When the cold chain is under attack: what the refrigeration hacks teach

The cold chain rests on one thing: knowing that temperature-sensitive stock is being kept within its limits, all the time. Lose that and you risk wasted stock, financial loss, regulatory trouble and, for medicines and blood, patient safety.

This autumn added a new way to lose it. Attackers reached refrigeration controllers over the internet, changed their settings and forced fridges, freezers and cold rooms into defrost. The incidents differ in detail, but they point to the same lesson: no business should rely on a single system, controller or alarm route to know that its stock is safe.

What happened in France in October

On the night of Sunday 11 October 2026, refrigeration at hundreds of French supermarkets was disrupted. Intermarché, Netto, Coopérative U, Carrefour, Monoprix and some E.Leclerc stores were affected. Attackers remotely triggered forced defrost cycles, some fridges and freezers reportedly reached 50 °C, and stores had to throw away fresh and frozen stock. The Paris prosecutor opened an investigation into what it called a "large-scale" attack. Danfoss, one of the controller makers involved, said the affected units were running outdated firmware (Al Jazeera).

The second wave on 1 and 2 November

Three weeks later a second wave began around midnight on Sunday 1 November. Supermarkets in Belgium, Luxembourg and Sweden reported refrigeration switched into defrost, with further cases reported in Finland, Ireland, Estonia and the Netherlands. The attacks used remotely exploitable weaknesses in management interfaces left open to the internet, and researchers reported many attempts to log in with the makers' published default passwords (Help Net Security).

The attacks showed how a system built to keep storage safe can become the route by which it is made unsafe. A controller runs the equipment: set points, defrost cycles, fans. Where it can be reached remotely, has default passwords or runs old firmware, someone else can change what it does.

UK businesses were caught up too

The November wave reached the UK. The Association of Independent Meat Suppliers (AIMS) urged its members to check their fridges as a matter of urgency after several reported interference: one supplier's units had been set to defrost every hour, and another's set far above safe storage temperatures (The Grocer). AIMS later said none of its affected members lost meat, and that the incident "must act as a reminder to all in the food industry" that their businesses may be targets (The Record).

Langridge Organic, a fruit and vegetable wholesaler in west London, found six of its ten cold room control systems had been compromised. The rooms had been set to defrost remotely, and the automated alerts that warn staff when a room leaves its safe range had been switched off. No stock was lost, because staff carry out regular manual temperature checks (The Grocer).

Two points stand out. The risk is not limited to supermarkets and large distribution centres: wholesalers, processors and smaller operators were hit because their equipment was connected. And an alarm generated by the same control system can be silenced by whoever controls that system. Langridge's stock was saved by a separate check, not by the controller's own warning.

The French blood service: the alarms did their job

On 2 November the supervision and control systems for cold rooms at three regional sites of the Établissement français du sang (EFS), France's national blood service, were affected through a refrigeration provider. The EFS reported that operating settings had been altered. A duty technician and the sites' monitoring and alarm systems picked up the problem, stored products were moved to other equipment, and remote access to the affected units was cut off. The EFS said no blood products were lost and no health impact had been identified (Le Quotidien du Médecin, AFP).

This is the outcome every operator wants. Monitoring is not there to collect readings or produce reports. It is there to tell a person about a problem in time for them to act, and to give them somewhere safe to move the stock when they do. That means knowing where your monitoring, control and notification sit, and whether they really are independent of each other. Our excursions guidance covers what to do once stock has been out of range.

Control, monitoring and alarms are three different jobs

A refrigeration controller is essential to a cold room or freezer, but it should not be your only source of truth about the temperature of the stock.

• Refrigeration control runs the equipment and holds its settings.
• Independent monitoring measures and records the actual conditions, through its own sensors, gateway and communications.
• Alarm management turns those readings into notifications, escalation and action.

Kept apart, a problem with one is far less likely to remove all three. If a controller is hacked, misconfigured or simply fails, an independent sensor keeps reporting the conditions inside the room, as long as its own sensor, gateway and connection are working. If a compromised controller shows normal settings, the independent reading still shows what is happening to the product.

The same applies well beyond cyberattacks. Refrigeration fails through mechanical faults, power cuts, doors left open, human error and maintenance. Independent monitoring catches the consequence whatever the cause. It is not a substitute for securing the controllers. Both need protecting.

Alarms that lead to action

Independent monitoring is only as good as the alarm plan behind it. An alert that goes to an unattended inbox, to someone on leave, or to a team that has learned to ignore it, protects nothing. A good plan answers five questions.

• Who needs to know? The people who can act: site staff, facilities, quality, managers and an out-of-hours contact.
• How quickly? A brief rise from a door opening needs different handling from a sustained excursion or a fast climb.
• What if the first person doesn't respond? If an alarm isn't acknowledged within an agreed time, it goes to the next person.
• Can the event be traced? When it started, who was told, who acknowledged it, what was done and when it ended.
• Do the settings fit the product? Thresholds and delays should reflect the storage limits and the risk, and be reviewed when equipment or processes change.

The NHS Specialist Pharmacy Service guidance on alerts makes the same points for medicines: set the alarm before an excursion occurs, keep any delay as short as practical, keep a record of alerts, and make sure alarms cannot be permanently silenced. It also notes that audible alarms can be missed out of hours or when nobody is nearby. That holds across the cold chain: design an alarm around the response it has to trigger, not the message it can send. Our monitoring and alarms guidance and our article on alarm fatigue go further.

Monitoring software needs maintaining too

Monitoring and alarm software runs on servers and web software that need security updates like any other. In October, for example, the PHP project issued urgent fixes for two critical flaws in widely used web software (CVE-2026-109618 and CVE-2026-109619) that could let an attacker run code on a server without logging in, and said updating was the only complete fix (PHP security advisory). Whatever system you use, know who keeps its software patched, how quickly, and what happens when a version reaches the end of its support. A software flaw is a separate issue from the sensors and gateways, but it belongs in the same continuity plan.

What to review now

The recent incidents are a good prompt to check your own arrangements.

• Remote access to refrigeration controllers. Find out which can be reached from outside your network, and limit access to authorised people over secure connections.
• Default passwords. Replace them with unique, strong passwords and review who has access.
• Software and firmware support. Know which controllers and monitoring systems are near the end of support and how updates are applied.
• Control and monitoring kept apart. Check whether a fault or compromise in the controller could also take out temperature measurement and alarms.
• Sensor placement and coverage. Make sure sensors read the areas where the stock actually sits.
• The whole alarm process, tested. Check that alarms reach the right people, are acknowledged and escalate, including out of hours.
• Contingency plans. Staff should know what to do if refrigeration, monitoring software, communications or power fail, and where stock can be moved.
• Records. Keep temperature histories and alarm records where you can reach them for investigations, audits and product decisions. See records and data integrity.
• Clear responsibilities. IT, facilities, refrigeration contractors and quality should each know who secures, maintains and responds to each part of the system.

The National Cyber Security Centre's advice on internet-exposed operational technology says the same in more depth: verify which systems are reachable from the internet rather than assuming they aren't, keep them off the public internet, replace default credentials, monitor connections, and keep tested backups so you can recover. These are not only IT tasks. They protect the physical process the cold chain depends on. For food sites, our guidance on frozen food and cold stores and warehouse mapping and monitoring covers the storage side.

More than one line of defence

October and November showed how quickly a technical weakness becomes a cold-chain incident. A compromised controller changes the conditions the stock is kept in. A disabled alert stops staff getting the warning they expect. A web software flaw puts the system that records it all at risk. Each is a different failure, and each shows the danger of relying on one point of control or notification.

• Secure, maintained refrigeration controls.
• Independent temperature measurement.
• Reliable records you can see and use.
• Alarms set up for your site, with escalation.
• Trained people who know how to respond.
• Practical plans for when systems fail.

No single device or platform removes every risk. Together, these give you the best chance of spotting a problem early and protecting the stock. So ask yourself one question: if the system running your refrigeration failed, was compromised or stopped sending its own alarms, would you still know what was happening to your products? If you're not sure, now is the time to review it. We're happy to go through your independent monitoring and alarm set-up with you.

This article is industry commentary and practical guidance. Assess your own systems, security and regulatory requirements with the right technical and quality specialists.