{"id":90940,"date":"2026-11-09T11:34:40","date_gmt":"2026-11-09T10:34:40","guid":{"rendered":"https:\/\/fhi.nl\/nieuws\/refrigeration-controller-security-lessons-from-the-european-fridge-hacks\/"},"modified":"2026-11-09T11:34:41","modified_gmt":"2026-11-09T10:34:41","slug":"refrigeration-controller-security-lessons-from-the-european-fridge-hacks","status":"publish","type":"news","link":"https:\/\/fhi.nl\/en\/news\/refrigeration-controller-security-lessons-from-the-european-fridge-hacks\/","title":{"rendered":"Refrigeration controller security: lessons from the European fridge hacks"},"content":{"rendered":"
\n\n\t\n\t\t\t
<\/div>\n\t\n\t
\n\t\t
\n\t\t\t
\n\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t

\n\t\t\t\t\tRefrigeration controller security: lessons from the European fridge hacks\t\t\t\t<\/h1>\n\n\t\t\t\t
\n\t\t\t\t\t<\/svg>\t\t\t\t<\/div>\n\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div>\n\n\t\t\t\n\t\t<\/div>\n\t<\/div>\n<\/header>\n\n\n\n
\n\t
\n\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t
<\/div>
\n
\n\t\t\n\t<\/div>\n\n<\/div><\/div><\/div>
<\/div><\/div>
<\/div>
\n
\n\t
Refrigeration controller security became front-page news within weeks. In October, attackers hit hundreds of French supermarkets. Then, overnight into November 2, a second wave hit stores in Belgium, Sweden, Estonia and other European countries. In several cases, cooling units warmed up instead of keeping food cold. Authorities are still investigating who is behind the attacks.<\/h5>\n

What happened with the European fridge hacks?<\/h3>\n

Attackers changed the settings of internet-connected refrigeration controllers. In Belgium, they switched cooling units into defrost mode. In other cases, they raised the temperature setting. As a result, stores had to throw away chilled and frozen food. Controllers from several manufacturers were involved. The exact weakness that was used has not been confirmed yet.<\/p>\n

What do we know about the vulnerabilities?<\/h3>\n

Our partner ARIANNA<\/a> checked its vulnerability database for the refrigeration systems named in the reports. It found known vulnerabilities in monitoring and management systems from both Copeland (Dixell XWEB) and Danfoss (AK-SM). For the Copeland XWEB PRO models alone, the database lists 23 CVEs, including command injection, authentication bypass and code execution flaws.<\/p>\n

The manufacturers had warned about these weaknesses before the attacks. Danfoss published security advisories in August 2023, March 2025 and August 2025, and Copeland issued a security bulletin in February 2026. They advised installing the latest software and limiting direct internet exposure.<\/p>\n

Important:<\/strong> the French cybersecurity agency CERT-FR has not established that the attacks used these vulnerabilities. The way in is still unconfirmed. ARIANNA raises a fair question, though: were affected systems updated and shielded from external access? Read the full overview ARIANNA's LinkedIn article<\/a>.<\/p>\n

Why connected controllers are an easy target<\/h3>\n

A refrigeration controller does not look like a security risk. Yet it is often connected to the internet for remote monitoring. That convenience has a price. Devices like this stay in the field for many years, and they are rarely updated. Some still use default passwords or outdated software. Therefore, one weak spot can give an attacker remote control of a physical process.<\/p>\n

This is not just a supermarket problem. The same pattern applies to every connected product, from medical devices to industrial machines and charging stations.<\/p>\n

What device manufacturers can do<\/h3>\n

Securing a connected controller starts early in development and continues after release. Four steps help most:<\/p>\n

    \n
  1. Know what is inside your product.<\/strong> Keep an up-to-date SBOM, so you can see which components are affected when a vulnerability appears.<\/li>\n
  2. Find the holes before attackers do.<\/strong> Scan your firmware for known vulnerabilities and weak configurations.<\/li>\n
  3. Detect abnormal behavior at runtime.<\/strong> A device should notice when something unexpected happens and respond to it.<\/li>\n
  4. Update safely.<\/strong> Make sure you can patch devices in the field, and that only authentic firmware can run.<\/li>\n<\/ol>\n

    How LOGIC helps<\/h3>\n

    LOGIC supplies the building blocks<\/a> for these steps and helps you combine them. As the Benelux sales and support partner of our suppliers, our engineers work with your team, from tool selection to implementation.<\/p>\n