When Hackers Turned Up the Heat: The European Fridge Attacks and the OT Security Debt Behind Them

In October and November 2026, a strange kind of cyberattack swept across Europe. No data was stolen. No ransom note appeared on a screen. Instead, the fridges started heating up.

Across hundreds of supermarkets — and then, more alarmingly, several French blood banks — attackers remotely forced refrigeration units to 50°C. Ice cream melted, frozen food rotted, some cooling systems caught fire, and thousands of euros of stock went into the bin. At one supermarket outside Brussels, around €100,000 of produce had to be thrown away overnight.

This wasn't a glitch. It was a coordinated wave of attacks on internet-connected refrigeration controllers — and it is one of the clearest warnings yet about the security debt sitting inside our Operational Technology (OT). Here is what happened, how, and what every business that runs connected equipment should learn from it.

The uncomfortable part: every device these attackers abused was already sitting on a network, running outdated software, waiting to be found. That is exactly the blind spot Securion's on-prem scan agent is built to close — it continuously walks your network, inventories every connected device (servers, workstations, IP cameras, IoT, management/gateway controllers, network gear), flags the known vulnerabilities, and reports them to your tech team as prioritised, escalated fix-tickets — before an attacker's scanner gets there. More on that at the end — first, how the attacks actually worked.

The attacks unfolded in waves, escalating from inconvenient to genuinely dangerous:

• Early August 2026 — a series of fridge malfunctions at around six US military bases, now investigated as a suspected hack.
• Mid-October 2026 — roughly 700 French supermarkets had their cooling units tampered with. Food spoiled, fires broke out, and one retail executive estimated losses in the tens of millions of euros in a single day. The wave spread to Spain, Portugal, Poland, Germany and Belgium.
• Early November 2026 — a fresh round hit around 40 supermarkets in Belgium and Luxembourg, plus stores in Sweden, Ireland, the Netherlands, Estonia and Finland. This time it also reached several French regional blood banks, through the cold-storage facilities that keep donated blood viable.

The blood-bank angle is what elevates this from costly nuisance to national-security concern. Blood cannot be manufactured on demand — if a supply is ruined, hospitals and surgeries are affected for days. According to France's Ministry of Health (reported by Reuters), no blood products were ultimately damaged: the storage units' own alarms detected the temperature tampering, staff were alerted, and they regained control in time. It was a near miss, not a disaster — but only because monitoring worked.

The most sobering detail, as the BBC's reporting made clear, is just how unsophisticated this attack really was.

Supermarket and industrial fridges are no longer standalone appliances. Their temperature controllers are connected to the internet so that engineers can monitor and adjust them remotely — checking they're online, nudging a temperature up or down, without driving to the site. As ESET's global cybersecurity adviser Jake Moore put it, that convenience is exactly what opens the door: "it's on the internet, [so] hackers can equally then try and use the same techniques to get in."

From there, the attack chain was almost mundane:

1. Find the devices. Attackers used widely available internet-scanning tools (the kind that let you search for anything connected to the internet) to locate exposed fridge controllers.
2. Exploit known weaknesses. The affected units — two makes of controller — had publicly known security vulnerabilities. French authorities linked the root issue to Danfoss refrigeration controllers running outdated firmware. Crucially, Danfoss said it had long advised customers to update their software and replace older equipment. The fix existed; it simply hadn't been applied.
3. Use the default password. In at least one case, the controllers shipped with default passwords printed in the user guide — freely findable online — and many sites had never changed them. So the whole attack could be as simple as: find a device, type the default password, take control.
4. Flip the switch. Once in, the attackers simply told the units to heat instead of cool — triggering forced defrost and pushing temperatures to 50°C.

The attack chain — no zero-day required.

No zero-day. No nation-state-grade malware. Just exposed devices, an unpatched known flaw, and factory-default credentials.

It wasn't the deep machinery — it was the box managing it

One detail is worth dwelling on, because it changes how you defend against this. The attackers did not reach down and reprogram a low-level controller over some obscure industrial protocol. They logged into the management layer — the networked system manager that supervises the refrigeration units, a small embedded computer with a web interface, sitting on the network with a known-vulnerable firmware version and a default password.

That matters because this management-and-gateway layer — the system managers, building-management front-ends, HMIs and remote-access gateways that sit on top of physical equipment — is ordinary, discoverable IT from a network's point of view. It has an IP address, open ports, and a software version you can read. In other words: it is exactly the kind of device a security team can find and fix in advance — if they're looking. Most aren't, because nobody has a complete, current inventory of what's on the network and what each device is running.

Here's the part that should concern every security leader. These particular attacks did not use AI. But they didn't need to — and that won't last.

AI is, among other things, an extremely fast vulnerability scanner. The reconnaissance step above — searching the internet for exposed, weakly-secured devices — is exactly the kind of work AI performs far quicker than a human. As Jake Moore observed, that means attacks like these can happen sooner and at greater scale than before. Ciaran Martin, the former head of the UK's National Cyber Security Centre, framed it memorably: "AI combined with geopolitical tensions are shining a searchlight on bad security practices that have been hiding out in the dark."

The flip side is just as true: AI is also the most powerful tool defenders have ever had to find and fix those same weaknesses first. This is the fight-fire-with-fire reality of modern security — and it is exactly why continuous, automated monitoring now matters more than the annual audit.

The specifics were fridges. The lessons apply to any organisation running connected equipment — manufacturers, hospitals, logistics, utilities, ports, and the cloud systems that support them.

1. Treat OT and IoT as a life-safety attack surface, not an IT afterthought. When a control system is compromised, the consequence is physical — spoiled stock, a fire, a disrupted blood supply — not just a data leak. The priority for this equipment is safety and availability, which changes how you protect it.
2. Kill default credentials, everywhere. The single biggest enabler here was unchanged factory passwords. Every connected device needs a unique, strong credential — this is table stakes, and it's still routinely skipped.
3. Patch your OT like your life depends on it. The Danfoss vulnerability had a fix available. The breaches happened because of outdated firmware — the "technical debt" of equipment that should have been updated long ago. Connected equipment needs the same patch discipline as your phone.
4. Get critical devices off the open internet. Segment OT away from the general network. If remote access is genuinely needed, use a VPN — never a public connection. And watch your supply chain: the French blood service was hit through a supplier's systems.
5. Invest in continuous monitoring and detection. The blood banks were saved by alarms. You cannot manually watch every connected device, every hour — but you can't afford to find out about tampering after the damage is done either. Detection is the control that turns a catastrophe into a near miss.

The uncomfortable truth behind this whole episode is that the weaknesses were knowable and fixable in advance — exposed devices, running outdated software, with known vulnerabilities that already had patches. The gap wasn't capability; it was visibility at scale. Most organisations simply don't have an accurate, current picture of every device on their network and what each one is running.

That is exactly what Securion's network scan agent is built for. It's a lightweight agent you run inside your own network — no inbound access, read-only — that works continuously, doing what the attackers in this story did first, except on your side and before they get there:

• Discovers every connected device on your network and classifies it — servers, workstations, phones, printers, IP cameras and CCTV, smart TVs, IoT devices, networked management and gateway controllers (the system-manager class at the centre of these attacks), and network equipment (routers, switches, firewalls). It finds the quiet devices too, not just the obvious ones.
• Fingerprints the software each device is running — the exposed services, ports and versions. This is the inventory most organisations have never actually had.
• Flags known vulnerabilities automatically by matching those versions against public vulnerability feeds, including CISA's Known Exploited Vulnerabilities list and exploit-probability scores — so the issues most likely to be used against you rise to the top. An unpatched management controller like the one at the centre of these attacks is exactly the kind of finding it surfaces.
• Catches insecure configurations such as legacy SMBv1 (the EternalBlue-class exposure) and weak network-management settings.
• Reports straight to your tech team, with built-in escalation. Every finding becomes a remediation ticket per device, ranked by severity — a critical, actively-exploited flaw is raised as urgent and pushed to the top, so the right engineer knows what to fix first. "What's exposed" becomes a prioritised, assignable fix-list, with the evidence kept audit-ready.

And it doesn't stop after one pass. The agent scans on a continuous schedule (and can scan a device the moment it joins the network), so new equipment, new exposures and newly-disclosed vulnerabilities are caught and routed to your team as they appear — not once a year in an audit. In other words, it continuously answers the two questions this whole episode should force every organisation to ask — what connected devices do we actually have, and which of them are running something with a known, fixable flaw? — and then makes sure someone is told to fix it.

The next attack may not target a fridge. As the BBC's experts warned, the same weakness could just as easily sit in energy infrastructure or a hospital. The organisations that come through it well will be the ones that stopped coasting on security debt and started seeing — and closing — their exposures continuously. Find it, fix it, prove it — before an attacker (or an AI-powered scanner) finds it first.

Want to know what's exposed on your network? Talk to us — our scan agent will inventory every device and show you the vulnerabilities before someone else does.