OT and IoT security, connected refrigeration and critical infrastructure exposure

Hackers Didn't Need Ransomware. They Just Turned Up the Refrigerators.

Reporting published November 7, 2026 describes intrusions into internet-connected refrigeration at European supermarkets and three French blood-storage facilities — attacks that needed no ransomware, because the target was a setpoint. In France, alarms fired and the health ministry reported no operational impact. UK abattoirs recorded defrosting units and one 100°C reading on empty equipment. A security firm logged more than 276 attempts against Danfoss refrigeration controllers from October 20 to 30, from 91 distinct actors, peaking October 26. No group has claimed responsibility; no ransom was demanded. This analysis separates incident dates from publication dates, corrects the conflation of setpoints with measured temperatures, reconciles the five-to-eleven country counts, and explains why the same controller class that runs a cold room also runs doors, cameras and alarms.

JWilliams & Associates · November 7, 2026 · 10 min read

A freezer setpoint moved from about -30°C to 110°C. No file was encrypted. No ransom note appeared. No data left the building.

That is what makes the reporting published on November 7, 2026 worth a board's attention. The attack never needed ransomware, because it was never after data. It was after the temperature.

The dates, separated from the coverage

Nearly every summary of this story blurs when things happened. The incidents and the publications are a week or more apart, and the gap matters.

What	When it happened	How it is sourced
Refrigeration intrusions at hundreds of French supermarkets	Mid-October 2026	Translated secondary reporting; ANSSI and Paris prosecutor involvement reported
Probing of Danfoss refrigeration controllers, observed on decoy systems	October 20–30, 2026; peak October 26	Lupovis, relayed in regional coverage citing Euronews Next
Blood-storage cooling systems, Bourgogne-Franche-Comté	Night of November 1–2, 2026	Translated secondary reporting; EFE agency coverage
European retail refrigeration wave first reported	November 2, 2026	EFE agency reporting, republished
Three UK abattoirs affected	Overnight November 2, 2026; confirmed November 3	UK national newspaper citing the Association of Independent Meat Suppliers
NCSC annual review remarks	Tuesday, November 3, 2026	UK national newspaper
Consolidated assessments published	November 7, 2026	EFE; Kompas.com; Metrotvnews; Oslobodjenje

The distinction is not pedantic. French supermarket refrigeration was attacked in mid-October. The European retail wave was first reported on November 2. The assessments that pulled it together appeared on November 7. Between those dates the same events were described as a retail outage, a supply-chain disruption, and — after the blood banks — a public-health near miss.

The number is 110, and it is not a temperature

One detail in the translated coverage deserves more attention than it received: the reported 110°C was the value written into the refrigeration control system, not a temperature the freezer physically reached.

That correction is the whole difference between a scare and a catastrophe. A setpoint is an instruction. Whether blood plasma is destroyed depends on what the equipment actually did, how fast anyone noticed, and whether the alarm was independent of the controller that had just been tampered with.

In the French blood-storage case, the alarms worked. France's health ministry confirmed the incident did not disrupt operations. That is a control functioning as designed, and it is the only reason this is a story about refrigeration rather than about blood products.

The UK cases came closer to luck than design. Three abattoirs were affected, according to the Association of Independent Meat Suppliers on November 3. Two reported refrigeration units defrosting unexpectedly overnight; another recorded a temperature reading of 100°C. The units were empty. No meat was lost.

Empty equipment is not a security control.

What was actually exploited

None of the reporting describes a sophisticated intrusion. It describes the ordinary state of internet-connected operational equipment.

Exposed control interfaces. Refrigeration controllers reachable from the public internet, with login pages discoverable by scanning.
Factory credentials. Reporting cites default accounts, including a username of "Supervisor" and a password of "12345," left unchanged.
Older firmware. Coverage points to a suspected legacy firmware version in equipment made by Danfoss, the Danish engineering company. That attribution is reported, not confirmed.
Third-party access. In the French blood case, the target was described as a maintenance provider that services cooling facilities for the national blood establishment — not the operator itself.

Awais Rashid, a professor of cybersecurity at the University of Bristol, is quoted making a point that applies far beyond groceries: many of these units are managed by third parties and had not received the updates that would have stopped the intrusion.

The manufacturer's position is more uncomfortable still. A cooling-systems producer quoted in the same reporting argued that software patching alone would not fix it, and that direct physical modification of the devices was required to close the network exposure.

Five, nine or eleven countries

The affected-country count moved as the week progressed: at least five in the first wave reported on November 2, nine by early November, eleven in UK coverage. This is what early incident reporting looks like. The totals describe what had been confirmed at the moment of writing, not what happened.

Named retailers vary by outlet for the same reason. One report lists roughly 40 Delhaize branches across Belgium and Luxembourg, five Colruyt stores and 15 of Carrefour's 700 Belgian locations, with IKEA and ICA also affected. Another lists approximately 150 Intermarché stores, 80 Carrefour stores and 25 Monoprix locations in France.

The only financial figure in the reporting is an executive estimate: Intermarché's chief executive put losses in the tens of millions of euros. That is one company, one estimate, relayed through secondary coverage. No audited total exists.

Attribution: claimed, suspected, unproven

No group has claimed responsibility. No ransom has been demanded. Those two absences are themselves information, though of what is unclear.

The most specific attribution-adjacent finding comes from Lupovis, a cybersecurity firm operating honeypots — deliberately exposed decoy systems used to observe attacker behavior. Between October 20 and October 30 it recorded more than 276 access attempts against components of Danfoss refrigeration controllers, originating from 91 distinct threat actors, with activity peaking on October 26.

Its chief executive, Xavier Bellekens, described the pattern: attackers trying default passwords and exploiting specific vulnerabilities, working from hosting providers that resist takedown requests and that have previously been used by Russian hacking groups. He characterized the operation as well planned and consistent with a state actor, while conceding the company cannot prove a Russian link.

European officials have pointed toward Russia. The Kremlin rejected those accusations on Thursday, November 5. Analysts quoted by the EFE news agency — Hervé Lambert of Panda Security and Josep Albors of ESET Spain — agreed the incidents share elements but said the hypotheses do not yet support a conclusion about a single origin or motive.

George Nott, technology editor at The Grocer, made the case for restraint most directly: with no ransom demand and no claim of responsibility, the actor could be a state — or a group of teenagers doing it for amusement.

On artificial intelligence the reporting is consistent: no evidence indicates it was used. Both analysts said it would be plausible, and both noted that AI is raising the capability of people with limited technical skill. Plausible is not the same as present.

Meanwhile, the same controller runs the door

The most useful sentence in the entire body of coverage comes from Kumar Sokka of Acre Security: the freezer is nothing special — it is simply the most visible example of a much broader category.

The same class of controller, he notes, can manage doors, cameras, alarms, lighting and heating, ventilation and air conditioning in a modern building. In a hospital or a data center, an intrusion could disable a camera or silence an alarm without producing any obvious sign that something is wrong.

That reframing turns a grocery story into an enterprise estate problem. The devices in question are not in the IT asset register. They are commissioned by facilities, maintained by a contractor, reached over a link somebody set up years ago, and updated on a schedule that belongs to a manufacturer's support policy rather than a security program.

What the national picture adds

On Tuesday, November 3, the head of the UK's National Cyber Security Centre used the refrigeration disruption as an illustration of societal exposure. "Our resulting exposure as a society is huge and increasingly exploited in cyber attacks as we are seeing in the disruption of refrigeration units across Europe," Richard Horne said at the launch of the agency's annual review. He had already put the stakes plainly: "When food isn't on the shelves, when lights aren't on, businesses have gone under." Asked whether the attacks reinforced official advice to households to keep emergency supplies, he answered: "Absolutely."

That advice — three days of non-perishable food and bottled water — was published on October 22 under the Be Ready campaign. The government also announced £60 million for the first phase of a Cyber Shield initiative and £70 million for a center to identify vulnerabilities across critical infrastructure.

Read those two things together and the policy logic is clear. When physical systems are reachable from the internet, the failure mode is not a data breach. It is empty shelves.

Five questions for the next leadership meeting

1. Which of our physical systems are under remote control, and who can reach them? This is Lambert's recommendation and the right starting point: not a policy review, an inventory — including the devices facilities bought without telling IT.

2. Do we know the firmware version and credential state of every one of those devices? A default password is not a configuration error to be corrected eventually. It is the entire attack.

3. Can the operational network be separated from the corporate one, and is remote access mediated rather than direct? Bellekens' observation — that many of these systems would be better protected behind a VPN than exposed to the internet — is a design decision, not a product.

4. Does the alarm work independently of the system being attacked? The French blood case is the model: the alarm fired because it was not the compromised controller. The UK abattoir cases are the warning: nothing was lost because the equipment happened to be empty.

5. Which third party holds the keys, and does the contract require patching? In the blood-storage incident the target was a maintenance provider. Vendor management is the control.

What this edition could not establish

Attribution. Suspicions are named; proof is not. The Lupovis findings describe probing activity against decoys, not the intrusions themselves.
Whether the episodes are one operation. Common elements, no confirmed link.
Whether Danfoss firmware was the root cause. Reported as an initial line of inquiry, with the company suspected of pointing to an older version. Not confirmed.
Actual peak temperatures. Some outlets report internal temperatures reaching 50°C; others conflate control setpoints with measured readings. The 110°C figure is a setpoint. The 100°C figure is a reading on empty equipment.
Secondary physical damage. Reports of fires at some French locations appear in one translated account and were not corroborated here.
Total financial loss. One executive estimate, no audited figure.
Source quality. The core agency reporting arrives via EFE and is republished. The most detailed operational accounts are translated secondary coverage from Indonesian, Bosnian and Spanish outlets, plus one UK tabloid whose NCSC quotations were not corroborated elsewhere in this edition's retrieval.

The freezer was never the point

The reason this story travels is that refrigeration is legible. Everyone understands a warm freezer. Very few people can picture a building management controller.

But the freezer was never the target. It was the proof of concept. A device installed for convenience, connected for remote maintenance, configured once and forgotten, and reachable from anywhere on the internet. Every enterprise has some of these. Most have hundreds.

The reporting does not describe a failure of cryptography or a novel exploit. It describes a decade of procurement decisions in which "connected" was a feature and "defended" was nobody's line item.

France's blood supply survived on an alarm that happened to work. That is not a security posture. It is a coincidence with good timing — and the next building where the alarm shares a controller with the door may not be so fortunate.

Hashtags

#CustomSoftware #SystemsIntegration #EnterpriseAI #BusinessAutomation #CyberResilience #OTSecurity #ColdChain #SupplyChain #CriticalInfrastructure #FacilitiesManagement #RiskManagement #ZeroTrust #ITLeadership #CISO #DataGovernance #BusinessContinuity #OperationalExcellence #DigitalTransformation #VendorManagement #SecurityStrategy

Sources & references

Hacker Sasar Kulkas Supermarket di Eropa, Tidak Perlu Alat Canggih! — Metrotvnews (November 7, 2026, 14:32)
Indonesian-language coverage, translated. Establishes the incident date as Monday, November 2, 2026; that internet-connected supermarket refrigeration was targeted and temperatures raised to as high as 50°C, spoiling food and causing large losses; the affected estate including roughly 40 Delhaize branches across Luxembourg and Belgium plus branches in Sweden, Ireland, the Netherlands, Estonia and Finland, five Colruyt supermarkets in Belgium, 15 of Carrefour's 700 Belgian stores, and Belgian branches of IKEA and ICA. Also the source for University of Bristol cybersecurity professor Awais Rashid's observation that many supermarket refrigeration units are managed by third parties and had not received updates that would stop attackers; for the assessment by experts and a cyber advisory board that these units were reachable online with default passwords, requiring no advanced tools or techniques; and for cooling-systems manufacturer Sabcobel's position that software updates alone are insufficient and direct physical modification is needed to better close the security exposure. Translated secondary reporting.
Los ciberataques a supermercados: una lección que aprender y muchas incógnitas por aclarar — Infobae, citing EFE (November 7, 2026)
Companion EFE agency piece, translated. Corroborates the November 2 disclosure of the wave against supermarket and retail refrigeration systems affecting at least five European countries with losses of comestibles and preventive product withdrawals; the blood-bank incident the following Monday in which refrigerator temperatures rose sharply but alarm systems functioned and produced no health impact; that no evidence demonstrates the episodes are connected, share an operation, used AI, or establishes authorship or motive; that no direct economic motivation appears evident, making geopolitical or destabilization objectives 'reasonable' to consider as a hypothesis without proof; that prorussian groups including NoName057(16) and Z-Pentest have been discussed without sufficient evidence; Josep Albors' concern that no lesson will be drawn; and the security-by-design argument that connected-device manufacturers must design against attack from the outset, in the way the automotive industry integrated occupant protection, rather than treating cybersecurity as an add-on. Agency reporting relayed through a republisher.
JWilliams & Associates
Destination for the advertisement in this article and the source for the capabilities described there: custom software and portals/APIs, custom AI applications and agents, multi-tenant SaaS development, enterprise architecture, systems integration, data engineering and managed services, together with the stated design philosophy that custom AI should serve as a force multiplier for company staff rather than making staff replacement the default goal. Nothing in this source supports any claim about specific customer results, incident prevention, operational technology security outcomes or savings, and no relationship with Danfoss, Lupovis, EFS, Coolworld, Delhaize, Colruyt, Carrefour, Intermarché, Monoprix, IKEA, ICA, Panda Security, ESET or Acre Security is asserted.
Britain given 'food shortage warning' as fears over attack soar — Express (November 2026)
UK national newspaper coverage used for the domestic dimension and for direct English-language quotations. Establishes: at least 11 European countries affected with reported temperatures in some fridges and freezers reaching 50°C and large quantities of spoiled food discarded; supermarkets affected in Belgium, Sweden, Ireland, Italy, Germany and Romania; three UK abattoirs affected, two reporting refrigeration units defrosting unexpectedly overnight and another recording a temperature reading of 100°C, with the units empty and no meat lost; the Association of Independent Meat Suppliers confirming on Tuesday, November 3 that some of its roughly 300 members were affected and that businesses using the same software as affected European supermarkets became 'collateral'; National Cyber Security Centre chief executive Dr Richard Horne's remarks at the launch of the agency's annual review on Tuesday, November 3, quoted verbatim in this article, including that exposure is 'increasingly exploited in cyber attacks as we are seeing in the disruption of refrigeration units across Europe' and his 'Absolutely' when asked whether the attacks reinforced emergency-supply advice; the Be Ready campaign published October 22 advising three days of non-perishable food and bottled water; government funding of £60 million for the first phase of Cyber Shield and £70 million for a center to identify vulnerabilities across critical infrastructure; the British Retail Consortium's confirmation that retailers were working with the NCSC; and Dr Asma Adnane of Loughborough University on food supply as critical national infrastructure. Tabloid source; its NCSC quotations were not corroborated elsewhere in this edition's retrieval and are attributed to this outlet.
Objavljeni detalji o napadima na frižidere u trgovinama: "Lozinka je bila 12345" — Oslobodjenje (November 7, 2026, 18:08)
Bosnian-language coverage, translated. Primary source for the honeypot findings: Lupovis recorded more than 276 access attempts against components of Danfoss refrigeration controllers between October 20 and October 30, originating from 91 distinct threat actors, with activity peaking October 26; chief executive Xavier Bellekens told Euronews Next that attackers tried default passwords and exploited specific vulnerabilities, that the attempts were observed on deliberately exposed decoy systems, and that hosting providers used resist takedown and have previously been used by Russian hacking groups; Bellekens characterized the operation as well planned and consistent with a state actor while stating the company cannot prove a Russian connection, and noted similar activity was recorded in Europe but not in South America, Africa, North America or Asia. Also the source for: factory default credentials including the username 'Supervisor' and password '12345'; George Nott of The Grocer noting no ransom demand and no claim of responsibility, so a state actor or a group acting for amusement remain possible; the note that attackers used weak passwords and vulnerabilities for which patches already existed; Bellekens' view that many systems would be better protected behind a VPN than exposed directly to the internet; and Kumar Sokka of Acre Security describing the freezer as merely the most visible example of a much broader category, with the same controller class managing doors, cameras, alarms, lighting and HVAC in modern buildings, including in hospitals and data centers where an attack could disable a camera or alarm without an obvious sign. States no indication that AI was used in the European refrigeration attacks. Translated secondary reporting.
Los ciberataques a supermercados y bancos de sangre en Europa: todo lo que se sabe y lo que aún falta por aclarar — Infobae, citing EFE (November 7, 2026)
Spanish-language agency reporting, translated for this analysis. Establishes: the wave known on November 2 affected shops in at least five European countries, with more territories added in subsequent days; incidents in Belgium, the Netherlands and Sweden occurred three weeks after a similar episode in France; three French blood banks were attacked on the Monday, raising refrigerator temperatures sharply, with alarms functioning and no health impact; refrigeration systems are connected to platforms permitting remote monitoring and modification, so an intruder can alter temperature or defrost cycles from a computer thousands of kilometers away; no proof exists linking all episodes to one operation, attributing them to a specific group, or establishing that artificial intelligence was used; the Kremlin rejected European accusations of Russian involvement on Thursday; analysts Hervé Lambert (Panda Security) and Josep Albors (ESET Spain) agreed the cases share common elements but the hypotheses are insufficient to confirm a single origin or motive; Lambert's assessment that malware and attack tools are easy to find online without the dark web, and that an outdated system, weak password or poorly protected remote connection may suffice; and the recommended responses — identify which physical systems are under remote control, verify only authorized parties can reach them, keep equipment updated, maintain monitoring, avoid direct internet exposure of industrial devices, separate corporate networks from those controlling critical installations, and provide independent alarms and emergency protocols. Agency reporting relayed through a republisher.
Rentetan Serangan Siber di Perancis, Kulkas, Bank Konvensional, hingga Fasilitas Penyimpanan Darah Jadi Korban — Kompas.com (November 7, 2026, 11:15 WIB)
Indonesian-language coverage, translated. Establishes the mid-October 2026 French retail incident: remote access to cooling control systems at hundreds of French supermarkets, temperatures rising to 50°C, spoiled food, and reported fires at some locations; affected chains including Les Mousquetaires (Intermarché) at roughly 150 stores, Carrefour at roughly 80, Monoprix at roughly 25 of 490 French stores (5%), and Coopérative U with an unknown count; Intermarché chief executive Thierry Cotillard estimating losses in the tens of millions of euros; the Paris prosecutor categorizing the incident as a large-scale attack and ANSSI investigating; initial examination pointing to a vulnerability in a system made by Danfoss, the Danish engineering company, with Danfoss suspecting an older firmware version; suspected similar targeting in Spain, Portugal, Poland, Germany and Belgium, and early-November disruption at supermarkets across nine European countries. Also the source for the blood-storage incident in Bourgogne-Franche-Comté on the night of Sunday November 1 to Monday November 2, 2026, targeting Coolworld, a maintenance provider for the French blood establishment (EFS); the reported change of the control setting from approximately -30°C to 110°C, with the explicit clarification that this figure was the value configured in the control system rather than the temperature actually reached inside the freezer; early detection by staff; and the French health ministry confirming no operational disruption. Translated secondary reporting; several details are single-source and not independently corroborated.