Securing connected refrigeration systems takes clear ownership

A freezer in a Dutch storage facility should be set to -20 °C. After a cyberattack, its setting had been changed to -10 °C. At a Swedish supermarket, refrigeration settings were changed to 50 °C.

These reports are part of a series of attacks on commercial refrigeration systems in Europe. In the Netherlands, supplier Danfoss reported that at least 17 businesses were affected on 2 November, mainly smaller shops and butcheries.

The incidents show how business continuity can depend on equipment outside the usual office IT environment, including the systems that keep food at a safe temperature.

Refrigeration systems are part of the network

Modern refrigeration systems are increasingly managed remotely. A technician can check the temperature, spot a fault or change settings without driving to the shop. For business owners, that is useful: less downtime, lower maintenance costs and a faster response when something goes wrong.

But there is a trade-off. These systems often contain a small computer, called a controller, connected to a network. If it is reachable from the internet and not adequately secured, someone outside may be able to change its settings.

In the recent attacks, temperature settings and defrost programmes were among the things manipulated. This could make products unsafe or spoil them. Businesses in several European countries had to remove or discard food.

Dutch broadcaster NOS reported that one affected storage site was able to intervene in time after a freezer setting changed from -20 to -10 degrees. This also shows why quick detection matters: a changed setting is not the same as a confirmed product temperature or spoiled stock.

Smaller businesses were affected

The affected organisations were not only large supermarket chains with extensive IT departments. Danfoss, as cited by NOS, said the Dutch reports mainly involved butcheries, neighbourhood shops and other smaller businesses.

Outside the Netherlands, branches of supermarket chains in Belgium, Ireland, Luxembourg and Sweden were also affected. The Associated Press described shops removing stock after refrigeration systems were manipulated remotely. In one Swedish shop, a cooling setting was raised to 50 degrees; that was a reported setting, not the measured temperature of every product.

The Dutch National Cyber Security Centre (NCSC) also warned about attacks on internet-connected refrigeration systems. According to the NCSC, weak and default passwords can allow unauthorised people to change settings.

These attacks expose an uncomfortable truth: you can secure office computers well and still depend on an overlooked device in a utility room for an essential business process.

The problem goes beyond refrigeration

A smart thermostat, access control system, camera, charging station or building management system is also a computer that controls something in the physical world.

That does not mean every connected device is unsafe. But its security often falls outside normal IT routines. The installer manages the equipment, the IT provider manages the network and the business owner assumes everything is covered. Who actually checks access and updates?

Responsibilities can be especially unclear in smaller organisations. A device is installed, works for years and disappears from view. Its password never changes. Firmware is not updated. A maintenance connection stays open.

Researchers and suppliers involved in the refrigeration incidents pointed to known vulnerabilities, outdated equipment and poorly secured connections. According to Associated Press reporting, the attacks discussed did not require advanced, new AI techniques.

The main risk was not necessarily a cutting-edge attack, but an old problem that had gone unnoticed for too long.

Four questions every business owner can ask

Even without an in-house cybersecurity team, you can check a few useful things this week.

1. Which devices in my business are connected to the internet? Think beyond laptops and printers: refrigeration, alarms, cameras, doors and climate control too.
2. Who can operate them remotely? Ask the installer or IT provider whether a management interface is directly reachable from the internet or only through a secure connection.
3. Are passwords and security updates managed? Replace default passwords. Devices without security support need a replacement or isolation plan.
4. How would we know if a device became unreliable? Is there an independent temperature alarm, an emergency procedure and a contact who can act quickly?

That last point is easy to miss. If one system both controls refrigeration and sends the alarms, a fault or compromise could affect both functions. Independent monitoring can limit the impact.

Always coordinate changes to industrial equipment with the responsible technician. Disabling a connection without a plan could also interrupt legitimate monitoring and fault alerts.

Why this attack still matters next week

On 10 November, UK trade publication *The Grocer* reported that researchers could still reach hundreds of refrigeration controller interfaces through the public internet. That does not automatically mean they can be operated without a password, but it shows that exposure still needs attention after the incidents.

Businesses do not need to panic and switch off every smart device. The sensible approach is simpler: know which devices you have, who manages them, whether they still receive updates and what you will do if one suddenly stops working.

A cyberattack does not have to start with a suspicious email. Sometimes it starts at a controller above a freezer — and you only notice when the stock can no longer be sold.

Ask yourself: which devices keep your business running but sit outside your IT security routine?

Sources: NOS · Dutch NCSC · Associated Press · The Grocer