What is known

Stores reported disruption; the campaign picture is still open

BleepingComputer reported on 2 November that retailers in several European countries had refrigeration failures after remote temperature settings were changed. It obtained acknowledgements from several chains, including ICA, Coop and Ahold Delhaize, about affected stores. The reported outcomes varied: some units shut down, some warmed and staff had to intervene to protect stock.

It remains unclear whether the stores were hit by one coordinated operation or separate incidents. The public reporting does not establish the attackers' initial access or a single product flaw behind every case. Store counts and impact details come from the reporting and retailer statements, not a unified public incident report.

An earlier warning is useful context, not attribution

CERT-FR warned in October about compromises of exposed Danfoss, Copeland and Dixell refrigeration controllers in France. That alert is practical guidance, but it does not prove that the November store incidents are the same campaign or involve the same devices.

Defender workflow

Start with the controllers reachable from outside

  1. 1

    Find remote management paths. Inventory controllers, vendor support connections and public IP exposure. Ask facility and refrigeration providers which systems can change temperature or defrost settings remotely.

  2. 2

    Check configurations and operating logs. Review setpoints, defrost schedules, user accounts and recent remote changes with the facilities team. Preserve the current state before resetting a suspected compromised controller.

  3. 3

    Restrict access safely. Follow vendor and CERT guidance to remove direct internet exposure and use protected access. Coordinate changes with operators so monitoring and service are not interrupted unexpectedly.

Defender note

An IT fix can have a physical consequence

CERT-FR specifically advises checking controller configurations and restoring access through a protected network or VPN. That is a useful starting point for any exposed refrigeration estate. The response should include store operations and food-safety owners: they can tell whether a changed setting is merely unusual or already affecting product temperatures.