Sometime in the early hours of Monday morning, attackers quietly logged into internet-exposed refrigeration controllers at supermarkets across Belgium, Sweden, Estonia, Ireland, and several other European countries — and turned up the temperature. When staff arrived for the morning shift, frozen and chilled food was spoiling. More than 100 stores were affected. Some had to pull entire product lines off shelves.

This is the second wave of these attacks in recent weeks. A first round hit French supermarkets, apparently from the same playbook: find internet-exposed industrial refrigeration controllers — primarily made by Danish vendor Danfoss — log in through default or weak credentials, and change setpoints. No ransomware, no extortion demand. Just spoilage, disruption, and a bill that someone has to absorb.

The attacks are notable for what they aren't. There's no sophisticated zero-day here, no nation-state tradecraft. These are industrial systems — operational technology, or OT — that were connected to the internet with inadequate access controls and apparently never hardened. The barrier to entry is roughly "know how to use Shodan and have an afternoon free."

That's the uncomfortable part. Industrial control systems across the food, water, energy, and logistics sectors have been getting quietly networked for years — often by people optimising for remote monitoring convenience, not security. The payoff is real: a technician can check refrigeration performance from a laptop instead of flying out to 40 stores. The risk, as these attacks demonstrate, is that so can an attacker.

The question of who is behind this remains open. Researchers haven't publicly attributed the attacks, and no group has claimed responsibility. The lack of a ransom demand is conspicuous — this looks more like demonstration-of-capability or pure disruption than a criminal money grab. That points toward hacktivism or a state-adjacent actor testing the waters, though it's too early to say.

What makes this a wider story: Danfoss refrigeration controllers are deployed globally, including in Australian supermarket and cold-chain logistics infrastructure. Any operator running internet-accessible OT equipment in that category should be treating this as a direct prompt for an asset audit — not a "monitor the situation" moment.

The ACSC has previously flagged OT and industrial control system security as a priority concern under Australia's SOCI Act framework, which requires critical infrastructure operators to manage risks to their systems. Cold-chain logistics arguably sits within that scope for some operators, and this wave of attacks is exactly the kind of threat scenario the Act was designed to address.

For defenders, the immediate ask is straightforward: take OT management interfaces off the public internet, enforce multi-factor authentication where remote access is genuinely required, and change any default credentials that shipped with the hardware. The Danfoss gear at the centre of these attacks has known, published default credentials — that alone should have been remediated years ago.

What to watch: Whether a third wave hits, whether attribution firms up, and whether any European regulator moves to mandate baseline OT security standards for food-sector operators. The UK's NCSC and CISA have both flagged food and agriculture as undersecured critical infrastructure sectors. These attacks are making the case for them in real time.