The New York Times reported on Nov. 2 that investigators were looking into suspected cyberattacks at commissaries on military installations based in the United States over the summer similar to attacks on refrigeration systems in European supermarkets in October. There were also reports Monday that retailers again experienced refrigeration problems across Europe.
Typically, the attackers turn up the temperature of the refrigeration systems in the middle of the night, causing the freezers to defrost and then spoil the food. Attacks on the food supply have followed cyber incidents earlier this year targeting water utilities.
The first wave of the most recent refrigerator attacks happened at French supermarkets in October, while the attacks in early November were reported in many other European countries, including Belgium, Estonia, Ireland, Luxembourg, the Netherlands, and Sweden.
The U.S. military was reportedly investigating multiple incidents that happened domestically in August, including suspected attacks at Fort Huachuca in Arizona, Fort Irwin in California, and Naval Station Newport in Rhode Island.
“Although investigators have not established a connection, successful attacks against military food supplies could directly affect logistics and operational readiness,” said Louis Eichenbaum, Federal CTO at ColorTokens. “While the geographic scope raises questions about coordinated or nation-state activity, attribution remains uncertain. Regardless of who’s responsible, the potential for these techniques to be used in a broader campaign against critical infrastructure should concern us all.”
Eichenbaum said there’s a clear lesson here: patching alone is not enough. Eichenbaum pointed out that many OT environments rely on legacy controllers that cannot be easily updated or replaced. Organizations must now identify exposed assets, eliminate unnecessary internet access, enforce strong authentication, and implement microsegmentation to restrict unauthorized communications and contain compromised systems.
“Cybersecurity must move beyond simply preventing intrusions to ensuring that essential services continue operating during an attack,” said Eichenbaum. “That requires comprehensive asset visibility, zero-trust access controls, microsegmentation, continuous monitoring, and tested recovery procedures.
Waseem Ahmed, head of engineering at Secure.com, said if these are cyberattacks as suspected, the common thread looks like remotely reachable controllers, not a fridge fault. Ahmed said French authorities named specific refrigeration controllers, and researchers found thousands reachable from the internet, and one expert said many ran default passwords.
Ahmed said there’s several checks that those dependent on refrigeration systems need to do before the weekend: List every controller your stores run, with model and firmware. Pull the management screens off the public internet and put remote access behind a VPN. Change every shared password, including the ones your refrigeration contractor uses. And finally, add temperature alarms that don't depend on the controller being alarmed because attackers in France reportedly lengthened defrost cycles and delayed the warnings.
“Food safety now sits on gear that nobody on the security team owns,” said Ahmed. “That gap is the real story, and it’s fixable.”
Kieran Human, lead cybersecurity engineer at ThreatLocker, added that refrigeration systems connected to the internet can create cybersecurity risks if not properly secured, as demonstrated by these attacks in Europe where hackers gained remote access to exposed OT systems.
Human said organizations should isolate refrigeration systems on a dedicated network, enforce strict firewall rules, use IP allowlisting and strong passwords, and require VPN access with multi-factor authentication.
“Tools like Shodan can also help identify refrigeration systems and other OT devices that may be unintentionally exposed to the internet,” said Human.
Anthony Pillitiere, co-founder of Horizon3, said if millions in reported losses and clear warnings from security experts still weren’t enough to prompt organizations to secure these systems, then they either knowingly accepted the risk or assumed they weren’t exposed. Unfortunately, as this incident shows, Pillitiere said those assumptions are what get people in the news.
“Whether these attacks are nation-state, hacktivists, or some bored 12-year-old is yet to be seen,” said Pillitiere. “The strategic outcome for a nation-state seems too far removed, and hacktivists announce themselves and their cause typically.”
