and trusted software updates ship with the product rather than being retrofitted in the field. That gives suppliers a clear path to meeting the secure-by-design expectations of the Cyber Resilience Act.

The lesson

The real lesson goes well beyond refrigeration. The same kind of connected controllers run water treatment plants, energy grids, healthcare supply chains, EV charging networks, smart buildings, traffic systems and production lines. Each one is a potential lever on services people depend on every day. As CISA’s guide points out, common attackers usually target products, not organisations. A weakness in one device type can therefore be exploited at every site that uses it. The technology to secure these systems already exists. What is needed now is shared responsibility across the whole supply chain, from the companies that design devices to those that buy and integrate them.

Building trusted device identity with Telit Cinterion

This is one of the reasons Device Authority and Telit Cinterion are working together to combine hardware-backed device identity with automated identity lifecycle management. The objective is to provide manufacturers with a trusted foundation for secure provisioning, device authentication and credential management throughout the product lifecycle, as part of a broader security architecture.

Sources