Thaw: How Preventable Errors Let Hackers Heat Europe's Freezers: Cybersecurity Is Not Enough

Refrigeration controllers were designed for convenience, not security. Many older Danfoss and comparable controllers were connected directly to the public internet with weak or default credentials and no network segmentation. This created a standing vulnerability long before any attacker appeared.

Legacy controllers remained in service well past their supported lifespan. Known exploit methods for these devices were publicly documented and circulating online, yet no systematic patching regime existed across the retail sector.

The earlier French attack (affecting up to 700 supermarkets) and the 2022 compromise of Israeli supermarkets running Danfoss controllers were clear warning signals. Maintenance providers such as Sabcobel advised clients to secure or disconnect internet connections after the French incident. This advice was not universally implemented—a classic error of failing to convert a near-miss into systemic reform.

Internet-exposed industrial control systems in the food supply chain were not subject to binding cybersecurity standards. Responsibility was fragmented between retailers, maintenance contractors, and equipment manufacturers, with no single party accountable for end-to-end security.

Attackers compiled lists of publicly reachable IP addresses belonging to vulnerable controllers. Honeypot data later showed probing concentrated exclusively on systems appearing to be located in Europe. This reconnaissance phase went unnoticed because most retailers had no monitoring of inbound traffic to their refrigeration infrastructure.

There was no logging or alerting capable of flagging unusual access patterns to controller endpoints. The attackers could map and test targets at leisure.

Attackers used known exploit methods to gain control of controllers in at least seven countries (Belgium, Sweden, Ireland, Luxembourg, the Netherlands, Estonia, Finland), with later incidents in Germany and Romania. The coordinated timing—overnight—maximised damage before staff could intervene.

The attackers switched units into "defrost mode," a normal maintenance function. There was no secondary authentication, rate-limiting, or confirmation step protecting this high-impact command. A single remote instruction could override cooling across an entire store.

Temperatures rose to as high as 50°C before the problem was discovered. Stores lacked automated temperature alarms linked to off-hours response, so the rise was detected only when staff arrived or physical symptoms (heat, spoilage, in some cases fires) became evident.

Store-level responses were improvised: goods discarded, systems manually reset. There was no pre-existing incident playbook for "refrigeration controller compromised," slowing containment and evidence preservation.

Information emerged piecemeal through individual retailers, local media, and maintenance firms. Danfoss confirmed only a "limited number" of older systems affected in France and declined comment on the newer wave, leaving a vacuum that rumours filled.

Pro-Russian hacktivist groups (NoName057(16), Z-Pentest Alliance) claimed responsibility on Telegram, then deleted the posts. NoName057(16) is known chiefly for DDoS attacks and has a history of false claims. Sekoia and other firms urged scepticism, pointing instead to Russian state-aligned or Iranian actors. The error here is informational: without preserved forensic evidence and coordinated attribution, public understanding was shaped by unverified claims.

Individual stores reported losses of €100,000 (Hoeilaart, Belgium), over €360,000 (Lilienthal, Germany), and £12,500 for a single butchery chain. No sector-wide insurance or mutual-aid mechanism existed to absorb or distribute such losses.

The Belgian federal prosecutor opened a criminal investigation, the EU food safety network was activated, and the European Commission convened emergency meetings—but only after damage had occurred. Europol and ENISA coordination began in response to the incident rather than in anticipation of it.

Responsibility remains diffuse among retailers (who exposed systems), maintenance firms (who advised but did not enforce), manufacturers (who shipped insecure defaults), and regulators (who set no standards). Without clear accountability, the same configuration is likely to persist.

The attention generated by the attacks may fade before binding standards, mandatory network segmentation, and sector-wide monitoring are implemented—repeating the pattern seen after the French and Israeli incidents.

The chronological reconstruction shows that the attack succeeded not because of exceptional attacker sophistication—the exploit methods were known and the entry points were poorly protected—but because a chain of preventable errors accumulated over years and was never interrupted. Each prior incident (France, Israel) offered a chance to break the chain; each time, the warning was noted but not acted upon.

Crucially, every single error identified in this analysis is a human error—not a failure of technology in isolation, but a failure of people to design, decide, warn, act, enforce, or learn. The controllers did exactly what they were configured to do; the humans responsible for them did not. This is precisely where a human error management system would have intervened. Such a system systematically identifies error-likely situations before they become incidents: it would have flagged the unpatched legacy controllers, forced a decision on the Sabcobel warning after the French attack, assigned clear ownership across retailers and maintenance firms, rehearsed an incident playbook, and—most importantly—created a feedback loop in which near-misses are treated as mandatory corrective actions rather than optional advice. The errors listed here did not occur because no one knew better; they occurred because no system existed to convert knowledge into consistent action.