Fridge Cyberattack Second Wave Reaches Germany

The fridge cyberattack second wave reached Germany overnight on November 2. More than 100 stores across Europe saw their fridges and freezers heat up, some units to 50 °C. The BSI says it knows of incidents at individual German supermarkets, and an Edeka store in Reisbach, Bavaria, has confirmed that its cooling was switched to heating. Three weeks earlier, the same technique hit about 700 French supermarkets.

What Happened in the Fridge Cyberattack Second Wave

The fridge cyberattack second wave follows the pattern of October 12. Attackers reached remote controllers for commercial refrigeration over the internet and forced the units into defrost mode (SecurityWeek, November 3). The affected businesses, from large chains to butcher shops, are in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden, with problems also reported in Finland, Italy and Portugal. In Belgium, Delhaize reported disruption at several dozen stores and Carrefour at 15 locations. In Ireland, SuperValu pulled chilled and frozen goods from 13 stores.

In Germany, the BSI said on November 3 that internet-reachable control systems of cooling units were manipulated at individual supermarkets and that food had to be destroyed in some cases. Bayerischer Rundfunk reported that the operator Edeka Ernst confirmed the attack for its Reisbach store, where most of the stock was discarded. The BSI names no chains and gives no count. As of November 5, further German cases are reported: supermarkets in North Rhine-Westphalia and Lower Saxony (ZDFheute, November 3), and the BSI told CORRECTIV that a pharmaceutical wholesaler’s cooling for medicines was attacked. The BSI calls the attacks untargeted and opportunistic.

CERT-FR’s alert (first published October 12, last updated October 16) names Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB supervisors. Claroty reports that a Danfoss spokesperson told the Dutch broadcaster NOS the systems hit this time were not on secure networks and used a default password. Separately, an attack on a refrigeration supplier reached three plasma storage sites of the French blood service EFS on November 2; alarms caught the change, and EFS says no blood products were lost.

As of November 5, pro-Russian Telegram channels claim the attacks, but the BSI says it has no evidence for this and cannot rule out copycats. Investigators have not shown that the two waves are connected. Officials have not said how the attackers got in. Researcher Kevin Beaumont says every freezer hit on Monday had a management interface reachable from the internet.

Why It Matters

Danfoss told its customers on October 13 to cut the controllers’ internet connection and reconnect only through a secure network. A spokesperson told NOS that most stores did, and a small number did not. Censys counted 1,825 exposed Danfoss StoreView interfaces in France before the first wave and 220 now, yet about 1,000 remain reachable worldwide. The gap between a warning and a changed configuration is the story.

Assumption: many German companies with cold storage, such as food producers, wholesalers and pharma logistics, cannot say which of their cooling units have a web interface, because a refrigeration contractor installed and maintains them. The EFS case shows that a supplier connection can reach regulated healthcare storage too. We covered the first wave in our October 14 post.

What You Should Do Now

1. List every refrigeration, cold-room and building controller with a network connection, and ask your refrigeration contractor which ones allow remote access, and which model and firmware each runs.
2. Take web interfaces off the internet. CERT-FR advises access only through a secure VPN or protected network; filtering the contractor’s source IPs is an emergency measure only. Check insurance terms before cutting remote monitoring.
3. For Danfoss units, CERT-FR advises a firmware update, security level Strict and changed default passwords. Units that no longer get security updates should not stay online: CERT-FR says a factory reset alone leaves them vulnerable.
4. Check defrost schedules and setpoints for unexpected changes, and make sure a temperature alarm exists that does not depend on the controller itself.

DIESEC Perspective

Cooling is operational technology that sits outside most IT inventories. Put it on the asset list, name an owner, and agree with the contractor who may connect remotely and how.

Not sure which of your cooling or building controllers can be reached from the internet? Contact DIESEC for an exposure assessment of your OT and building systems.

Sources: BSI | CERT-FR | SecurityWeek | BR24 | Claroty | Le Monde | ZDFheute | CORRECTIV
Published: 2026-11-06 | Category: Vulnerabilities & Patches | ~4 min read