Fridge hack: how supermarket freezers hit 50C, and why attackers "really didn't need" AI

The fridge hack started as a strange French retail story and has become a test of how much basic equipment sits exposed on the internet. Before October, a supermarket freezer was a maintenance problem. Now the US and UK governments are treating its controller as an attack surface. On Sunday, The Guardian reported that Paul Chichester, director of operations at the UK's National Cyber Security Centre (NCSC), said the attackers "really didn't need" AI to find the flaws. Default access passwords, he said, had been published in one fridge operating company's manuals.

Our 26-second version:

File photo of a freezer aisle in Frankfurt; this store is not linked to the attacks. Image: Alexis Jazz (CC BY 4.0, Wikimedia Commons)

What is the fridge hack?

It is a run of attacks on the systems that manage commercial refrigeration, not on the fridge in your kitchen. Attackers changed settings remotely so that units warmed up or went into defrost, and some reached 50C (122F).

The first big wave came in October in France. Finance minister Roland Lescure told parliament about 700 of the country's 10,000 supermarkets were affected. BleepingComputer cites a lower estimate of 250 to 350, so the true count is still unsettled.

The second wave landed on Monday 2 November. BleepingComputer counts more than 115 stores across six countries. Al Jazeera and Reuters listed dozens of Delhaize shops in Belgium and Luxembourg, about 15 Carrefour stores in Belgium and seven Coop stores in Sweden. RTÉ reported 13 SuperValu stores in Ireland, where owner Musgrave said the problem was limited to one model of refrigeration.

It also went beyond groceries. The French Blood Establishment said temperature and defrost thresholds were raised at three plasma storage sites, and told AP no blood products were compromised. Reuters, citing four officials, reported that the Pentagon considered freezer failures at US bases a suspected hack.

NextDiff graphic. Sources: Reuters, AP, BleepingComputer, CISA, The Guardian

How did hackers get into the fridges?

Large stores run refrigeration through networked controllers so that technicians can monitor them remotely. That convenience is the opening. University of Bristol professor Awais Rashid told Al Jazeera these systems are often remotely managed, exposed to the internet and short of updates, with known flaws and guessable passwords.

Danfoss, the Danish refrigeration company, told The Guardian that most of the affected equipment was old and no longer received security updates, and that it had long recommended customers update or replace it. A US-made Copeland system was also in use at one London wholesaler that saw units read 150C, according to the same report. Neither detail proves a single vendor was the route in, and the US fact sheet names no vendors.

The plain-English version: nobody needed a novel exploit here, as far as officials have said. Old devices, reachable from the internet, with passwords that were never changed, were enough.

What are governments telling operators to do?

On 5 November, CISA, the FBI, and the US health, agriculture and transportation departments published a joint fact sheet. It says attackers are targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage. Its advice applies to anyone running this equipment:

• Remove controllers from the public internet, and put any remote access behind a maintained firewall or edge device.
• Move them to a dedicated operational-technology network, away from business systems.
• Change default passwords and use phishing-resistant multi-factor authentication where possible.
• Patch firmware, and replace devices that are past end of life.
• Set limits on temperature setpoints and alert on any deviation.

The joint fact sheet published on 5 November. Image: CISA (US government work)

Who is behind it?

Nobody has been confirmed. No group has claimed the attacks. Xavier Bellekens, chief executive of the security firm Lupovis, told The Guardian there are elements pointing to Russia but added that nobody can be certain. TechCrunch, citing NPR and Nextgov, reported that researchers and US officials have pointed to Iran. The US has made no formal attribution. Treat any confident claim with caution.

Why it matters

The cheapest lesson is the most uncomfortable. The NCSC's warnings about AI-driven attacks on infrastructure get the headlines, but this campaign reportedly worked through manuals and unpatched boxes. Ciaran Martin, the NCSC's founding chief executive, told The Guardian it was a bad run but not unprecedented, which is a useful counterweight to the talk of a new era. The Guardian set the fridge attacks beside the $6.3 billion Binance theft, a very different kind of attack.

For anyone who ships connected hardware, the gap is the product's lifespan. A freezer lasts far longer than its software support, and the device keeps working after the updates stop.

What's next, and what we don't know

Belgian prosecutors have opened a criminal investigation, and French agencies are investigating the blood storage incident. We don't yet know how many sites were compromised without visible effects, whether further waves are coming, or who ran this. We'll update this story when attribution or a full store count is confirmed.