When Hackers Turn a Freezer Into an Oven

Over the past three months, a strange new kind of cyberattack has been spreading. In August, freezers at at least six US military base commissaries flipped into defrost mode overnight and cooked the food inside. On the night of October 11, hundreds of French supermarkets, including Intermarché, Carrefour and Monoprix, had their refrigeration pushed to 122°F. Millions of euros of food spoiled and some units caught fire. On November 2, a second wave hit stores in Belgium, Ireland, Sweden, the Netherlands, Luxembourg, Estonia and Finland.

Here is the part business owners need to understand. The attackers never touched a single freezer. They went after the central controller that runs all of a store’s refrigeration, the same box a maintenance contractor logs into remotely. Those controllers were sitting wide open on the public internet. Once inside, the attackers forced defrost cycles and raised temperature setpoints. In France, reporting indicates they also stretched the defrost cycle from one hour to eight so the alarms never fired.

The way in was almost embarrassingly simple. A security researcher found exposed units accepting “admin” as the username and the current date as the password, which matches a publicly documented flaw in certain Danfoss controllers that CISA flagged back in May 2025. Updated firmware already fixes it. Many of the affected units were end-of-life models that stopped receiving security updates years ago, and thousands more remain exposed right now.

So how do you keep this from happening to you? Start by accepting that your refrigeration controller, your thermostat, your door access panel and your security cameras are all computers, and every one of them needs the same discipline you give your servers. Nothing operational should be directly reachable from the open internet. Remote vendor access belongs behind a VPN with multi-factor authentication, not a web login anyone in the world can find in thirty seconds. Default credentials have to go. Firmware has to be current, and gear that no longer receives security updates has to be replaced on a schedule instead of running until it fails.

Just as important, your alarms should not depend on the device being attacked. If the controller can be told to stay quiet, you need independent temperature monitoring that reports somewhere else entirely. Along the Gulf Coast we already know what a lost freezer costs after a storm takes the power for three days. The difference here is that no weather event was involved, and no insurance adjuster is going to call this an act of God.

This is exactly the kind of overlooked risk Cyclone 365 helps local businesses find before someone else does. Our team maps every connected device on your network, locks down remote access for your vendors, keeps firmware current, segments operational equipment away from the systems that run your business, and monitors the whole thing around the clock. For restaurants, grocers, seafood processors, clinics and cold storage operators across the Southeast United States, that protection costs a fraction of one ruined freezer.

The groups behind these attacks still have not been identified, and no one has demanded a ransom. Experts lean toward sabotage, though one noted it could just as easily be someone bored and curious, given how little skill it took. Either answer should worry you. Give Cyclone 365 a call and let us make sure your equipment is not the next easy target.