Hackers cranked Europe's freezers to 50C. Australia got the same warning

France has named Iran as the culprit. Overnight, Foreign Minister Jean-Noël Barrot accused Tehran of running the attacks and called for European sanctions. On November 2, freezers in dozens of stores across at least 11 countries were cranked up remotely, some to 50 degrees, hitting Carrefour and Ikea in Belgium, ICA and Coop in Sweden, Kesko in Finland and SuperValu in Ireland — three weeks after hackers did the same to hundreds of French supermarkets.

The intruders didn't need to be clever. Vincent Strubel, head of France's cyber agency ANSSI, told the French Senate the controllers sat on the open internet with no firewall and admin screens guarded by weak passwords. Danfoss, the Danish maker of the gear, said the Dutch systems hit were not on a secure network and still used factory passwords, while Britain's National Cyber Security Centre operations director Paul Chichester said one company's defaults were printed in its manuals. Claroty, a US security firm, counted at least 1000 Danfoss store systems exposed online worldwide on the day of the second wave, though it couldn't say how many sit in Australia. Danfoss said most equipment targeted was old and no longer getting security updates; Belgium's refrigeration industry group Sabcobel says the damage would have been far worse had members not started patching after October 12.

These controllers don't just chill peas. The same small computers run cold rooms in hospitals, medicine warehouses and data centres. France's national blood service said hackers reached the cold storage of at least three blood banks last week — the blood was moved and no patients were harmed.

Nobody has claimed the attacks or asked for money. Tom Hegel, a lead researcher at US security firm SentinelOne, says Russian-aligned groups are credible suspects because they have hit similar systems before, but calls that “only context, not the missing evidentiary link”. Romania's cyber security director, Dan Cîmpean, dismissed the attacks as “semi-amateurish”. Samuli Bergström of Finland's WithSecure suspects it is “less about food than about opportunity”, noting retailers' defences are weaker than banks' or energy companies' and that “if the security is poor, someone will find it”.

Breaking in is getting cheap. In August, Claroty published details of security holes in controllers made by Danfoss and US firm Copeland; a day after the French attack, its researchers showed an AI tool could build a working attack on a test device in about 28 minutes, for US$6 (about $9). Luc De Laet, who runs a small Belgian butcher chain, told Reuters he lost about €15,000 ($24,000) of meat in a single night — more than 2500 times what that test cost.

Australia has reported no attacks yet. Woolworths is understood to have no store refrigeration controllers connected to outside networks, and Aldi is similarly understood not to use outside networks to manage or maintain its refrigeration; Coles did not answer questions. Two days after the French strike, the Australian Signals Directorate issued an alert to businesses running refrigeration and cooling systems. Critical infrastructure laws cover the supply networks of Woolworths, Coles and Aldi but don't explicitly cover the freezer aisle, and Home Affairs would not say whether it has spoken to any supermarket. Bergström's test: “If a failure can harm the public within days, it belongs in that category.”