Five Governments Just Warned You About Your Freezer

50°C. Inside a freezer.

That's the number that ended up in the US government's warning last week — the temperature some European supermarket refrigeration units were pushed to in November, by attackers who never set foot in the stores.

Somewhere in France, in the middle of October, a supermarket freezer stopped being cold. Nobody broke a lock. Nobody walked into the store after closing. Someone far away reached a small grey box on the wall — the controller that tells the freezer how cold to be — and switched it into defrost. Then left it there. By the time anyone noticed, the temperature inside the cabinets had climbed past safe, and everything inside was already lost.

That was the first wave. It wasn't the last.

An estimated 250 to 350 French supermarkets were hit in October. Then a second wave in November reached more than 115 stores across six European countries. Some freezers shut down entirely. Others climbed to 50°C — hotter than a summer afternoon, inside a machine built to hold frozen food.

Then it stopped being about groceries.

On the night of 1–2 November, the same kind of attack reached three sites run by France's blood service, the EFS. The target there wasn't food. It was blood plasma, stored at −30°C. Someone pushed the setpoint toward 110°C. An on-call technician happened to spot the climb in time, and no blood products were lost. The French health ministry confirmed there was no health impact. But the margin between a close call and a disaster that night was one person, watching a screen.

Days later, five governments spoke at once.

On 5 November, the United States published a joint advisory from CISA, the FBI, the Department of Health and Human Services, the Department of Agriculture, and the Department of Transportation. Five agencies, one document, one message: malicious actors are targeting industrial refrigeration and cold-chain monitoring systems, worldwide, right now.

"Every organization that depends on refrigeration and monitoring systems should assume it could be a target," said Chris Butera, CISA's acting executive assistant director for cybersecurity.

That sentence is the story. Not because it's dramatic — because of who had to say it, and how many of them had to say it together.

Here's what the advisory actually confirms. The targets are electronic temperature controllers and commercial refrigeration controllers — the boxes that let operators watch temperatures remotely, manage defrost cycles, and run cooling equipment. The attackers get in through unpatched or internet-accessible controllers, using authentication bypass, code injection, or weak configurations. The advisory names no vendor, no CVE, no attacker, and no victim count. That's not a gap in the reporting. That's the point: the problem is the whole class of device, not one bad model.

And the effects are worse than spoiled food. A controller pushed the wrong way can shorten a system's life, start a fire, and wipe out inventory. It can also do something quieter and more dangerous: take away the operator's view of the temperature. The advisory calls it a loss of visibility. In plain words: the attacker can warm the freezer and hide the thermometer at the same time.

That last detail is the one that should change how you think about this. A fridge that stops working is a maintenance problem. A fridge that lies about its own temperature is a safety problem — because nobody throws the food away if the screen still says −18°C.

So why is this happening now? Partly because the devices were never treated as computers. A temperature controller is a computer with a thermostat attached, and thousands of them sit on the public internet. France's CERT-FR named Danfoss AK-SM and AK-SC controllers in its alert. An IPinfo scan found 1,331 exposed Danfoss dashboards in France alone. Nobody needed a zero-day. They needed a search engine and a default password.

And partly because the cold chain is bigger than supermarkets. The same controllers keep blood plasma cold, vaccines cold, chemicals stable, and refrigerated trucks on temperature. The advisory lists four sectors by name — healthcare, chemical, food and agriculture, transportation — because the same box sits in all of them.

The agencies' advice is refreshingly blunt, and none of it requires new technology. Take the controllers off the public internet. If remote access is genuinely needed, put it behind a firewall and keep that firewall updated. Isolate the refrigeration network from the business network. Change the default passwords — and use phishing-resistant multi-factor authentication where you can. Patch the firmware, and retire devices the manufacturer no longer supports. Set hard limits on how warm a unit is allowed to get, and alert on it. Watch the logs.

None of that is glamorous. All of it would have stopped most of these attacks.

There's a pattern in the incidents NullTrace has followed this autumn, and this is its clearest form yet: the attack didn't come through the front door. It came through the device nobody counted as a computer. The supermarket freezer. The blood bank's thermostat. The box on the wall that everyone walked past.

The freezer was never just a freezer. It was a computer, and computers get hacked. Five governments didn't discover that this week. They just said it out loud — together.