Cooling Under Attack: Round Two

Three weeks ago we covered French supermarkets where someone remotely switched the freezers into defrost mode. It could have looked like a one-off.

It wasn’t. On the night of Monday, November 2, it happened again, this time in stores across several European countries. According to BleepingComputer, more than 115 stores in six countries were hit, though the exact figures vary between outlets. The same night, the refrigeration units of the French blood service were also affected.

Hi, my name is Patrik Žák, and welcome to Security Sunday.

I won’t repeat what I already covered in a previous episode. Instead, we’ll look at what’s new since then, why this attack is so easy to repeat, and what NÚKIB, the Czech National Cyber and Information Security Agency, said about it this week.

The Second Wave

According to The Record, more than 50 stores were hit in Belgium, with more in Sweden, Ireland, Estonia, the Netherlands and Luxembourg. The attack resembles the October one in France. The attackers changed temperature or defrost settings, and the goods started to spoil.

Belgian refrigeration installer Sabcobel said that for the equipment it manages, a software update isn’t enough and the fix requires physical intervention on site.

The Blood Bank

On November 3, the French blood service EFS confirmed that someone had changed the temperature and defrost settings of refrigeration units at three of its facilities. EFS says it was not the direct target. The incident hit its refrigeration equipment supplier, which the media identify as Coolworld, and Coolworld has confirmed the incident.

It ended well. According to EFS, alarms caught the change, and technicians either repaired the equipment or moved the products elsewhere. EFS says no blood products were lost, and neither blood collection nor supply to hospitals was interrupted.

One thing caught my attention. Nothing in the public record suggests EFS neglected anything. It was enough that the supplier had remote access to its freezers. Coolworld also said the vulnerability described in the media affects a third-party component that it doesn’t control itself. So the chain can run from a blood bank, through its refrigeration supplier, all the way to that supplier’s software vendor.

Who Claimed It

In early November, two pro-Russian groups, NoName057(16) and Z-Pentest, claimed responsibility for the attacks. According to Danish broadcaster DR, they posted a video on Telegram titled “Operation Chronicle: Danfoss,” claiming they had gained access to Danfoss and Dixell XWEB monitoring systems. According to RetailDetail, NoName057(16) also published an alleged data sample linked to Danfoss. However, Swedish broadcaster SVT found that most of the corporate email addresses it checked from the sample had already appeared in older leaks. So the sample doesn’t prove who is behind the attacks.

NoName057(16) has shown up in the Czech Republic before. It’s a pro-Russian hacktivist group known mainly for DDoS attacks that flood websites with traffic. In August 2023, it caused online banking outages for customers of several major Czech banks. In July 2025, Czech police said they had recorded roughly 850 successful attacks on 230 entities in the country since 2022, and attributed most of them to this group. Also in July 2025, an international operation called Eastwood took action against the group, with the Czech police taking part. Z-Pentest, on the other hand, focuses on industrial control systems.

No one has independently verified the groups’ claims, though. Danfoss said it has no indication of a successful attack on its internal IT infrastructure and cannot verify the published material. The Danish Agency for Societal Security neither confirmed nor ruled out the groups’ involvement.

Analysts at SentinelLabs treat the pro-Russian groups as a credible lead. At the same time, they write that the available evidence doesn’t yet establish who is responsible, or even whether this is a single campaign. Tom Hegel of SentinelOne put it well in an interview with Computer Weekly: “an attacker who logs into an exposed control panel leaves almost no trace. From the defender’s point of view, a teenager and an organized group would look nearly identical.”

That’s why the Belgian Centre for Cybersecurity’s statement also holds: “the perpetrators may never be identified.” And it isn’t yet known whether the same people are behind both waves.

For defenders, the takeaway is simple. You don’t need to know who did it. Whether it’s a pro-Russian group or someone imitating one, both attacks come through the same door: devices exposed to the internet.

Why Can the Attack Be Repeated?

The answer probably won’t surprise you. Refrigeration controllers are exposed to the internet and have known flaws.

NÚKIB specifically names Danfoss AK-SM and AK-SC devices and Copeland/Dixell XWEB systems. For Danfoss, one of the flaws is CVE-2025–41450, which allows authentication bypass and has been public since spring 2025. For Copeland, it’s CVE-2026–21718, again an authentication bypass. Add default or weak passwords on top of that.

According to The Record, some older Danfoss systems are no longer supported by the manufacturer.

So we have a device that runs for years, that nobody thinks of as a computer, that sits on the internet for convenient management, and that nobody updates. From an attacker’s point of view, it’s the ideal target.

The Authorities Respond

On Thursday, November 5, the US agencies CISA and FBI, together with other agencies, issued an advisory for operators of industrial refrigeration and cold chain monitoring. They describe attacks worldwide and name healthcare, food, transportation and chemicals among the affected sectors.

NÚKIB issued its own notice the same day.

A Look at the Czech Internet

So how does the Czech internet look? Censys and Shodan data show several of these refrigeration devices. And not just them. I have no doubt some of them are honeypots, but the number of industrial systems reachable from the internet is frightening, and not only in the Czech Republic. That makes the potential impact of an attack on these devices even more frightening.

Key Takeaways

Find out whether any of your controllers are reachable from the internet. If they are, remove direct access and put them behind a VPN.
Replace default and weak passwords, and check the firmware against the manufacturer’s recommendations.
Ask your supplier how they connect to your devices and who else has access. The blood bank case shows this matters as much as your own network.

Summary

Let’s sum it up. Three weeks later, the attacks on refrigeration came back, this time in several European countries, and even hit a blood bank’s equipment through its supplier. The perpetrator is unknown. The attackers are helped by internet-exposed devices, flaws that have been known for years, and weak passwords. As of November 5, NÚKIB had not recorded any incident in the Czech Republic.

And the bottom line? A freezer today is a computer. And if it’s on the internet, someone will find it sooner or later.

If you want to know which of your devices are visible from the internet and could be exploited, get in touch at team@sysnetshield.com. That’s exactly what we look for during an external penetration test.

Subscribe so you don’t miss the next episode, and see you next Sunday.