Who turned up the fridge? What a real cyberattack reveals about connected cooling

The alarm that matters

Imagine arriving at a grocery store before opening. The refrigeration cabinets have power. The display is lit. Then you put an independent thermometer inside and watch the reading rise. Which reading do you trust, and who gets to decide whether the food goes back on the shelf?

That scene is hypothetical. The disruption behind it is real. On November 3, Sweden’s public crisis information service reported that a cyberattack the previous day had raised temperatures in a number of retail refrigerators and freezers. The notice did not publish temperature readings, identify the attacker or describe how access was gained. Carrefour Belgium independently said refrigeration equipment was lightly affected at 15 of its more than 700 stores, mainly in freezer sections. Its stores stayed open. The Associated Press reported that some affected retailers elsewhere in the wider disruption discarded spoiled stock. An EU joint statement published November 4 said commercial refrigeration and similar equipment had been affected in several member states since October 11, with another wave on November 1 and 2.

These reports establish a physical consequence in commercial refrigeration. At home the evidence is different. Researchers have shown weaknesses in individual appliances and the online accounts that control them. Those tests help explain how a kitchen appliance can expose information or accept instructions from someone other than its owner. They do not establish a wave of household fridges being sabotaged. The common question is which permissions an intruder inherits after entry.

Source notes: 1, 2, 3, 4, 7, 8, 24.

Why stores connect their refrigeration

It is 2 a.m. and one cabinet is warming. In a store without remote monitoring, staff may find out at opening. A duty operator who receives an alert can check the temperature trend, see whether the cabinet is in a scheduled defrost cycle and call a technician if the temperature keeps rising. Those checks help distinguish a short, expected change from a fault that needs someone on site. A cabinet air reading and a reading of the food can tell different stories, so a graph informs the response and the store’s procedures govern what happens to the stock.

There are three jobs in that chain. At the cabinet, a local controller reads sensors and runs equipment such as fans, valves and defrost hardware. Frost restricts airflow through the coil. A normal defrost cycle clears it and ends so cooling can resume. The site supervisor brings multiple cabinets together. It can log readings, route alarms and, with appropriate access, change settings or coordinate defrost. Above it, an optional fleet service lets a retailer compare stores, prioritize call-outs and see whether one site’s energy use has drifted. Danfoss documents these layers in its equipment manuals and describes the multi-store features in its service documentation.

Logs also have a food-safety purpose. EU hygiene rules require applicable food businesses to monitor critical points, plan corrective actions and keep records suited to their operation. A store can use temperature histories to document those checks. Publishing a controller’s login page on the internet is a design choice, outside those hygiene requirements. France’s CERT-FR even tells operators to check insurance terms before cutting a contractor’s monitoring feed. The aim is to protect access while keeping the warning system useful.

Source notes: 4, 31, 32, 33, 35.

How attackers can get in, and what the evidence shows

An exposed login with a factory password is the most concrete public lead. The Dutch NCSC confirmed attacks in the Netherlands on November 2 and described how weak or unchanged passwords can let someone alter settings remotely. Its notice leaves individual investigations to the affected organizations. Dutch broadcaster NOS reported a Danfoss spokesperson’s account that attackers changed temperatures at at least 17 Dutch businesses. The spokesperson said the affected systems used default passwords and were outside a secure network. At one frozen-products site, the supplier reported a change from a usual setting of −20°C to −10°C. That was a reported change to the setting. The report did not provide an independent temperature reading from the food. In a separate test on October 27, security firm Previdian recorded three attempts using factory credentials against its internet-visible decoy, which rejected them. The Dutch supplier described the affected equipment. The decoy recorded what somebody tried. The Irish NCSC also described reports of unauthorized access to directly internet-accessible controllers. Together these sources establish exposure and a plausible route. They leave the exact login or exploit at individual stores open.

A weakness in the controller’s own authentication is a second route. In separate lab research, Claroty found an alternative administrative login mechanism on a Danfoss controller that undermined the protection offered by the ordinary password. Claroty also documented weaknesses in Copeland XWEB Pro. These findings explain why restricting who can reach a controller matters even when the normal credentials are unique. Claroty’s November 4 follow-up says its specific flaws had yet to be officially linked to the attacks.

A contractor or service network is a third route to account for. A legitimate maintenance connection can reach equipment that is invisible from the public internet. If access on that path is stolen or abused, the attacker may inherit the technician’s reach. That is a security scenario, separate from an established route into the November victims. Swedish retailer ICA told Cybersecurity Dive that affected units were outside its central network. Sweden’s public notice confirmed the physical effect but gave no initial access route. France’s CERT-FR documented numerous compromises in October across Danfoss AK-SM and AK-SC, Copeland XWEB and Dixell XWEB systems. It advised operators to remove public exposure and review settings, especially defrost schedules. Its alert does not assign an entry route to each case.

The damage can follow a legitimate command after entry. A session authorized to change cooling may be able to raise a target temperature or interfere with a defrost schedule. In a custom test refrigerator, Claroty showed that a compromised Copeland XWEB Pro supervisor could reach cooling components through a field controller and change the displayed value independently of the probe. The demonstration explains why a reassuring number on a dashboard can be weak evidence during an incident. It does not reconstruct what happened at a specific store.

That is the case for separating access by role. A duty operator can view alarms without permission to change settings. A technician can receive logged, narrowly scoped access through a protected gateway when a change is necessary. Operators can test whether local cooling and independent alarms keep working when they isolate the remote connection. Results depend on the installation.

Censys measured a different part of the problem. It observed 6,695 internet-visible hosts worldwide across two controller families on October 9 and 3,124 on November 5, a fall of roughly 53%. The unit of measurement was an internet-visible host. The number of compromised stores and the reasons for the decline remain separate questions. Thousands of hosts in those two families were still visible after the second wave.

Source notes: 1, 4, 5, 6, 9, 28, 29, 30, 34, 36, 37, 38.

Three ways a home fridge can be involved

Start with the connection. In 2015, Pen Test Partners examined a specific Samsung RF28HMELBSR at DEF CON. The fridge’s calendar connection used encryption but did not properly verify the server’s certificate. Think of the certificate as evidence of who is at the other end. If the appliance encrypts a conversation without checking who it is talking to, someone in a position to intercept that connection could impersonate the service. The researchers identified a possible route to Google credentials. Their report did not show arbitrary access from anywhere on the internet or a takeover of the cooling system.

A second route is the account or the manufacturer’s service. In 2017, Check Point reported a weakness in the login process for LG’s SmartThinQ platform. The team demonstrated account takeover using an LG robot vacuum and its camera. Refrigerators were among the appliance types linked through the platform. The public demonstration involved the vacuum. This distinction matters because different devices expose different controls, and even two models in the same range can have different permissions.

A third route is a flaw in the connected software on the appliance itself or in a controller that serves it. The impact depends on which software component is affected and what it is allowed to do. A compromised screen or app may expose a calendar, photos or a linked account. A controller with authority over cooling can present a different risk. Samsung’s current support documentation shows that SmartThings can change temperature on supported refrigerators. That is an example of a legitimate remote permission. Someone who misuses a valid session could potentially exercise the same permissions, subject to that model’s limits. The documentation is not evidence of a current flaw in SmartThings.

At home, the benefit may be as simple as getting a high-temperature alert while you are away. The feature’s usefulness depends on whether the model can warn you locally as well, and which controls still work if the phone cannot reach the service.

The reason to separate these routes is practical. A unique password and two-step verification can help with account theft. They cannot repair a certificate-validation flaw in appliance software. A separate network can limit what a vulnerable appliance can reach inside the house. It cannot stop a valid command sent through the manufacturer’s cloud. A firmware update may address a software bug without revoking a stolen login session. Match the response to the layer you have evidence about.

Source notes: 5, 7, 8, 10, 11, 12, 13.

The costs that do not look like hacking at first

Privacy is one. Samsung documents a feature on supported Family Hub models that can show fridge and freezer temperatures and an image of the contents in its app. A picture of a shelf can contain more information than an inventory. A repeated record might suggest shopping routines or when a household is active. That is a possible inference, and its reliability would depend on what data is collected and how frequently it is observed. It does not mean every refrigerator streams video, that this service sells the images or that a stranger has accessed them. Look for what your own model collects and which account members or linked services can view it.

Another cost is uncertainty about a physical system. If a store cannot trust its temperature history, it may have to hold stock while staff check independent measurements and follow food-safety procedures. That can consume staff time and create waste even where only part of the site was affected. At home a warm refrigerator, an unexpected notification or a changed app display can also have ordinary causes. A power problem, a failing sensor or a settings change calls for different troubleshooting. An unknown account login or unexplained configuration changes are reasons to investigate. Either way, actual temperature is a separate question from how the problem began.

And then there is attribution. In 2014, a headline-making claim linked a refrigerator to spam. Cisco Talos explained why a public IP address is insufficient to identify the appliance that sent it: computers and connected devices in the same home can share one external address. Identifying a fridge on that network does not identify it as the sender. A screenshot, IP address or open web page can tell you where to look. To assign a particular action to a particular device, you need evidence that connects the two.

Source notes: 1, 2, 5, 13, 14, 15.

The two clocks start at different times

One clock measures how long the appliance can do the job you bought it for. The US Department of Energy used an average of 14.3 years for standard-size refrigerators and refrigerator-freezers in a standards analysis based on historical shipments and the installed stock. That is a category estimate. It cannot predict the life of the unit you are looking at in a showroom.

The other clock measures how long the connected product receives security fixes. Samsung’s UK page for one Family Hub model, RS90F66BEFEU, lists a security-update period ending December 31, 2030, and describes the period in relation to the product’s launch. That date is for the listed model and market. It is neither a warranty nor a promise that every feature or third-party integration will be available until then. A late buyer can have less remaining support than an early buyer of the same model. Ask for the actual end date before comparing units. Commercial hardware can face the same gap. Copeland’s bulletin says its XWEB EVO supervisory controllers stopped receiving security patches on March 16, 2026, and can keep operating. XWEB EVO is a separate product line from the XWEB Pro tested by Claroty.

There is also a third deadline hiding behind both clocks: the life of the service a feature relies on. In a 2026 preprint, Leipzig University researcher Erik Buchmann mapped the dependencies behind eight uses across three household refrigerator models using manuals and product pages. In that analysis, some ways of changing cooling parameters depend on software or services outside the owner’s control. The paper identifies possible long-term failures. It did not measure how often they happen or test whether those three fridges lose cooling when their cloud goes offline. A sensible purchasing question follows: which controls and alarms work locally if the app cannot sign in?

Disclosure rules can make the comparison easier, but the date and jurisdiction matter. The UK’s connected-product regime has applied since April 29, 2024 and requires manufacturers of in-scope products to make the minimum security-update period available. It does not prescribe the same number of years for every device. The EU Cyber Resilience Act links support for covered products to expected use and generally requires at least five years, with an exception for products expected to be used for less. Its main requirements apply from December 11, 2027; specified manufacturer reporting obligations started on September 11, 2026. That timetable is not a fresh five-year support promise for a fridge already in a kitchen. Check the exact model, market and manufacturer statement.

Source notes: 16, 17, 18, 19, 20, 25.

What to do before buying, and if something looks wrong

Before buying, ask the seller to show the exact model’s update end date, where updates appear and whether local temperature controls and alarms work without a manufacturer account or an internet connection. Ask separately about cameras, shared access and what a previous owner must do before transferring a used unit. If the connected features matter to you, test the difference between an alert the phone receives and a warning the appliance can display by itself. Follow the model’s manual and avoid experimenting with food safety.

For a supported fridge you want to keep online, use a unique password and two-step verification if available. Keep the appliance, controlling app and home router updated. Remove household members, trusted devices and integrations you no longer use, where the account allows it. A separate IoT or guest network can help limit access to other devices if your router actually isolates clients. Check that your setup still provides the alerts you depend on. Avoid making the appliance’s management interface directly reachable from the internet.

If you suspect unauthorized access, handle cooling and security in parallel. Keep the fridge powered while you verify temperature with a separate appliance thermometer. If food may have warmed, follow official local food-safety guidance and do not rely on taste or appearance to judge it. From a trusted device, open the official account page, review unfamiliar activity and revoke sessions or trusted devices where available. Change a suspected compromised password. Save relevant alerts or screenshots before a reset if it is safe to do so. If the manufacturer’s instructions allow it, disconnect the fridge from Wi-Fi while investigating. That can pause cloud features and remote alerts, so verify which controls remain available and contact the manufacturer if anything is unclear. A factory reset is a model-specific last step: it can erase useful evidence and settings, and it does not install a patch.

Store operators have a different recovery problem. Removing public exposure is an urgent first measure. After that, the refrigeration team and its service provider need a known-good configuration, trustworthy temperature records and a safe plan for restoring necessary remote access. A network block can stop commands arriving over that path while leaving changed setpoints or schedules in place. An independent measurement helps staff determine whether the equipment is back in a safe operating state. It does not replace the organization’s food-safety procedure.

Source notes: 4, 5, 6, 10, 11, 12, 13, 14, 17, 21, 22, 23.

The better question to ask

A remote alert can be genuinely useful, especially when nobody is there to hear the appliance. Its value depends on who can change the setting, what happens if the connection fails and how long the equipment will receive fixes. Those questions belong on the same purchase checklist as capacity and energy use. When the display and the contents tell different stories, the priority is to learn what happened to the food. The app can help with that answer. It should never be your only source of it.