On the night of 11 October, somebody reached into the refrigeration systems of several hundred French supermarkets and warmed them up. By the morning, cabinets that should have held frozen stock were running far above freezing, and whole aisles went into the skip. Les Mousquetaires, the group behind Intermarché and Netto, said some of its units had been driven to fifty degrees and put the damage in the tens of millions of euros. Carrefour, Monoprix, Coopérative U and E.Leclerc all reported sites hit. Three weeks later, on 2 November, it happened again across at least nine more countries — Belgium, Luxembourg, the Netherlands, Sweden, Estonia, Ireland, Portugal, Italy, Finland and others — and this time it reached Britain, where a handful of meat suppliers and a produce wholesaler found their cold rooms being driven the same way.
I wanted to see this for myself, from the attacker's side of the glass. So on 2 November I put a decoy on the public internet, built to look to anyone poking at it from outside exactly like the controller that runs a supermarket's refrigeration — the unglamorous box that holds the chilled and frozen aisles at temperature and raises the alarm when they drift. There was no shop behind it, no stock, no customers and no actual refrigeration: only the controller, answering in the same industrial language the real ones speak, sitting on a public address to see who would come knocking. We call this a honeypot. The point is not to catch anyone. It is to listen, and to learn how quickly an exposed piece of industrial kit is found, and what people do when they find it.
It ran for seven days, from 2 to 9 November, alongside the second wave. This is what it saw.
Found within hours
The first thing to say is the most mundane, and the most important. It was found almost at once. Within hours of going live the decoy was being catalogued by the automated scanners that sweep the whole internet around the clock, and over the week it logged activity from more than a thousand distinct internet addresses. After stripping out my own test host and scanner, that left a little over seventeen thousand events from 1,023 sources.
The overwhelming majority of that is the ordinary background radiation of the internet: automated programs rattling every door they can find, hunting for forgotten passwords, exposed configuration files and the usual commodity web and router weaknesses, then moving on. That noise is the normal weather of any address connected to the internet, and it is worth stating plainly because it sets the context. This level of attention is not special to a refrigeration controller. Any exposed system receives it, all day, every day. The lesson is not that someone is hunting supermarkets specifically; it is that exposure itself is the event. Put anything on a public address and the whole internet introduces itself within the hour.
Against that background, a smaller body of activity engaged specifically and deliberately with the industrial surfaces the decoy presented. Three things stood out, and they are the story.
One visitor turned the dial
Late on the evening of 5 November, a single connection spent the better part of four hours interacting with the controller by hand. This was not a scanner. It worked out what the device was, read its current state, and then began adjusting the temperature setting — pushing it from a normal frozen target up to well above freezing, the sort of change that on a real system would let a case warm and spoil its contents, and then trying values no real freezer could ever reach, reading the result back each time to watch what the controller did. Then, apparently satisfied, it stopped and did not come back.
The striking thing about that session is not the part that sounds alarming. Nothing was at stake. There was no stock to spoil, no store to disrupt, no ransom demanded and no victim. The visitor could not even have known whether anything real sat behind the controller. They changed the temperature of a freezer that did not exist, watched a number move on a screen, and went to bed.
That is the honest shape of a great deal of what reaches an exposed industrial system: not a planned sabotage campaign, but curiosity meeting an open door. The connection came from an ordinary residential broadband line in Switzerland, with no VPN or proxy in front of it — the unmasked, experimental, patient character of someone capable who found the thing and could not resist seeing what it would let them do. I would not read that address as the person; home lines are reassigned, and a home machine can itself be a stepping-stone. But the behaviour is unmistakable, and it is a different and more accurate picture than the one usually painted of these attacks.
There was a quieter companion to it. Earlier the same afternoon, another visitor spent under a minute on the same industrial service and read the controller's state — brief, but unmistakably fluent in the protocol, going straight for the right registers rather than fingerprinting blindly. That one arrived through what reputation data flags as a residential proxy: a service that routes a paying customer's traffic out through other people's home broadband, so the true operator was deliberately hiding behind a stranger's connection in Spain. Fluency in industrial control plus deliberate concealment is a materially different and more concerning profile than the unmasked tinkerer, and the two of them, on the same afternoon, are a fair sample of who turns up.
The key was left in the lock
The second finding is the one that matters most for anyone who actually runs this equipment, and it is worth being very fair about where the weakness lay.
The decoy shipped, as many real controllers do, with a weak factory-default login. Over the week that default was accepted eight times, by six different visitors, who typically logged in, looked at the status dashboard for a minute, and left. The password was not being painstakingly cracked. It was simply known, and being tried. One other visitor, who did not get in, guessed a plausible brand-themed password — which tells you that at least one party recognised the make of the device and reached for a credential to match.
Look at where those successful logins came from and the picture sharpens. Most arrived through commercial VPNs, a cloud-security proxy and assorted consumer lines rather than from one place blind-guessing. That is the signature of a credential that has begun to circulate — checked by more than one party from behind anonymising infrastructure, rather than discovered fresh. On a real estate of controllers, this is the single most exploitable exposure there is, and it is the clearest message of the week.
Because it would be easy to draw the wrong conclusion here, let me be plain. The weak point was not the refrigeration controller. The device these attacks target is a common, capable and perfectly sound piece of equipment, and nothing here is a flaw in any one manufacturer's product. The weakness is in how such a device ends up deployed: reachable from the open internet, and still using the simple password it came with from the factory. An open door, and the original key still in the lock. That combination is what every deliberate visitor to my decoy walked through, and — though the investigators have never confirmed the exact route into the real stores — it is almost certainly what opened the door in France, Belgium and Sweden too.
The part the news got right, and the part it mostly didn't
The real attacks did have a technical story underneath them, and it is worth setting out because it explains why this happened now. In August, researchers at Claroty published work on a widely used Danfoss refrigeration manager, the AK-SM 800A, and disclosed a set of flaws — an authentication bypass tracked as CVE-2025-41450, together with a post-login command-injection issue, CVE-2025-41451, and a denial-of-service one, CVE-2025-41452. Danfoss had already issued fixed firmware. The authentication bypass is the one that reads like a parable: the device could be entered using a maintenance code that was derived from nothing more secret than the current date and time, so anyone who understood the scheme could produce a valid code for any day without ever knowing the real password. France's CERT-FR, in its alert of 12 October, never confirmed that this was the route used, and the British meat-sector incidents on 2 November were pinned on a different family of controllers again — Copeland's XWEB supervisors, with their own authentication-bypass problem and their own patch that had been available since August. Different vendors, same shape.
And the shape is the point. Two things had to be true for any of these attacks to work: the controller's management interface had to be reachable from the open internet, and the way in — a default password, an unpatched bypass, a date-derived code — had to be weak or known. Neither is a sophisticated-adversary problem. Ken Munro of Pen Test Partners suggested to reporters that the culprits could be "kids messing around", and having watched my own decoy for a week, I think that is nearer the truth than most of the coverage allowed. The French group's losses were real and ran to tens of millions; the capability required to inflict them was not.
That is why the honeypot was not a contrived example. It was an ordinary one. When I re-ran the exposure counts for The Grocer on the morning of 9 November, there were still 274 supermarket-type refrigeration controllers of the main makes sitting on the open UK internet — 198 of them the exact Danfoss StoreView type my decoy imitated, plus 76 Dixell XWEB units — part of the better part of twenty thousand controllers of these makes exposed worldwide. "Reachable on the open internet" does not, by itself, mean every one is unpassworded; it means the door answers from anywhere on earth, and the honeypot is what showed how easily the ones still on their factory credential are then walked through. A large exposed population, and a demonstrated ease of entry — those two findings are much stronger told together.
Who did it? Mostly, the evidence can't say
The question everyone asks is who was behind it, and for the most deliberate visitors to my decoy, that is precisely the question the evidence cannot answer. Most of them reached it through services whose entire purpose is to hide where their user really is: commercial privacy networks, a cloud-security proxy, and in at least one case a residential-proxy service that borrows ordinary people's home connections. The addresses I can see are deliberate dead ends. I can describe what was done, and sometimes roughly where a connection appeared to surface, but attaching a name or even a reliable country to it is, for most of these visitors, simply not possible from the data — and I would far rather say so than point a finger I cannot justify.
That is not a failure of the sensor. It is the condition of the modern internet, and it has a direct operational consequence: if you are defending real equipment, address-based blocking will always lag, because the addresses are rented and rotated by the week. The durable detection is behavioural — the sequence of a reconnaissance sweep followed by someone writing to a temperature set-point is the same whatever address it comes from, and it is the kind of thing a monitored estate can actually alarm on. The official view is converging on the same point. Belgium's cyber-security centre said plainly that the perpetrators may never be identified; Britain's NCSC, launching its annual review on 3 November, called the national impact "minimal" so far while its chief executive, Richard Horne, warned that these freezer attacks were "really just sort of the foothills". His colleague Ollie Whitehouse put it more bluntly, saying the agency was "surprised to see some of these things being connected to the internet still in 2026". So was I, and I had a week of logs to prove it.
What to actually do
If you run, supply or buy from a business with chilled or frozen stock, the fix is mundane, cheap, and almost entirely within your control. None of it requires buying a new controller or waiting for a vendor.
The first and largest step is to get the management interface off the open internet. These controllers were never meant to face the whole world; they were meant to be reached by a maintenance contractor. Put them behind the equivalent of a locked staff corridor — a private, authenticated connection such as a VPN, or at the very least a firewall that only lets your refrigeration contractor's addresses through — and almost everything my decoy saw this week simply cannot reach you. CERT-FR's emergency guidance was exactly this: disconnect the controllers or filter access to them, and treat IP filtering as a stopgap rather than the destination.
The second is to change the factory password, on every controller, and to make sure the person who installed it did not leave it on the shipped default or a house standard they use everywhere. This is the one that my week proves matters most, because the default was not cracked — it was simply known.
The third is to find out what you actually have, because in a great many businesses nobody knows. The controller is usually installed by a refrigeration contractor who takes the quickest route to remote access, often over consumer or cellular broadband that the retailer's own IT team never sees and does not manage. Before you can secure the thing, someone has to be able to answer three questions: what refrigeration controllers do we have, are any of them reachable from the internet, and who put them there. If the honest answer is a shrug, that is the finding, and it is the same shrug that sat behind most of the European stores that lost their stock.
The fourth, for anyone running outdated or end-of-life equipment, is to patch what can be patched and to treat what cannot as something that must never face the internet directly. CERT-FR was explicit that an end-of-life device exposed without fixes is very likely to be compromised, and that a factory reset alone will not save it — it will simply be taken again.
For boards
Three questions, none of which needs a technical answer.
Do we know where our refrigeration and building controllers are, and is any of them reachable from the open internet right now? For most food businesses the honest first answer is that nobody knows, because the kit was installed by a contractor and never entered anyone's asset register. That gap is the exposure.
Who can reach that equipment from outside, over what connection, and is it still on the password it shipped with? If the answer to the last part is a shrug, assume it is, because across a week my decoy was entered on its default eight times by people who already knew it.
If our cold chain were driven out of range overnight, how would we know before the morning — and is that an IT problem or a food-safety one? In the French stores the alarms did not help and the staff had gone home. The businesses that came through the second wave intact were the ones where a person saw the temperature move and physically pulled the plug.
The closing observation
The temptation, after a run of attacks like this, is to reach for the language of cyber-warfare — critical infrastructure, state actors, the cold chain as a target. Some of that may yet prove true, and the national agencies are right to watch for it. But it is not what my week showed, and it is not what the evidence from the real attacks supports either. What I watched was something plainer and, in its way, more sobering: an exposed industrial control is an almost irresistible invitation to curiosity, and curiosity is abundant. The freezer I put on the internet did not exist, and still, within four hours on a Thursday evening, someone found it and turned the dial just to see if it was real.
The door was open and the key was the one it came with. That is the whole of it. Shut the door, change the key, and the overwhelming majority of what spoiled Europe's groceries this autumn simply has nowhere to happen.