When the freezers went quiet: what Europe’s supermarket attacks teach us about the CRA

Vulnir

4 November 2026

What happened

This week, supermarkets in at least 10 EU countries and the UK threw away food after their fridge and freezer temperatures rose. The cause was not a power cut but cyberattacks on refrigeration systems. Italy held emergency talks with its intelligence chiefs on 3 November, and Belgian federal prosecutors have opened an investigation.

The numbers so far are modest per country. About 20 stores were hit in Italy, four in Germany, six in Romania and seven Coop shops in Sweden. Belgium and the Netherlands are also affected, and around 700 French supermarkets were hit by a similar attack overnight on 11 October, according to the Paris prosecutor.

Nobody has claimed responsibility. The EU’s agriculture commissioner calls it a deliberate attempt to disrupt the food supply chain. Romania’s cybersecurity director calls it semi-amateurish and does not suspect a state actor. The full technical picture has not been published yet, so what follows is about the pattern, not a forensic verdict.

It is not only food. Overnight between 1 and 2 November, attackers reportedly changed the temperature setpoints of freezers used by the French Blood Establishment (EFS) from about −30°C to 110°C. The freezers held donor samples and, according to EFS, frozen plasma for transfusion, which must stay at −25°C or below. The attackers reportedly went through Coolworld, the EFS cooling service provider. An on-call technician spotted the rising temperatures in time, and the Health Ministry reports no operational consequences. No link to the supermarket attacks has been shown.

Not the first time, but a new kind of attack

The food chain has been hit before. Until 2026, though, almost every major incident was ransomware on IT systems: ordering, planning and warehouse software. This year, attackers went straight for the refrigeration controllers.

Date	Who	What happened	Layer hit
Nov 2026	French Blood Establishment (EFS), via its cooling provider	Plasma freezer setpoints changed from −30°C to 110°C; caught in time by an on-call technician	OT: medical cold chain, via supplier
Nov 2026	Supermarkets in at least 10 EU countries and the UK	Freezers forced into defrost; food discarded	OT: refrigeration controllers
Oct 2026	Around 700 French supermarkets	Overnight remote defrost, raised setpoints, delayed alarms	OT: refrigeration controllers
Aug 2026	US military commissaries	Freezers went into defrost overnight; treated as a possible cyberattack	OT (unconfirmed)
Sep 2025	Copeland E2/E3 controllers (Frostbyte10 research)	Ten flaws disclosed, including a predictable daily admin password; no known exploitation	OT: vulnerability research
Jun 2025	UNFI, Whole Foods’ main distributor	Order and distribution systems shut down; around $400M revenue impact expected	IT: distribution
May 2025	Peter Green Chilled, UK	Ransomware at a chilled food logistics firm supplying major UK supermarkets	IT: cold chain logistics
Nov 2024	Ahold Delhaize USA	Pharmacies and e-commerce disrupted; data of 2.2 million people stolen	IT: retail
Apr 2023	Americold	Second attack in three years; around 30% of 243 cold storage sites affected	IT: cold storage
Feb 2023	Dole	North American production plants and shipments halted; salad shortages	IT: food processing
Sep 2021	NEW Cooperative and Crystal Valley, US	BlackMatter ransomware on grain and feed cooperatives at harvest time	IT: agriculture
May 2021	JBS	About 22% of US beef and pork slaughter capacity offline for two days; $11M ransom paid	IT: meat processing
Apr 2021	Bakker Logistiek, Netherlands	Cheese deliveries halted for three days; empty shelves at Albert Heijn	IT: cold chain logistics
Nov 2020	Americold	Phone, email, inventory and order systems disrupted	IT: cold storage
Jun 2017	Mondelez (NotPetya)	1,700 servers and 24,000 laptops destroyed; over $150M in losses	IT: food production

The pattern matters. IT ransomware stops orders and trucks. An attack on the controllers spoils the food itself, store by store, and can be repeated wherever the same exposed equipment sits.

Why a freezer is now an attack surface

Commercial refrigeration is run by controllers that are connected to the internet on purpose. Contractors use that link to monitor temperatures, receive alarms and fix faults without driving to the store. That is useful, and it is also the problem.

The UK’s National Cyber Security Centre said that in some of the cases, vulnerable technology had been exploited. Researchers at Forescout found nearly 13,000 refrigeration control services openly reachable online across 99 countries. In Sweden, the affected equipment was reportedly connected over old 4G mobile networks, and Italy says only stores with outdated security systems were hit.

Italy’s National Cybersecurity Agency (ACN) has described how the earlier French attack worked. The attackers exploited obsolete installations, administration interfaces exposed directly on the internet and weak authentication. That let them trigger defrost cycles remotely and change the plants’ operating parameters. ACN also warns that an attacker can change alarm thresholds and notification settings or alter displayed data, so the problem may go unnoticed for a long time.

The attackers did not need to break the equipment. They used its own forced-defrost function, so the changes looked like routine operation. Setpoints were reportedly raised far above normal, and some defrost cycles were stretched from one hour to eight to delay the alarms.

France’s CERT-FR issued a security alert on 12 October, updated on 13 and 16 October, reporting numerous compromises of remote refrigeration controllers from several product lines. Its advice: remove internet exposure, review the full configuration including defrost schedules, and restore remote access only through a secure VPN or protected network, with IP filtering acceptable only as a short-term emergency measure. It also warns that a factory reset alone is not enough, because the device stays vulnerable, and that an end-of-life device left exposed without patches carries a very high risk of compromise.

Exposure data shows how fragile the fix is. According to Censys figures cited by Nozomi Networks, internet-facing refrigeration consoles in France fell from 1,825 on 11 October to 220 on 2 November, an 88% drop. That drop came from disconnecting devices, not patching them. Outside France, the fall was only about 30%, and roughly 800 consoles were still reachable when the second wave hit.

The recipe is a familiar one from IoT and OT security:

a management interface that should never face the internet, but does
weak or shared credentials for maintenance access
firmware that is rarely or never updated in the field
nobody in the store or at headquarters who knows the device is online at all

Your fridge controller is a CRA product

A connected refrigeration controller is a product with digital elements under the Cyber Resilience Act. From 11 December 2027, new ones placed on the EU market must meet the essential requirements in Annex I. Read against this week’s incidents, those requirements stop being abstract.

What went wrong (reported pattern)	CRA Annex I, Part I(2) requirement
Controllers reachable from the open internet	(j) limit attack surfaces, including external interfaces
Maintenance access with weak or shared logins	(d) protection from unauthorised access, with proper authentication and access management
Insecure settings shipped and left in place	(b) secure-by-default configuration
Known vulnerabilities exploited	(a) no known exploitable vulnerabilities at release; (c) vulnerabilities addressed through security updates
Cooling stopped, food lost	(h) availability of essential functions, including resilience against attacks
Attacks noticed only when temperatures rose	(l) recording and monitoring of relevant internal activity

The harmonised standards being written for the CRA, including the prEN 40000 series, turn these requirements into testable controls. For a manufacturer, the practical question is simple: if an assessor checked your controller against these points today, what would they find?

Two publicly reported details make the point. One disclosed vulnerability in this class of equipment was a hidden maintenance login whose password could be derived from the device’s date. That is exactly what secure-by-default and access-control requirements are meant to rule out. And for some end-of-life models, a login bypass will never be fixed. The CRA’s requirement to declare a support period and deliver security updates throughout it exists for precisely this case.

The CRA reporting clock is already running

One part of the CRA is not waiting for 2027. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products. This applies to products already on the market too, not only new ones.

The EU’s joint statement of 4 November says so explicitly: from 11 September 2026, manufacturers must report severe incidents and actively exploited vulnerabilities through the CRA Single Reporting Platform.

If a refrigeration controller’s vulnerability was exploited in these attacks, its manufacturer has to notify the designated CSIRT and ENISA through the single reporting platform:

an early warning within 24 hours of becoming aware
a fuller notification within 72 hours
a final report within 14 days after a fix is available (one month for a severe incident)

This may be one of the first large, public tests of those obligations. Manufacturers who have not yet set up their intake, triage and reporting process, the backbone of vulnerability handling in prEN 40000-1-3, should treat this week as a warning.

The installed base is the real gap

The CRA’s design requirements apply to new products. The stores hit this week ran equipment that was installed years ago, and no product regulation will retrofit it. That part of the risk sits with the operator.

NIS2 covers food businesses engaged in wholesale distribution and industrial production and processing. Many retail chains are not directly in scope, but their distribution centres, logistics and suppliers often are. Either way, the question every retailer should ask is the same: which of our systems are reachable from outside, and who can log in to them?

There is also a radio angle. Equipment that connects over mobile networks is radio equipment. Internet-connected radio equipment placed on the EU market since 1 August 2025 must meet the cybersecurity requirements of the Radio Equipment Directive, assessed with the EN 18031 series. Older units carry no such baseline.

CRA and NIS2: two halves of the same answer

These attacks show why the CRA and NIS2 have to be read together. The CRA makes the manufacturer responsible for a secure product. NIS2 makes the operator responsible for how that product is chosen, connected, maintained and monitored. Neither one alone would have kept these freezers cold.

The EU’s own response makes the same point. In a joint statement on 4 November, the European Commission, ENISA, Europol’s European Cybercrime Centre, the EU CSIRTs Network and EU-CyCLONe described the incidents as large-scale and called on organisations to take immediate action to reduce exposure. The statement names both laws side by side: manufacturers must report severe incidents and actively exploited vulnerabilities under the CRA, while NIS2 entities must manage the cybersecurity risks to their operations and report significant incidents. It also points to ENISA’s collection of national advisories and its Secure by Design and Default Playbook.

	CRA	NIS2
Who it binds	Manufacturers, importers, distributors of products with digital elements	Essential and important entities, such as food wholesale, production and processing
What it asks	Secure design, secure defaults, security updates, vulnerability handling	Risk management measures, incident handling, supply chain security
Where it touches this case	The refrigeration controller and its remote-access features	The cold chain operator, its network and its maintenance contractors
Reporting	Exploited vulnerabilities and severe incidents in the product, from 11 September 2026	Significant incidents affecting the entity’s services

Supply chain security is the bridge between the two. NIS2 asks entities to consider the security of the products and services they buy, including how they handle vulnerabilities. CRA conformity gives them something concrete to ask for. The maintenance contractor sits in the middle: it is the operator’s supplier, and it controls the remote access that was exposed.

The blood plasma incident shows why this matters. The attackers reportedly reached the freezers through the cooling service provider, not through the blood service itself. Health is in scope of NIS2 as a sector of high criticality, and the security of suppliers and maintenance access is part of its risk management duties. What saved the plasma was not a firewall but an on-call technician watching the temperatures: monitoring and alarms that reach a person are a control in their own right.

Italy’s ACN has already turned this into practice. Its CSIRT Italia bulletin (BL01/261013/CSIRT-ITA) targets large retail, food logistics, industrial refrigeration and the maintenance companies that serve them. It sets out six immediate actions:

Identify systems and exposures: inventory controllers, SCADA, HMIs, OT/IoT gateways and remote-assistance services, with vendor, model, version and support status. Include cellular routers and links set up by maintainers.
Segregate networks: remove direct internet exposure, separate OT from IT, user and guest networks, and deny all traffic not explicitly allowed, outbound included.
Secure remote access: VPN with multi-factor authentication, access limited per user and maintainer, supplier access time-bound, logged and revoked after each job.
Review accounts: disable unused accounts, replace default or reused credentials, use individual accounts, and separate read-only from parameter-changing rights.
Check parameters and hunt for compromise: compare setpoints, defrost cycles and alarm settings with authorised values, verify real temperatures independently, and review up to 90 days of logs.
Update or retire unsupported devices: confirm end-of-support dates with vendors, patch what can be patched, isolate the rest, and plan replacement with owners and deadlines.

Three of its points deserve wider attention. A login page and an HTTPS certificate do not make an exposed system secure. VLANs alone are not filtering. And where an OT device cannot do multi-factor authentication, it should be enforced on the system that brokers access to it.

The bulletin also says plainly that isolation is temporary: it does not restore manufacturer support or remove vulnerabilities. That is exactly where an operator’s NIS2 duty meets a manufacturer’s CRA obligation to define a support period and deliver security updates throughout it.

Two short checklists

If you make refrigeration controllers or other connected equipment

Check whether any of your product lines are affected, and whether the 24-hour CRA reporting duty has been triggered
Make sure your vulnerability intake, triage and reporting process works end to end, not only on paper
Ship with no default or shared credentials, and remote access off unless the customer turns it on
Keep management interfaces off the public internet by design
Deliver security updates for installed units, and tell customers how to apply them
Start a gap assessment against CRA Annex I now; December 2027 is closer than it looks
Make sure the controller itself checks that a remote command comes from an authorised source and hasn’t been tampered with, instead of trusting whatever reaches it through the network.

If you run stores, warehouses or cold chains

List every connected device: refrigeration, HVAC, energy, cameras, payment
Find out which ones are reachable from the internet, and close what does not need to be
Know which contractors have remote access, how they log in, and revoke what is unused
Separate building systems from the store and corporate networks
Change default passwords and apply available firmware updates
Set temperature alarms that reach a person, so an attack is noticed before the stock is lost
In Italy, work through the ACN bulletin of urgent measures for food distribution and the cold chain; elsewhere, check what your national authority has published
Check your insurance and maintenance contracts before cutting the data links your contractor relies on, as CERT-FR advises, but don’t let that delay removing internet exposure.
Treat an unsupported controller as a budget decision, not a patch ticket: if no fix will come, plan and fund its replacement.
Measure how fast you act on a warning. In the French attacks, the time from the first usable alert to intervention made the difference between stores that lost their stock and stores that didn’t.

AI makes this faster and cheaper

There is no public evidence that AI was used in the freezer attacks, and Romania’s cyber agency called them semi-amateurish. That is exactly the point. Finding exposed consoles, reading advisories and trying known weaknesses no longer takes a skilled team. AI tools are lowering that bar further and compressing the time between disclosure and attack.

The evidence is already public. ENISA’s Threat Landscape 2025, covering July 2024 to June 2025, found that AI-supported phishing made up more than 80% of observed social engineering activity worldwide by early 2025. It also reports that attackers often weaponise newly disclosed vulnerabilities within days. In November 2025, Anthropic reported disrupting a state-sponsored espionage campaign against about 30 organisations, in which an AI agent carried out most of the reconnaissance, vulnerability research and exploitation, with humans involved only 10 to 20% of the time. Some researchers have questioned parts of that account, but the direction is clear.

For exposed OT, the consequence is simple. A device that is reachable, unpatched and protected by a guessable password will be found and used faster than before, and by less skilled attackers. Patching windows shrink, and “nobody will bother with our freezers” stops being a defence.

That is why resilience has to be built in on both sides, before the next wave:

Products that are secure by default, keep their attack surface small and receive updates for a declared support period: the CRA’s job.
Organisations that know what they have connected, control who can reach it and notice when something changes: the job of NIS2 and of guidance like ACN’s.

AI will help defenders too, with faster triage, monitoring and testing. But it cannot protect a controller that should never have been on the internet.

The takeaway

This week showed that product security is now food security, and AI is making attacks faster and cheaper. A melted freezer is a more convincing argument for the CRA than any slide deck. The same weaknesses show up in building systems, energy meters and industrial equipment across Europe.

Help needed for your compliance journey?

At Vulnir, we help manufacturers implement harmonised CRA standards, including the prEN 40000 series. That means gap analyses against these standards and EN 18031, risk-based control selection, vulnerability handling and reporting processes, assessment evidence preparation, and training for product and test teams. To learn where your product stands, contact us.

Engineering Trust. Enabling Compliance.

Get In Touch

Note This article was prepared with the support of AI for research and drafting. The content was reviewed and edited by the Vulnir team, and all facts are linked to the sources listed below.

Sources

Tags:

Security Incidents

Comments are closed.