Why Someone Just Cooked a Supermarket's Freezers From the Internet

The situation

Over the past few weeks, refrigerators across Europe have been quietly turned off — not by storms or power cuts, but by strangers on the internet. Supermarket freezers in at least 11 countries spiked to high temperatures, forcing stores to bin entire aisles of food. In France, three facilities storing blood and plasma had their cold rooms heated; the blood survived only because alarms and staff caught it in time. Similar attacks hit grocery stores on US military bases in August.

Nobody has reliably claimed responsibility. But the striking thing is not who did it. It is how easy it was.

The model: attack surface and the weakest-link principle

Security researchers have a term for the sum of all the ways into a system: the attack surface. Every device connected to the internet is a possible door. The more doors you have, the more doors someone can try to open — and your security is set not by your strongest lock but by your weakest one. This is the weakest-link principle: a chain fails at its flimsiest point, and a defender has to guard every link while an attacker only needs to find one.

Now add the internet of things (IoT) — ordinary physical objects, from thermostats to industrial refrigeration controllers, fitted with chips and connected to the network so they can be monitored and adjusted remotely. Each one is convenient. Each one is also a door.

The refrigeration controllers in these attacks — many made by the Danish firm Danfoss — were running outdated software, exposed directly to the internet, some reportedly protected by passwords based on the date. A door with a lock that anyone can guess is not really a locked door.

The mechanism, step by step

1. A business installs a temperature controller that can be reached over the internet, so a manager can check the freezers from a phone.
2. The controller ships with a known flaw: weak default passwords, or a bug that lets an attacker skip the login entirely (an "authentication bypass").
3. The device is never updated, because patching a fridge controller is nobody's urgent job.
4. An attacker scans the internet for these exposed controllers — this is cheap and automatic — finds thousands, and simply raises the temperature.
5. The food spoils. No malware on a corporate network, no stolen data. Just a setting changed by someone who should never have had access.

The crucial feature: the digital and the physical are now the same thing. Flipping a value in software rots real food and endangers real blood. The old wall between "computer problem" and "real-world consequence" is gone.

The other view

It is tempting to read this as a sophisticated state campaign. Russian hacktivists tried to claim some attacks without credible proof; the Kremlin denied involvement; some researchers see possible Iran-linked actors behind the military-base incidents. All of that is still unknown and contested.

Here is what is known: the attacks were not technically hard. Exploiting an exposed controller with a weak password requires little skill. So the competing explanations are not "advanced adversary" versus "amateur" — they are "it doesn't matter who." Whether the hand belongs to a bored teenager, a criminal, or a government, the vulnerability is identical. The real story is not the attacker's capability but the defender's exposure. As critical-infrastructure researcher Josh Corman puts it, our dependence on connected technology has for over a decade grown faster than our will to protect it.

Where else this pattern lives

The weakest-link problem is everywhere connected convenience outpaces maintenance.

• Your home. A smart doorbell, a baby monitor, a router you set up once and forgot — each is an internet-facing device running software that quietly goes stale. The most common breach is not clever; it is an unchanged default password.
• Hospitals. Networked infusion pumps and imaging machines often run software years out of date because certifying an update is slow and expensive. Same door, higher stakes.
• Supply chains in general. A company can harden its own systems perfectly and still be compromised through a small vendor with a single unpatched server. You inherit the security of everyone you connect to.

The lesson transfers cleanly: when you add a connection for convenience, you add a door for everyone. Convenience is counted once; the door stays open forever.

What to watch

Two signals will tell you which way this goes. First, attribution: if investigators produce credible evidence tying the attacks to a specific state actor, the framing shifts from "sloppy infrastructure" to "deliberate pressure campaign" — and expect more attacks on cold chains during geopolitical tension, as happened to Russian and Israeli stores in 2022. Second, response: watch whether regulators start treating basic IoT hygiene — inventory your connected devices, disconnect what you can, patch and password-protect the rest — as a legal requirement rather than a suggestion.

Expectation: ~70% that similar refrigeration or cold-chain attacks recur within a year, because the underlying vulnerability — large numbers of exposed, unpatched controllers — will not be fixed quickly even now that it is public. The flaw is not a secret anymore; the fridges are still online.

Distilled from Wired