Blog

Refrigeration attacks expose a wider weakness in our cybersecurity

Manipulated refrigeration systems in Swedish supermarkets show how known weaknesses in connected technology can have physical consequences. What stops us from acting on risks we already know about, and how can we build stronger resilience?

On the night of 2 November, disruptions were reported in refrigeration and freezer systems at Swedish ICA and Coop stores. In Sjöbo, the temperature was reportedly set to around 50°C, forcing the store to discard goods. Other stores also reported unusually high temperatures. The incidents resulted in both financial losses and work having to be put aside.

It is a reminder of what can happen when digital controls have physical consequences. A simple change through an interface can result in spoiled food, disrupted operations and financial damage.

The full sequence of events has not yet been established. It has not been confirmed that all the incidents had the same technical cause, or that the attacks in France and Sweden were carried out by the same actor. But the questions they raise go far beyond individual refrigeration systems.

The warning was there. What did we do about it?

As early as the Cybersecurity in Sweden 2022 report, Sweden’s National Cyber Security Centre described internet-exposed supermarket freezers where poor password management made it possible to switch systems off or change temperatures remotely. More similar installations could be found with a simple search.

In October 2026, hundreds of French stores were affected by attacks targeting refrigeration controls. France’s CERT-FR warned of compromised controllers. Shortly afterwards, Belgian cybersecurity authorities urged organisations to identify their systems, remove direct internet exposure and secure remote access. A few weeks later, reports emerged of new disruptions in several European countries, including Sweden.

There is an uncomfortable pattern here. The risk was known. The warnings were specific. Yet not all the necessary measures were implemented in time.

In the environments I encounter, the cost of a security measure is tangible, while the consequences of waiting are uncertain. So the measure is postponed, sometimes again and again. Eventually, the weakness simply becomes part of the environment.

This leaves every organisation with an important question: when someone else experiences an incident, does it actually prompt us to examine our own exposure?

Old weaknesses in a new threat landscape

We pay a great deal of attention to new and advanced vulnerabilities. But an exposed administration interface, weak or shared passwords, or a controller that no longer receives security updates may be all an attacker needs.

In some reported refrigeration incidents, legitimate functions, such as defrosting or temperature settings, were used to disrupt cooling. In other words, an attacker does not necessarily need to install dedicated malware to cause damage. Exactly how access was gained in the November incidents has not, however, been publicly established.

Forescout has identified almost 13,000 internet-exposed refrigeration-related services across more than 6,000 public IP addresses in 99 countries. That is not the same as 13,000 confirmed vulnerable devices. But it illustrates just how common internet-exposed remote administration is.

AI makes this issue more urgent. The technology can help defenders identify exposure and prioritise action, but it can also help attackers map known weaknesses faster and at greater scale. There is no evidence that AI was used in the refrigeration attacks discussed here. The point is that the old question, “Why would anyone attack us?”, becomes increasingly difficult to rely on when exposed systems can be discovered automatically.

Whitepaper

Guide: Secure AI 2026 – effective & future-proof AI

Cut through the hype and standalone technical fixes. Deepen your understanding of AI by recognising that it is not merely a matter of innovation or security, but of governance, responsibility, and lon…

Read

Who is responsible for connected control systems?

ICA has stated that the connections used by the affected refrigeration systems were outside its central store network. This is an important distinction. The incidents should therefore not be described as breaches of ICA’s central IT environment.

But that is also where the lesson lies. A well-protected central network is not enough if refrigeration control, building automation or a contractor’s service connection has its own route to the internet. An attacker does not care whose budget the system belongs to.

Outsourcing maintenance does not mean outsourcing responsibility. Who knows which systems are in place, which suppliers can connect to them and what they are authorised to do? Who owns the decision to disable a connection when it is no longer secure?

This is where Zero Trust becomes tangible: who can access the control system, from where, using which identity and with what permissions? Equipment may require remote servicing, but that does not mean its controls need to be exposed to the internet.

Protection must also limit the impact

Alerts and monitoring are important. But once the temperature has risen to damaging levels, it may already be too late for the goods. Systems therefore need not only to detect anomalies, but also to limit what an unauthorised or compromised user is able to do.

Should it be possible at all to remotely change critical setpoints without additional controls? Can temperatures be monitored independently of the controller that could be manipulated? And what continues to work if remote access has to be disconnected?

These are questions that need to be addressed when systems are procured, built and managed, not when an incident is already under way. Resetting a controller without closing the original route of exposure does not solve the underlying problem.

Greater responsibility throughout the lifecycle

The EU Cyber Resilience Act strengthens requirements for security and vulnerability management in products with digital elements. Manufacturers’ reporting obligations for exploited vulnerabilities and serious security incidents began to apply on 11 September 2026. The main product requirements will apply from 11 December 2027.

This is an important step. But new requirements will not make existing installations secure overnight. Control systems being purchased today, as well as those already in operation, may need to function for many years. Manufacturers, maintenance providers and the organisations operating these systems therefore need to take responsibility for the entire lifecycle, including as the technology ages.

And this does not stop with refrigerators and freezers. Connected control systems are used across industry, energy, water, buildings, healthcare and food production. In these environments, the consequences can extend beyond discarded goods to product safety, operational continuity and, in some cases, people’s physical safety.

Resilience is built before an incident happens

Acting in advance comes at a cost. But during an active incident, the cost is often higher, and the decision can no longer be postponed. Cybersecurity is therefore not only about preventing breaches. It is about building an architecture that limits the impact, makes responsibilities clear and allows the organisation to keep operating when something goes wrong.

Only when known risks lead to concrete decisions and an architecture designed to withstand disruption does cybersecurity become more than technology. It becomes business resilience.

Cybersecurity SOC/MDR

Whitepaper

Report: Cyber Resilience Insights 2026

Move beyond headline threat trends. Cyber Resilience Insights 2026 connects our own European SOC and MDR data, forensic investigation, offensive security testing and global threat research to show whi…

David Kasabji

Head of Threat Intelligence, Conscia Cyber & AI Security

Read

About the author