Cold chain cyberattacks: how to prevent them with independent monitoring

3 November 2026 by

Iván Bermejo

On the night of 11 to 12 October 2026, hundreds of French supermarkets were faced with an unusual problem: their cold rooms and freezers were warming up on their own. Someone had taken remote control of the refrigeration equipment and switched it to defrost mode, pushing temperatures up to 50°C. Intermarché, Carrefour, Monoprix, Coopérative U and E.Leclerc had to throw away tonnes of product, some units caught fire, and the chairman of Les Mousquetaires, the group that owns Intermarché, went as far as putting the losses at tens of millions of euros.

France was not the only country affected. According to cybersecurity firm Sekoia, cited by Reuters, equipment was also hit in Spain, Portugal, Poland, Germany and Belgium, although no details of those cases have been released. Then, on the night of 1 to 2 November, a second wave hit supermarkets in Belgium, Sweden, Ireland and Estonia (Delhaize, Carrefour, Spar, Coop, ICA and SuperValu, among others) using the same method. Nobody has claimed responsibility and, for now, the attacks have not been attributed; the EU Agriculture Commissioner even described them as a deliberate attempt to disrupt the food supply chain. The cold chain, the silent backbone of any food business, has become a target. Quality and operations managers across Europe are now asking the same question: can it be prevented?

What happened

The cause is less sophisticated than it looks. Supermarkets run their refrigeration equipment through small industrial computers called refrigeration controllers, which manage setpoints, alarms and defrost cycles. The compromised units were Danfoss AK-SM and AK-SC series controllers, many of them older models that no longer receive security updates: the AK-SM 800 was discontinued in 2021 and the AK-SC 355 in 2016. The day after the first attack, CERT-FR, the French government's incident response team, extended the list to include Copeland and Dixell supervisors.

The attacker did not need to crack any exotic digital lock. According to CERT-FR, the problem was that the controllers' management interface was directly reachable from the internet. In other words, the panel used to set temperatures was open to the world so that maintenance contractors could connect remotely. Once inside, all it took was a legitimate command from the equipment itself: start the defrost cycle and raise the temperature setpoint.

Put another way, there was no mysterious software flaw here. It was a textbook industrial security problem (what the industry calls OT, or operational technology): critical equipment exposed to the internet, not segmented from the main network and left without security maintenance. Unfortunately, it is a very common combination.

The blind spot of relying on a single system

One fact sums these attacks up: in most stores, nobody noticed until it was too late. The dominant pattern was late detection and, in quite a few cases, no automatic warning of any kind until staff physically came across the problem. In some units the temperature had been rising for around six hours before employees found out. The same scene played out again and again: someone opening a freezer in the morning and being hit by a blast of warm air. In many stores it was the heat and the smell that gave it away, not an alert.

Some caution is needed here, as the full technical details are not yet known. It is unclear whether the affected units had a remote alert system that failed or that the attackers managed to disable or bypass, or whether no such alert existed at all. What is confirmed is the outcome: in many stores the warning did not arrive in time, and the problem was discovered on site, hours later.

Beyond this specific case, there is a structural weakness worth pointing out: relying on a single source of truth for temperature. When control, logging and alarms all sit within the same system, anything that affects that system (an attack, but also a technical fault, a probe failure or a configuration error) can leave the business without reliable monitoring. And if nobody is keeping an independent eye on things, the problem can go unnoticed until it is too late.

In food safety, this is doubly serious. You lose the product, and you also lose the ability to prove what happened and when. Traceability, which is what regulations require and what protects the business during an inspection or a claim, is built precisely on reliable, independent records.

How to prevent it

Real protection is built in layers, and it helps to distinguish between two levels.

The first level is basic security hygiene on the refrigeration equipment itself, following the recommendations CERT-FR and Danfoss have published since the attacks:

Take management interfaces off the internet. No controller should be directly reachable from the public network.
Only allow remote access through a secure VPN or a protected network, never with the panel exposed.
Segment the refrigeration network and keep it separate from the main network, behind a firewall.
Change default or weak passwords, a basic flaw that is still common.
Update firmware and replace older equipment that no longer receives patches. Restarting a vulnerable unit is not enough if it is still reachable.

The second level is what makes the difference between suffering an attack blind and detecting it in time: temperature monitoring that is independent of the refrigeration system. That means monitoring that shares no hardware, network or credentials with the controller, so that whatever happens to the controller, something is still measuring the real temperature and raising the alarm. That is exactly the role Nebula ColdChain fulfils.

Where Nebula ColdChain fits in

Nebula ColdChain is Celestia TST's continuous cold chain monitoring solution. Instead of trusting what the fridge controller says, Nebula ColdChain deploys its own temperature probes, which use LoRaWAN wireless communication and are completely separate from the refrigeration system. They measure the actual product temperature and send it to a dedicated platform, outside the equipment that runs the refrigeration. In practice, this means:

If a controller is tampered with and starts warming up, the Nebula probes still pick it up, because they do not depend on it. The alarm goes off even if the compromised equipment claims everything is fine. And because the alarm is based on a sustained threshold, it can tell the brief spike of a normal defrost apart from a rise that persists over time, like the ones in these attacks.
Alerts reach the people in charge instantly (email, SMS, app), so they can act before the goods are lost, not after.
You keep an independent, tamper-proof temperature record, with EN 12830-compliant traceability that stands up to audits, inspections and claims.

That independence can be extended to the network as well. The gateway that collects data from the LoRaWAN probes does not need to connect to the store's IT network: it can use a dedicated 4G line reserved for monitoring. The whole chain (probe, gateway and cloud platform) then runs over its own channel, completely separate from the site's IT and OT networks.

This is the highest level of segmentation available: temperature monitoring is, in practice, isolated from the supermarket's network. An attacker who compromises the refrigeration controllers or the store's internal network, as happened in France and in the second wave, has no route to the monitoring system, because the two do not even share a network. This is true out-of-band monitoring: it watches the cold chain from the outside, without touching infrastructure that could be compromised.

It is worth being clear about the scope. Nebula ColdChain is not a firewall and does not replace the controller's cybersecurity measures. It does not stop anyone from attacking the refrigeration equipment. What it does is take away the biggest advantage an attacker, or any fault, has: invisibility. With an independent monitoring layer, sabotage in the early hours no longer goes unnoticed and becomes an early warning that someone can act on.

To put it as a straight question: would Nebula ColdChain have prevented the cyberattack on the controllers? No. Would it have minimised the losses? Without a doubt. By flagging any temperature anomaly in the refrigeration system instantly, it gives teams time to react within minutes instead of discovering the damage the next morning. That is often what separates a scare from a multimillion-euro loss.

Resilience by design

The attacks in France and this week's second wave leave a lesson that goes well beyond hackers. The cold chain is too critical to depend on a single system that, the day it fails (through an attack, a breakdown or simple human error), leaves the business blind. Resilience cannot be improvised. It has to be designed in from the start, by keeping temperature monitoring away from the network that could fail.

At Celestia TST, we put that thinking into practice with Nebula ColdChain: continuous, independent and traceable monitoring, so the temperature of your products never depends on a single source.

If you would like to explore how to strengthen monitoring across your cold chain, let's talk. We can give you a Nebula ColdChain demo tailored to your site and help you identify your blind spots before someone else does.