Second Wave of Fridge Cyberattacks Hits Europe: How to Protect Your Connected Devices

A second wave of cyberattacks is putting commercial refrigeration units on ice across Europe, leaving operations and security teams racing to protect their infrastructure. The new incidents, reported on Monday, November 2, come less than a month after hundreds of French supermarkets were hit on October 12. What began in France has now spread across the continent, as detailed in a BBC report covering dozens of supermarkets across seven European countries (Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, and Finland) where attackers manipulated connected refrigerators and freezers by switching evaporators to defrost mode and driving internal temperatures up to 50°C (122°F), threatening Internet of Things (IoT) and operational technology (OT) devices across supply chains and cold storage facilities.

If you manage connected systems and you read about others being attacked in your industry, how can you protect your environment from becoming the next target?

Here is a concise breakdown of how proactive visibility, exposure management, anomaly detection, snapshots (configuration control), and network segmentation build a reliable defense. We also show where Asimily fits at each step.

What We Know So Far

• Oct 12, France: French officials said about 700 of the country’s roughly 10,000 supermarkets were affected, with temperatures pushed as high as 50°C, food losses and reported fires.
• Nov 2, seven countries: Roughly 40 Delhaize stores in Belgium and Luxembourg were hit, along with stores in Ireland, the Netherlands, Finland, Sweden and Estonia. Thirteen SuperValu stores in Ireland were affected, and Swedish freezers reportedly reached as high as 55°C.
• Evading alarms: Le Monde reported that attackers extended the defrost cycle from one hour to eight, which helped avoid triggering alarms.
• Still developing: French investigators said a vulnerability in Danfoss software may have enabled the French attack. Investigations are ongoing, and we will update this post as details are confirmed.

Phase 1: Proactive Detection and Risk Assessment

Effective security starts with visibility. Understand what these devices are, where they are communicating (internal, external), and how the devices are communicating (over what service or port, and is it secure?). Then understand the known vulnerabilities behind these attacks, which carry high impact ratings, making active tracking essential.

A dedicated IoT security platform like Asimily automatically correlates high-severity threat bulletins against your existing inventory, mapping vulnerable hardware models, firmware versions, and communication protocols so you know which devices are exposed before attackers find them. If risky devices were not already in your inventory, then find out why and get them in there going forward. Asimily discovers and profiles connected devices that traditional IT tools often miss, including building and refrigeration controllers.

Phase 2: Exposure Management and Vulnerability Prioritization

Proactively identifying weaknesses across your network reduces your chances of being exploited. Exposure management continuously monitors IoT and OT assets to detect known vulnerabilities and security gaps before attackers can exploit them. Rather than attempting to patch every flaw at once, focus on prioritizing vulnerabilities based on their likelihood of exploitation and their direct business impact. By concentrating efforts on the most critical risks first, security teams can efficiently protect key operational systems and strengthen overall asset cybersecurity. After the first wave of French attacks, it should have been very clear that these were high-risk and high-priority vulnerabilities and they would have been prioritized very highly for your exposure management program to address quickly. As Stephan Moelans, CEO of Sabcobel (the refrigeration installer that manages Delhaize’s systems), noted: “The simplest solution is to manage the fridges over a secure internet connection. Most of our customers switched to that after the attack in France.” Asimily matches new advisories to your inventory and ranks exposure by exploitability and business impact, so your team can answer “are we exposed?” quickly and fix the right devices first.

Phase 3: Real-Time Anomaly Detection and Containment

If an attacker bypasses perimeter controls, anomaly (behavior) detection acts as your next line of defense. Unauthorized external connection attempts to commercial cooling systems from the internet at large should trigger instant alarms. Ideally, those connections are never allowed in the first place, but perimeter controls will sometimes fail or be misconfigured. Automated containment can quarantine compromised units immediately, preventing rogue scripts from spreading across your fleet. Detection also has to look beyond malicious traffic. Le Monde reported that attackers stretched the defrost cycle from one hour to eight, a legitimate setting changed in a way that avoids alarms. Asimily’s behavior-based anomaly detection flags a device doing something its normal profile says it should not, even when the traffic looks legitimate. If you need to investigate, packet captures on the affected segment give your incident response team the evidence it needs.

Phase 4: Microsegmentation and Blast Radius Control

Assume the worst: if exploitation is underway, flat networks are the enemy. They allow threats to spread unchecked. IoT and OT devices should operate on strictly limited network access without direct peer-to-peer communication. In this case, refrigerators need to communicate with central telemetry and management servers, but never directly with each other. Microsegmentation blocks unneeded lateral movement in networks, stopping infections at the source. Thankfully, most IoT and OT assets have defined purposes, which makes their logical network segments easy to define. Asimily recommends and simulates segmentation policies based on each device’s observed behavior and risk, so you can enforce least-privilege access without guessing.

Phase 5: Recovery

In the worst-case scenario that your devices have been compromised, you need to return to a known good state quickly. This can be done if you have a snapshot of the configuration of your devices and can easily revert to them. Further, if there are variances from that known good configuration and they are detected, it provides an additional level of protection that could shorten the amount of time that attackers have to create havoc. In these attacks, the damage came from altered device settings, such as forced defrost mode. Asimily Configuration Control takes snapshots of device settings so you can restore a known good baseline quickly.

Action Plan: What to Do Right Now

If you learn about an attack affecting your industry and you know that there are vulnerable assets in your inventory, here are some immediate steps to help you avoid being in the news.

• Audit Asset Inventories: Confirm all devices and their communications have been cataloged and mapped.
• Exposure Management: Figure out if there is a path for the attacker for the IoT and OT devices in your environment to successfully take a vulnerability and exploit it.
• Monitor Network Activity: Flag unknown inbound or outbound IP traffic targeting IoT and OT devices.
• Enforce Strict Segmentation: Verify firewalls prevent direct device-to-device communication and block direct internet access to device management interfaces.
• Capture Device Snapshots: Use Asimily Configuration Control to take snapshots of current system states and settings for quick baseline restoration.
• Run Packet Captures: If engaging an incident response team, collect detailed packet captures on suspicious segments to support forensic investigation.
• Check Remote Access: Confirm that vendor and managed-service access to refrigeration and building systems runs over a secure, authenticated connection.

Building Long-Term Resilience

Security should not rely on frantic manual updates during an active breach. Effective IoT security platforms continuously connect new threat intelligence to your device inventory, so the next advisory becomes a prioritized action list instead of a scramble.

Want to know whether your connected devices are exposed? Request an Asimily demo to see every device in your environment, which ones are at risk, and what to fix first.

Frequently Asked Questions

What Caused the Supermarket Refrigerator Cyberattacks?

Attackers remotely changed settings on connected refrigeration control systems, switching evaporators to defrost mode and driving temperatures as high as 50°C. French investigators said a vulnerability in Danfoss software may have enabled the first attack, and investigations into the second wave are ongoing.

How Do I Know If My Organization Is Exposed?

Start with an inventory of every connected device, including refrigeration and building controllers. Then check which are reachable from the internet and which run vulnerable firmware. Asimily automates discovery and prioritization.

How Can I Limit the Damage If a Device Is Compromised?

Segment IoT and OT devices so they can reach only their management servers, monitor for unexpected setting changes, and keep configuration snapshots so you can restore a known good baseline quickly.

[Related: French Fridges Heated by Hackers, Slamming Supermarkets and Outing OT Vulnerabilities]