Refrigeration controller security: lessons from the European fridge hacks

Refrigeration controller security became front-page news within weeks. In October, attackers hit hundreds of French supermarkets. Then, overnight into 2 November, a second wave hit stores in Belgium, Sweden, Estonia and other European countries. In several cases, cooling units warmed up instead of keeping food cold. Authorities are still investigating who is behind the attacks.

What happened with the European fridge hacks?

Attackers changed the settings of internet-connected refrigeration controllers. In Belgium, they switched cooling units into defrost mode. In other cases, they raised the temperature setting. As a result, stores had to throw away chilled and frozen food. Controllers from several manufacturers were involved. The exact weakness that was used has not been confirmed yet.

What do we know about the vulnerabilities?

Our partner ARIANNA checked its vulnerability database for the refrigeration systems named in the reports. It found known vulnerabilities in monitoring and management systems from both Copeland (Dixell XWEB) and Danfoss (AK-SM). For the Copeland XWEB PRO models alone, the database lists 23 CVEs, including command injection, authentication bypass and code execution flaws.

The manufacturers had warned about these weaknesses before the attacks. Danfoss published security advisories in August 2023, March 2025 and August 2025, and Copeland issued a security bulletin in February 2026. They advised installing the latest software and limiting direct internet exposure.

Important: the French cybersecurity agency CERT-FR has not established that the attacks used these vulnerabilities. The way in is still unconfirmed. ARIANNA raises a fair question, though: were affected systems updated and shielded from external access? Read the full overview in ARIANNA's LinkedIn article.

Why connected controllers are an easy target

A refrigeration controller does not look like a security risk. Yet it is often connected to the internet for remote monitoring. That convenience has a price. Devices like this stay in the field for many years, and they are rarely updated. Some still use default passwords or outdated software. Therefore, one weak spot can give an attacker remote control of a physical process.

This is not only a supermarket problem. The same pattern applies to every connected product, from medical devices to industrial machines and charging stations.

What device manufacturers can do

Securing a connected controller starts early in development and continues after release. Four steps help most:

1. Know what is inside your product. Keep an up-to-date SBOM, so you can see which components are affected when a vulnerability appears.
2. Find the holes before attackers do. Scan your firmware for known vulnerabilities and weak configurations.
3. Detect abnormal behavior at runtime. A device should notice when something unexpected happens and respond to it.
4. Update safely. Make sure you can patch devices in the field, and that only authentic firmware can run.

How LOGIC helps

LOGIC supplies the building blocks for these steps and helps you combine them. As the Benelux sales and support partner of our suppliers, our engineers work with your team, from tool selection to implementation.

• Exein Runtime detects threats at runtime and supports incident response on connected devices. It monitors the vital parts of an embedded system and reacts to abnormal behavior, for example by reporting an incident to a cloud service.
• Free CRA compliance scan: request a free scan of your binary and get an expert walk-through of the results. Request your free scan.
• ARIANNA Vulnerability Management Platform builds your SBOMs and HBOMs, monitors vulnerabilities continuously and shows compliance with regulations such as the CRA. Read more about ARIANNA.

Exein Runtime protects your device while it runs, and ARIANNA keeps track of known vulnerabilities. Together they form a LOGIC Solution.

Why the Cyber Resilience Act makes this urgent

The EU Cyber Resilience Act (CRA) turns these good practices into obligations. Since September 2026, manufacturers must report actively exploited vulnerabilities within 24 hours. On 11 December 2027, all main requirements take effect. From then on, products with digital elements must meet security-by-design standards and carry a CE mark to be sold in the EU. Therefore, the time to prepare is now.

Frequently asked questions

Why were the supermarket fridges so easy to hack?

Attackers could change the settings of refrigeration controllers remotely over the internet. Investigators have not confirmed which weakness was used. Authorities advise removing controllers from direct internet exposure and securing remote access. Known vulnerabilities exist in several of these systems, and manufacturers had published advisories before the attacks. Whether those weaknesses were used has not been confirmed.

What is the first step to secure a connected device?

Start by knowing what is inside. Build an SBOM and scan your firmware for known vulnerabilities. Then decide which risks matter most.

How can I check my firmware for vulnerabilities?

Request a free CRA compliance scan of your binary from LOGIC. You get a short report and an expert walk-through of the results.

Working on a connected device of your own? Request your free CRA compliance scan, or talk to one of our engineers about the right combination of building blocks.

There's always a LOGIC Solution!