--- title: "Freezers at 50 degrees: the price of a login on the open internet" summary: "Attacks on cooling controls hit shops in Switzerland and ten EU countries. The way in: open admin pages and factory passwords. What to check now." author: "Samuel Krauss" author_title: "Founder" publisher: "Elchi Studios" published: 2026-11-09 updated: 2026-11-09 url: https://elchi.dev/en/journal/freezers-at-50-degrees-the-price-of-an-open-login language: en tags: ["security","switzerland","passwords","infrastructure"] words: 1381 --- # Freezers at 50 degrees: the price of a login on the open internet *By Samuel Krauss, Founder. Published 9 November 2026.* > Attacks on cooling controls hit shops in Switzerland and ten EU countries. The way in: open admin pages and factory passwords. What to check now. In early November, the owner of a butcher's shop in Köniz near Bern found the temperature in its freezer at 50 to 70 degrees. Someone had changed the settings of its refrigeration control from outside. Three Volg shops were hit as well. It is the Swiss chapter of a wave of attacks on supermarket cooling systems that started in France in October and reached nine more European countries on 2 November. The way in was not sophisticated: management interfaces that anybody on the internet could reach, some of them still protected by the password they left the factory with. ## What happened On 12 October 2026, CERT-FR, the French government's computer emergency team run by ANSSI, published an alert about "many compromises" of remote controllers for refrigeration installations. It names four product lines: Danfoss AK-SC and AK-SM, Copeland xweb and Dixell xweb. The alert was extended on 13 October with further devices and its recommendations were updated on 16 October. Its last line of warning still stands: attack campaigns against these devices are "probably still ongoing". On 21 October, ANSSI's director general Vincent Strubel described the French attacks to the Senate's foreign affairs and defence committee. According to Génération NT's report of the hearing, the attackers exploited equipment directly exposed on the web and weak passwords, and ANSSI has no legal power to force retailers to secure their systems. Overnight into Monday 2 November, the second wave came. Euronews counted nine countries: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. Carrefour reported about 15 of its more than 700 stores in Belgium, Musgrave 13 SuperValu shops in Ireland, Intermarché 7 stores in Portugal, Coop 6 of about 800 in Sweden. In Belgium, cooling units were switched into defrost mode. The EU's agriculture commissioner, Christophe Hansen, called the incidents "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it". Nobody has claimed them, and Belgium's Centre for Cybersecurity said who is behind them may never be determined. What the industry said about the way in is plain. A Danfoss spokesperson told the Dutch broadcaster NOS that the affected systems in the Netherlands were not on a secure network and still used default passwords. Danfoss said most of the units hit in France were older models it no longer updates, the AK-SM 800 and the AK-SC 355. In Belgium, the refrigeration trade association Sabcobel said the attackers got into individual supermarkets' systems, not into the systems of the contractors who maintain them. In Switzerland, Lüthi's Fleischwaren in Köniz wrote on its website that a targeted cyberattack had manipulated the electronic control of its refrigeration and deep-freeze units. The owner told SRF the meat was "as if cooked" and the price labels had melted. The shop disconnected the systems from the network, closed, and plans to reopen on 20 November if the cooling holds. Volg confirmed changed parameters in the cooling units of three shops and said it had taken and reinforced measures. The cantonal police of Bern were informed and have started investigating, although no formal complaint had been filed by 6 November. On 9 November, the current incidents page of the Federal Office for Cyber Security (BACS) did not yet list the refrigeration attacks. ## What it means for a company or an administration The lesson is not about fridges. A cooling controller with a web page and a password is the same thing as a building's heating control, a door access system, a solar inverter, a network camera or the admin page of a printer. Often a contractor set it up once, so that someone could look in from outside, and then nobody thought about it again, because it worked. CERT-FR's sentence applies to all of them: exposing a management interface on the internet "is contrary to good practice". Three things made the attacks easy, and each of them is common. **The interface was reachable by anyone.** Remote maintenance is useful. It does not need the login page to be open to the whole internet. A connection through a VPN, or a path the contractor opens only when a technician needs it, gives the same service to far fewer people. **The password was the factory's.** A default password is printed in a manual that anyone can download. Against an interface on the open internet, it is not a lock. Nor is a shared account that every technician of the contractor has used for years. **The device was out of support.** Danfoss says it no longer updates the models most affected in France. CERT-FR warns that keeping a device without security fixes exposed to the internet means "a very high probability of compromise", and that a factory reset alone is not enough: the device stays vulnerable and will "certainly" be compromised again. For a municipality, the list is longer than for a shop: the school's heating, the water supply's telemetry, the sports hall's ventilation. For a company, the question is who installed what, and who still has a way in. No personal data has to be involved for an attack like this to close a business: the shop in Köniz expects to stay shut until at least 20 November. ## How it affects Elchi Studios and its clients We do not build, install or maintain refrigeration, heating or building controls. Nothing here is a product for them, and EAuth is no gateway for a controller's built-in web page: it is an OpenID Connect provider, and it signs people in to web applications that are built to use it. What we can say is how we treat our own doors, because the principle is the same. In EAuth, every place that takes a credential is counted twice, by the address a request comes from and by the account it names: five wrong passwords per account from one address in 15 minutes, twenty per account from anywhere in the same time. Every attempt is counted before it is checked, and if the store that counts them does not answer, sign-in refuses instead of letting everything through. The details are in our post on [the move to eauth.me](https://elchi.dev/en/journal/eauth-moves-to-eauth-me). Every application that signs in through EAuth also offers [passkeys beside the password](https://elchi.dev/en/journal/passkeys-beside-passwords). A passkey is bound to eauth.me, and its private half never leaves the person's device: there is no shared secret that could be printed in a manual, guessed or leaked from our database. Our own developer console and dashboard sign in through the same page. For clients who run their own web applications, the attacks are a reason to look at their admin pages with the same eyes: the content management login of a website, an internal tool, a test system left online after a project. If one of them still runs on a password alone, a limit on guesses and a second factor or a passkey are the minimum. ## What to check this week 1. **List what can be reached from outside.** Every device and every admin page with a public address: cooling, heating, ventilation, access control, cameras, inverters, printers, routers. If you do not know, ask whoever runs your network for the list. 2. **Ask your contractors how they get in.** For each remote access: which path, which account, who holds the password, and whether it can be opened only when needed. 3. **Close the open interfaces.** Access through a VPN or a protected network. Filtering by the contractor's IP addresses is acceptable as an emergency step, CERT-FR says, but not as a permanent one. 4. **Change every default password.** One account per person where the device allows it, and the manufacturer's hardening settings where they exist. For Danfoss controllers, CERT-FR names the security level Strict. 5. **Find the devices without updates.** A controller that its maker no longer updates should not be reachable from the internet at all. Plan its replacement. 6. **Check the configuration and the alarms.** CERT-FR advises reviewing the whole configuration, defrost schedules included. An alarm should reach a person when a freezer warms up at two in the morning. 7. **Read your insurance terms first.** CERT-FR advises checking them before cutting the data link to the refrigeration contractor. 8. **If a device was hit, a reset is not the end.** Disconnect it, restore it, reconfigure it, update it, and only then connect it again, by the closed path. ## Sources 1. [Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (CERTFR-2026-ALE-012)](https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012), CERT-FR, ANSSI, read 2026-11-09 2. [Aktuelle Vorfälle](https://www.bacs.admin.ch/de/aktuelle-vorfaelle), Bundesamt für Cybersicherheit BACS, read 2026-11-09 3. [Cyberattaque des frigos de supermarchés : l'Anssi pointe des défauts de sécurisation élémentaires](https://www.generation-nt.com/actualites/cyberattaque-frigos-supermarches-anssi-defauts-2083209), Génération NT, read 2026-11-09 4. [New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food](https://thehackernews.com/2026/11/second-wave-of-cyberattacks-hits.html), The Hacker News, read 2026-11-09 5. [Which countries in Europe have been hit by supermarket fridge cyber incidents?](https://www.euronews.com/2026/11/03/which-countries-in-europe-have-been-hit-by-supermarket-fridge-cyber-incidents), Euronews, read 2026-11-09 6. [Kühlanlage manipuliert: Berner Metzgerei Opfer von Hackerangriff, auch Volg betroffen](https://www.srf.ch/news/schweiz/kuehlanlage-manipuliert-berner-metzgerei-opfer-von-hackerangriff-auch-volg-betroffen), SRF, read 2026-11-09 7. [Cyberkriminelle verderben Fleischvorrat einer Berner Metzgerei](https://www.inside-it.ch/cyberkriminelle-verderben-fleischvorrat-einer-berner-metzgerei-20261106), Inside IT, read 2026-11-09 8. [First known cyberattack on a refrigeration system in Switzerland](https://www.swissinfo.ch/eng/various/first-known-cyberattack-on-a-refrigeration-system-in-switzerland/92333384), SWI swissinfo.ch, read 2026-11-09