Dutch NCSC warns of attacks on internet-connected refrigeration

Dutch NCSC warns of attacks on internet-connected refrigeration

2 November 2026: The Netherlands' National Cyber Security Centre says several cyberattacks are under way on refrigeration installations from various suppliers across Europe, the Netherlands among them, and it is monitoring and investigating. Attackers who reach the controllers change the temperature or the defrost cycles so the cooling stops working as it should.

Not yet independently verified. The NCSC names no suppliers, products or flaws, and says it does not comment on individual organisations, so which installations are affected rests on press reports we have not used here. We will update this when it can be confirmed, and remove this note.

The warning, published on 2 November, is aimed at any organisation that owns such an installation: supermarkets and food distributors first, but also cold stores, pharmacies, laboratories and hospitality businesses whose stock depends on a steady temperature.

How the systems are being reached

The NCSC describes two routes. Some controllers are connected to the internet and carry vulnerabilities an attacker can exploit; others are protected by weak or default passwords. Either way, the attacker gains remote access and changes settings. Products then warm up and spoil, food safety is put at risk, and installations can fail outright, with financial damage, waste and possible downtime for the business.

The centre does not name the suppliers or the flaws involved. It says it does not make substantive statements about individual organisations or ongoing investigations.

What the NCSC tells owners to do

Its advice starts with the supplier: contact them and find out whether your installation is vulnerable, and if it is, update it at once or apply the measures below.

• Keep refrigeration controllers off the open internet.
• Where remote access is essential, limit it to trusted IP addresses.
• Replace default and weak passwords with strong ones.
• Install security updates regularly.
• Check the settings regularly and monitor the systems, so that changes nobody made on purpose are spotted quickly.

Owners who find signs of misuse are asked to report them to the NCSC, through its reporting form or, for registered organisations, through MijnNCSC.

Reporting duties under the new Dutch law

The warning also reminds readers of the Cyberbeveiligingswet (Cbw), the Dutch law implementing NIS2, in force since 15 August. It covers about 8,000 organisations in 18 critical and highly critical sectors such as energy, digital infrastructure, research and government, and can also reach larger companies in other sectors and some suppliers. A significant incident at a covered organisation has to be reported to the CSIRT of its sector and to the relevant supervisor, and the NCSC is the designated sectoral CSIRT for a large number of those sectors.

Sources

• NCSC: In het nieuws, cyberaanvallen op koelinstallaties in Europa, 2 November 2026