Freezer Hacks Go Global: What Governments Now Advise, and a Remote-Access Checklist for Any Site with Connected Controllers

When we first wrote about the supermarket freezer attacks, nobody had claimed them and nobody had been named. A week later the picture is different. French prosecutors have publicly accused a group linked to Iran’s Revolutionary Guard Corps. US agencies have issued a joint warning. Singapore and Japan have told operators to check their own equipment, and Thailand has told agencies to watch the threat and exporters to harden their cold chain.

The attribution is an allegation, and you should treat it as one. The technical advice is a different matter. Every government says the same thing, and it applies far beyond supermarkets. If a contractor can log in to a controller over the internet, that controller is part of your attack surface, whether it cools food, runs a chiller, or heats a plant.

This post covers what has changed, what the advisories agree on, and eight questions to put to your refrigeration contractor and your IT team.

What has changed since our first post

• The scale was larger than first reported. The Paris prosecutor’s office says the 11 October attack hit 700 retail locations across France, causing significant food spoilage and roughly twenty fires.
• A suspect group has been named, as an allegation. Prosecutors say the attack was carried out to serve a foreign power, Iran, and point to a cyber unit of the Islamic Revolutionary Guard Corps. They cite the attack methodology, the use of Persian, and IP addresses that trace back to devices in Iran. The investigation targets the leader of a group called "Shahid Kaveh" and two deputies, and no individual is named. These are accusations from an ongoing investigation, not findings. An IP address’s location does not by itself identify who was operating it, the report carried no immediate response from Iran, and officials have not said that every incident in France, Belgium, Sweden and the US is connected.
• Other cold storage was hit. A separate attack targeted several French blood banks. Reporting says the products and samples were not damaged, and it does not link that attack to the supermarket case.
• The US issued a joint advisory on 5 November. CISA, the FBI, HHS, USDA and the Department of Transportation say actors are exploiting unpatched or internet-accessible refrigeration controllers, and can force units into continuous heating and defrost cycles. The advisory also warns of "denial-of-view", where you lose sight of the real temperature.
• Asia has now responded. SingCERT published an advisory on 6 November covering remotely accessible OT control systems. Japan’s National Cybersecurity Office issued a notice on 9 November, according to Business+IT. In Thailand, the Prime Minister told agencies to monitor the threat, and the Department of International Trade Promotion (DITP) told exporters to strengthen cold-chain cybersecurity. None of the reports we reviewed describes an attack on Thai refrigeration systems.
• Exposure has not gone away. Forescout counted 12,976 internet-exposed service observations across 10 product groups, on 6,017 distinct public IP addresses in 99 countries and territories. Separately, Forescout’s Daniel dos Santos said in a report carried by Insurance Journal that nearly 5,000 Danfoss systems were still exposed online and potentially vulnerable in the week before the 2 November incidents.

What the advisories agree on

Source	Date	Main asks
CERT-FR (France)	From 12 Oct	Disconnect controllers that have a public IP address. Reconnect only through a secure VPN after checking the configuration. An IP allowlist is an emergency measure, not a long-term fix.
CISA, FBI, HHS, USDA, DOT (US)	5 Nov	Do not expose control panels to the internet. Put OT devices on a dedicated VLAN. Change default passwords and use phishing-resistant MFA. Patch and retire end-of-life devices. Allowlist who can change settings. Keep offline backups. Log, and alert on setpoint deviations.
SingCERT (Singapore)	6 Nov	Inventory internet-reachable OT interfaces. Use VPN with MFA and IP allowlists. Patch. Segment OT from IT and monitor remote access and configuration changes. Keep tested continuity plans, including manual control.
National Cybersecurity Office (Japan)	9 Nov	Check whether your own and your contractors’ equipment is reachable from outside. Change default passwords and review access rights. Make sure a temperature anomaly alerts the person on site.
DITP (Thailand)	5-6 Nov	For exporters: IoT temperature sensors, data loggers, and temperature records through transport. Consider transport insurance that covers cyberattack losses.

It is not only about supermarkets

These notices are written about refrigeration, but the pattern is wider. SingCERT lists energy and utilities, water, manufacturing, building management and HVAC, cold storage and logistics, and healthcare facility management. A Field Effect analysis adds that the same remote-management model runs HVAC, power distribution, pumps and data-centre cooling, and that a controller installed by a contractor is often missing from the company’s IT asset inventory.

For a factory, a cold store or a food exporter, the question is simple: which equipment can a third party change from outside, and would anyone notice?

Eight questions for your contractor and your IT team

Our first post gave six quick checks. These go one level deeper.

1. Whose controllers are they, and where are they listed? Contractor-installed controllers are often missing from the IT inventory. Ask for model, firmware, site, management address and support owner for every one.
2. Does any management page answer on a public IP address? Ask the contractor in writing, and test your own address ranges. This is the first thing CERT-FR and CISA ask you to remove.
3. Are there shared or stale contractor logins? Forescout recommends named identities and multi-factor sign-in, and removing credentials for people who no longer work with you.
4. Can a read-only account change a defrost schedule? Forescout suggests limiting access by function, so the person who checks alarms cannot rewrite settings by default.
5. Is there a setpoint limit, and an alert when it is breached? CISA asks for reasonable limits on downstream devices and alerts on deviations. Because attackers can also blind you to the real reading, keep an independent temperature sensor with its own alert path. Forescout says access controls should be backed by engineering safeguards and independent monitoring.
6. Are remote sessions logged, and can you match them to setpoint changes? Forescout advises logging remote sessions and correlating them with setpoint and defrost changes. Reliable timestamps make an overnight change easier to reconstruct.
7. What does your incident plan say about the physical process? Forescout warns that automatically isolating a controller can itself cause harm. SingCERT asks for tested plans that include isolation and manual-control fallback. Decide in advance who may switch to manual and where stock goes.
8. What do your contracts and insurance cover? Thailand’s Prime Minister asked the Commerce Ministry to review credit terms and trade insurance, and DITP suggests transport insurance that covers cyber losses. Ask your broker what a remotely caused spoilage claim looks like.

Where monitoring helps, and where it does not

Configuration comes first: closing exposure, fixing logins, setting limits. Monitoring then shortens the time between something going wrong and someone knowing.

simpliSOC is a Wazuh-based monitoring stack. It takes in firewall, VPN, server and endpoint logs, applies more than 50 custom detection rules, and alerts when a log source goes quiet. That suits questions 3 and 6 on the access side: who connected through the VPN, from where, and when.

The limits are the same as before. The simpliSOC page does not describe OT or IoT support, and most refrigeration controllers cannot run a monitoring agent. Pulling controller logs or temperature readings into monitoring is something we would scope for your site, not a built-in feature. Monitoring reduces the time to notice. It does not prevent a specific attack.

Talk to us

Tell us what equipment your contractors can reach remotely and how they connect. We will tell you what we would check first and what we would monitor. A short scoping call is enough to start.

• Email: hello@simplico.net
• LINE: iiitum1984
• Phone: (+66) 97496 6397

For network design and integration questions beyond monitoring, see our system design and consulting service.

FAQ

Has anyone proven who was behind it?
No. French prosecutors allege a group tied to Iran’s Revolutionary Guard Corps, based on methodology, language and IP addresses. These are accusations in an ongoing investigation, and no individual has been named. The FBI’s own warning describes the activity in general terms and does not attribute the French attacks to anyone.

Were there attacks in Thailand or Japan?
In the reports we reviewed, no. Thailand’s Prime Minister described the overseas reports as unverified and asked agencies to monitor the threat. Japan’s notice asks operators to check their equipment. Both are precautions, not incident reports.

We cannot cut remote access, our contractor needs it. What now?
You do not have to. CERT-FR’s route is to remove public exposure and reconnect through a secure VPN after checking the configuration, with an IP allowlist only as a stopgap. CISA adds MFA, a separate network for OT devices, and limits on who can change settings.

Does this apply to us if we only store food in a rented cold room?
Possibly. Ask the operator who manages the controllers, how they are reached, and what alerts you get. DITP’s advice to exporters (sensors, data loggers, temperature records) is worth following either way.

Sources

• Iran behind France grocery store refrigerator and freezer hacks, prosecutor says, CBS News
• US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems, CISA / FBI / HHS / USDA / DOT, 5 Nov 2026 (PDF)
• Advisory on Cyberattacks Targeting Remotely Accessible OT Control Systems, SingCERT AD-2026-014
• Unplug your smart fridges: French supermarkets warned after cyberattack, CSO Online
• In Cold Chain, Open Control, Forescout Research – Vedere Labs
• Supermarkets Across Europe Report New Suspected Freezer Hack, Insurance Journal, 2 Nov 2026
• Security challenges of connected operational technology, Field Effect
• DITP tracks export risks after reported freezer hacks at about 700 French sites, The Nation Thailand
• Anutin orders cyber threat checks to protect Thailand’s food supply chains, Pattaya Mail
• 冷蔵庫へのサイバー攻撃に日本政府が注意喚起, Business+IT