When the cooler is compromised: what food safety teams cannot see during a refrigeration cyberattack

There is one number that should keep a food safety manager awake at night: 30 percent. It is the share of the incident response cases one security firm handled in 2025 that began as unexplained operational issues rather than security alerts. In the exercises the same firm ran with asset owners, 82 percent had no clear criteria for deciding when an operational anomaly should trigger a cybersecurity investigation. Part of that gap is readiness, but a larger part is that a warming cabinet and a manipulated defrost schedule look identical at the start, and telling them apart is extremely difficult without evidence from the equipment itself. The refrigeration attacks of the past month began in exactly that way.

Two attacks with different stakes

On 11 October attackers forced defrost cycles in supermarkets across France, with as many as 700 stores affected and cold-room temperatures reportedly reaching 50°C. Le Monde reported that some freezers had been set to defrost for up to eight hours, which also postponed the alarms. The attacks went on to affect retailers in several countries, including the UK, by 3 November, according to The Guardian.

The attack of 2 November was a different kind of target. Three cold stores run by contractors of the French blood service had their temperature and defrost thresholds raised to “very high levels”, with readings as high as 110°C reported by Le Canard enchaîné. The blood service is government critical infrastructure even when contractors manage the plant, and the plasma in those stores is a national medical supply, so a loss there is a public health matter and not only a commercial one. No motive is known, no one has claimed responsibility and the way in has not been disclosed.

The CERT-FR alert, which now covers Copeland and Dixell controllers as well as Danfoss, advises removing internet exposure, restricting access to a VPN and checking defrost schedules. That is sound advice for prevention and clean-up, but it says little about the hours in between, when a breach has already succeeded, the process is changing and nobody yet knows whether the cause is a fault or an attack.

Why the process hides the attack

A refrigeration manager in a supermarket or cold store typically combines two roles that industrial models keep apart: it controls the equipment (Purdue Level 1) and it supervises it (Level 2), scheduling defrost, setting temperature thresholds and raising alarms. It is networked so that settings can be changed without a site visit. A command to start or lengthen a defrost, to raise a threshold or to postpone an alarm is something the system is designed to accept, so nothing in the network traffic marks it as hostile, and no malware has to be present for the process to be changed.

Figure 1. In a store the refrigeration manager combines supervisory and process control, so the upper levels see only what it reports, while electrical signal taps at Level 0 send current readings out-of-band, over a one-way path, to a SOC / SIEM. Illustrative scenario, not a real incident.

The physical symptom is the first evidence, and it does not have to be dramatic. In one French store it was a delivery driver in Gradignan who found the stockroom flooded at about 4am after the alarms had been postponed. In other cases there may be no wet floor at all, only a cabinet drifting inside its tolerance while the screen reports normal. Once an attack reaches the process level it has many ways to mask what is happening until the damage is done, and researchers showed at DEF CON in August that readings from a compromised controller can be falsified, although there is no direct evidence that this happened in these attacks. In most cases the damage can still be stopped if the deviation is detected on time and understood in context.

Network detection tools struggle with this kind of attack for a simple reason: skilled attackers, who are expected to be increasingly assisted by AI, can use legitimate commands through legitimate channels and give those tools nothing unusual to see. It is reasonable to assume that an organization as important as the blood service had network security tools in place, although no report says so, and yet the settings of its cold stores were still changed.

Reading the process itself

Process Oriented OT Cybersecurity answers this by observing the physical process directly, at Level 0, instead of relying on what the controller says about it. Electrical signal taps on the defrost heaters, compressors and evaporator fans passively read the current each one draws, and those readings travel over a one-way path, outside the refrigeration network, to a security operations center. Because the path is out-of-band, an attacker who controls the refrigeration manager has no network path to the readings, and the equipment cannot hide the current it draws.

From those signals it is possible to build a picture of how each cabinet normally behaves: how long a defrost heater runs, how often a compressor starts, what the fans do while a defrost is in progress. A deviation is then judged in context, against the schedule, the hour, any maintenance work and the behavior of neighboring cabinets and stores. One cabinet with a long defrost is most likely a failed sensor or a stuck relay, whereas the same pattern appearing together across many cabinets, or across stores soon after a remote session, points toward something deliberate. That is the difference between detecting an anomaly and understanding it, and the second is what allows a team to act in time.

How it would look in a store

The following sequence is an illustration built from the published details and not a record of what happened in any store. A store runs twenty cabinets on one refrigeration manager, and shortly after 10pm a remote session changes the defrost settings. At 11pm a scheduled defrost should end, and the controller duly reports that it has. The tap on the heater still shows current flowing, while the compressor is idle and the evaporator fans are off, which is the electrical signature of heating without cooling. Within minutes the same signature appears on five more cabinets. The context check finds no maintenance ticket and no schedule change entered through the usual route, so the event is classified as probable manipulation and passed to the security team with the evidence attached: heater current set against the schedule and against the controller’s own report. The team can then call the store, restrict the remote access, move the cabinets to local control and send someone to check product temperatures with handheld probes, hours before a delivery driver would have had any chance of noticing.

Measures that sit around it

Detection works best as one layer among several, and Process Oriented OT Cybersecurity makes each of the others checkable. Removing internet exposure and requiring a VPN with multi-factor authentication, as CERT-FR advises, closes the obvious routes, and the electrical signals show whether a session that did get through changed anything in the plant. Setting hard limits where the equipment allows, such as a maximum defrost duration or a ceiling on temperature thresholds, constrains what a command can do, and heater current shows whether a limit is actually being enforced. Keeping an independent temperature log with its own probes and its own alarm path gives food safety records that do not pass through the controller, and the electrical signals explain why a reading changed. Separating the refrigeration network from the corporate network and making remote access read-only by default reduces the number of people who can write to the plant, and the out-of-band view confirms that the separation holds. Written criteria for when an operational anomaly becomes a security matter address the 82 percent figure directly.

After the controller is restored

Restoring the controller does not show that the plant is back to normal, because a controller can only report its own settings. Engineers still have to confirm that heaters switch on only when scheduled and that compressors restart normally. For food and for plasma, the decision to release or discard stock depends on a temperature history that does not rely on the controller, together with a record of what the equipment was doing during the hours in question, which is the record the electrical signals provide.

If the controller reported normal tomorrow morning while a cabinet felt warm, what would a food safety team have in hand to decide which stock to keep?

Amir Samoiloff is co-founder and CEO of SIGA OT Solutions.