Hackers across Europe have been remotely hijacking internet-connected refrigeration systems in supermarkets and meat suppliers, cranking temperatures from sub-zero to as high as 100°C. The attacks struck retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands, and Sweden on Monday, following similar incidents in France last month. The UK's National Cyber Security Centre confirmed British meat suppliers were also affected, though it characterized the national impact as minimal. The attack vector is almost comically simple. The compromised Danfoss fridge controllers were connected to the internet using factory-default usernames and passwords — credentials that are publicly documented by the manufacturer. No AI, no zero-day exploits, no sophisticated tradecraft. These are legacy systems with known vulnerabilities that have existed "for a long period of time," according to NCSC operations director Paul Chichester. The French supermarket attacks last month used the same entry point. Cyberdefence firm Lupovis set up honeypot traps mimicking real Danfoss controllers and recorded 256 attempted attacks from 91 different sources between October 20 and 30. CEO Xavier Bellekens noted significant overlap between the probing infrastructure and networks "previously associated with Russian-linked malicious operations." The attackers used bulletproof hosting — internet service providers that ignore abuse complaints and resist law enforcement takedowns. Bellekens said the number of actors fitting this profile is "relatively small." The British Association of Independent Meat Suppliers reported that some of its 300-plus members were affected, with one company's cold units heating to 100°C and two others experiencing defrosting. Aims said the affected units were empty at the time and no produce was lost. No UK grocery chain has been directly affected so far. NCSC chief executive Richard Horne framed the fridge attacks as the "foothills" of an enlarged cyber threat, arguing that AI systems will increasingly surface flaws in IT networks that owners didn't know about or neglected to patch. Chief technology officer Ollie Whitehouse said manufacturers need to build safer connected devices and consumers need to accept paying more for that safety. The agency is now working with organizations to identify and close similar loopholes before they're exploited. The real story is structural, not technical. Industrial control systems for critical infrastructure — cold chains that keep food safe — are being connected to the public internet with authentication no better than leaving the key under the doormat. The attackers didn't need to be sophisticated because the defenders never showed up. Default passwords on internet-facing equipment are not a cybersecurity problem; they're a governance problem. The NCSC's reassurance that impact is "minimal" is accurate today. But the demonstrated capability is what matters: remote, anonymous actors can reach into the physical infrastructure of food supply chains across multiple countries simultaneously. If the units had been full, the economic damage — and the public health risk — would have been real.
