Not only the big chains

The headlines talk about Delhaize and Carrefour. But the attack also hit much smaller businesses:

• Butcher shops. Several butchers saw the temperature in their fridges and freezers suddenly go up, among them the Antwerp butcher chain De Laet & Van Haver (BX1). For a butcher, the cold room is the heart of the business. Warm meat cannot be sold, so the shop was simply out of action. But not for long, this company has the right spirit.
• Independent store owners. About five independent Spar owners had the same problem (VRT NWS), as did many Shop & Go and Proxy franchise stores.

This matters. A big chain can absorb a bad night. For a family butcher or a small franchise owner, a few thousand euros of lost stock hurts a lot more. They also have no security team, no OT specialist and often no idea that their freezer is reachable from the internet. They fully depend on their installer. So this is not a "big retail" problem. Every business with a connected cooling system is a possible target, from a hypermarket to the butcher around the corner.

Not only food: blood and plasma

In the same night of 1 to 2 November, the attack reached even further. In France, hackers targeted Coolworld, a refrigeration service provider for the French national blood service EFS (Établissement Français du Sang). The settings of freezers with plasma for transfusions were reportedly changed from about -30 °C to 110 °C (GBHackers).

An on-call technician noticed the rising temperatures, and according to the French Health Ministry, technicians stepped in on time. There are no reports of lost plasma or harmed patients. It is also not proven that this attack is technically linked to the supermarket attacks, and no device type has been named.

But it shows how far this goes. A supermarket throws away food. A blood service that loses its plasma reserves loses something that saves lives and cannot be replaced quickly. Cold storage is critical infrastructure: for food, medicines, vaccines and blood. And the weak spot is the same everywhere: a controller with remote access that nobody really protects.

Angle 1: For the installer, remote access is cheap and easy

Most supermarkets do not manage their own refrigeration. A specialised installer does it for them. And for an installer, remote access is a dream:

• No travel. No car, no mileage, no hours lost in traffic for every small change.
• Fast service. An alarm at night? Log in from home and fix the setting.
• Many customers, one desk. One technician can follow hundreds of stores from one screen.
• Patches from a distance. In theory, updates can be installed without visiting the store.

So the installer opens the management interface to the internet, often with a simple login. It works, it is cheap, and for years nothing went wrong. Why change it? That is the trap. Remote access that is easy for the installer, is also easy for a hacker. The same web page that saves a trip to the store, can be found by anyone with Shodan in a few minutes. Warning: Using Shodan to search for exposed devices is legal, but logging in to or exploiting systems you do not own, or have no permission to test, is a crime.

Angle 2: For the retailer: lower cost and fewer parties

For the retailer, remote maintenance also looks like a good deal. Fewer technician visits means a lower maintenance bill. And refrigeration is "facility", not "IT". It rarely shows up on the radar of the security team. But the bigger problem is ownership. Look at who is involved in one freezer in one store:

• The vendor builds the controller and publishes security advisories.
• The installer sets it up, adds remote monitoring and maintains it.
• The chain sets the brand, the rules and the IT policies.
• The store owner, often an independent franchise owner, pays the bills and owns the equipment.

As a colleague put it: there are a few too many parties who count on the other party, which is typical for supply chain security problems. The vendor says it sent the warnings, but those went to the installers, not to the stores. The chain thinks the installer handles it. The store owner thinks the chain handles it. And in the end, nobody does. It is no surprise that many of the Belgian stores hit were smaller convenience and franchise stores. That is exactly where this chain of responsibility is the longest.

Angle 3: Urgency versus thoroughness

After the French attack, the sector did start to act. In an interview, a company leader (actually the CEO of industrial and retail cooling installer Sabcobel) explained that they did the updates "as fast as possible". A colleague listened to that interview and made a sharp point. There was no real sense of urgency. The work was done thoroughly, but too thoroughly, so some stores were not helped in time. There is a big difference between two actions:

• Patching takes time. A technician must plan it, follow an upgrade path, test it, and sometimes visit the store. For old end-of-life devices, there is no patch at all.
• Disconnecting takes minutes. Switch off remote access, or block the device from the internet, until the patch is done.

With a real sense of urgency, you do the second one first, as a temporary measure. It is hard to imagine that internet access for a freezer controller is critical. The cooling works fine without it. Some French stores restarted their refrigeration and simply kept it offline. And one more question remains open: why did the sector only move after the French hack? The vulnerabilities were known and published long before. Danfoss released fixes in 2025. The American agency CISA warned about it in May 2025. That part of the story, nobody explains.

Angle 4: Convenience has a price

Remote access without control saves money. Until the night it does not.

• In France, losses ran into tens of millions of euros in a single day, with fires in some stores.
• In Belgium, one store alone threw away an estimated 60,000 euros of food.
• Add the lost sales, the angry customers, the damage to the brand and the hours of staff cleaning out freezers.

And then there is the food itself. Tons of perfectly good food went to waste, in a time when we talk a lot about sustainability. Compare that with the cost of a secure remote access solution, a firmware update or a short security check.

Throwing away food costs a lot more than finding a good security solution. Security is not a cost. Bad security is. As we say at Howest University of Applied Sciences (but we are slightly biased): knowledge and awareness are golden, make sure that not only your IT people but also your operational technology (OT) people have a good understanding of OT security.

Angle 5: A patch is not a solution

So the installers now install the patches, and the problem is solved? Not really. As a colleague put it: installing the patch and seeing that as the solution is short-sighted. Then you are simply waiting for the next vulnerability.

A device that was not designed to be secure, does not become secure with a few extra developers. Think about it: companies like Cisco, Fortinet, Citrix and Palo Alto build edge devices whose only job is security. Even they keep struggling with serious vulnerabilities. A refrigeration manufacturer will certainly not do better.

That is why the real fix is not on the device, but around it. Keep these systems off the internet, put them behind controlled access, and treat every OT device as something that will have a new vulnerability one day (assume breach).

This is also exactly what the European Cyber Resilience Act (CRA) wants to change: products that are secure by design, not secured afterwards with patches.

Angle 6: Who is behind it, and why?

For weeks, there was a strange element in this story. Almost nothing was known about who carried out these attacks. Nobody claimed them, in France or in Belgium.

And there was no clear money in it. No ransom was asked, no data was stolen to sell. That is not how ordinary cybercriminals work. So the question came up in our team: is this the work of a nation-state, or part of the hybrid harassment that European countries face more and more?

Update: the picture is now much clearer. In articles in HLN and VRT NWS, Xavier Bellekens, CEO of the Scottish cybersecurity company Lupovis, said that a Russian hacker community is behind the freezer hacks. His team discovered this with honeypots: fake systems that lure attackers in and record what they do. Shortly after, two pro-Russian hacker groups, NoName057(16) and Z-Pentest Alliance, claimed responsibility for the attacks.

So our team's question gets a likely answer: this is not about money, but about disruption. A claim is not yet official proof, and the investigations are still running. But the lesson is already clear. For attackers like these, food and water supply, healthcare, energy and logistics, in short our critical infrastructure, are attractive targets. And OT systems with open remote access are the easiest way in.