Refrigeration Cyberattacks Reach Switzerland: What the Köniz Case Means for Businesses

Until recently, a refrigeration cyberattack was something you heard about in conference talks. Since early November it has been a Swiss reality. In Köniz, just outside Bern, the owner of the butcher’s business «Lüthi’s Fleischwaren» opened his freezer to find temperatures of 50 to 70 °C. The meat looked «as if it had been cooked» and the price labels had melted, he told Swiss broadcaster SRF; staff could only enter the room wearing masks. The shop disconnected its systems from the network and closed the branch. It hopes to reopen on 20 November at the earliest, provided the units are cooling reliably again.

On 10 November the Federal Office for Cybersecurity, known internationally as the NCSC and in Switzerland as BACS, followed up with a public warning. Notably, it is aimed not only at critical infrastructure operators but squarely at SMEs. Here is what happened, which systems are involved, and how a business can find out within a few hours whether it has a problem.

From France to Köniz: what we know so far

The European wave

It started in France. Overnight on 11–12 October, refrigeration controllers in supermarkets at more than 700 sites were manipulated. The French Foreign Ministry reports considerable material damage, several fires and food losses estimated at tens of millions of euros. On 9 November, France formally attributed the campaign to «Shahid Kaveh», a unit affiliated with Iran’s Islamic Revolutionary Guard Corps, describing it as the first cyber campaign on French soil carried out purely for sabotage.

Danfoss wrote to customers on 13 October. The incidents reported to it involved unusually high defrost temperatures, changed setpoints and activated electric defrost. According to the manufacturer, the affected units were directly exposed to the public internet, with no VPN and no firewall in front of them. The same day, France’s CERT-FR extended its alert to Copeland and Dixell XWEB systems. Media later reported cases in Belgium, Sweden, Ireland, Estonia and the Netherlands.

The Köniz case

SRF broke the story on 5 November. Bern cantonal police confirmed they had been informed and had opened an investigation. The same report said three Volg shops had found refrigerated display settings changed. Who is behind the Swiss cases, and which controller was in use in Köniz, has not been made public. A link to the French campaign is plausible but unproven, and we treat it as an open question.

What the NCSC is saying

The NCSC had already alerted critical infrastructure operators via its Cyber Security Hub after the French incidents. It says the new public warning is needed because the affected systems are «also widely used by small and medium-sized enterprises». The list of sectors is long: butchers and food producers, restaurants and hotels, pharmacies, medical practices and laboratories, logistics and warehousing, industrial sites and agriculture.

Technically, the pattern is a familiar one. Attackers get into management interfaces that are reachable directly from the internet, then change temperatures, defrost cycles, alarm thresholds or notification settings. That last item is the nastiest. Switch off the alerts and nobody’s phone buzzes at 3am while the cold room warms up. Speaking to 20 Minuten, the NCSC also stressed the principle of self-responsibility: the Confederation supports and coordinates, but it does not take over operators’ responsibility.

Which systems are named

• Danfoss AK-SM 800 System Manager and AK-SC 355: end-of-life products with no more security updates. Danfoss says the AK-SC 355 was retired from sale in 2016 and the AK-SM 800 in 2023.
• Danfoss AK-SM 800A / AK-SM 8xxA: the current range, at risk when running outdated firmware. Danfoss fixed known vulnerabilities in version 4.3.1 and also recommends the «Strict» security level. According to the NCSC, newer firmware enforces encrypted HTTPS communication.
• Copeland/Dixell XWEB: refrigeration management systems named by CERT-FR and the NCSC as potentially affected, older units in particular.

Bear in mind that this list is a snapshot. Any other controller sitting openly on the internet with a factory password is not safer just because its maker has not been named in this wave.

The real issue: nobody owns it

It is tempting to dismiss these attacks as exotic. That would be a mistake, because the root cause is mundane and therefore widespread. A refrigeration contractor designs, installs and maintains the plant. So that they can see alarms and fix faults remotely, the controller gets an internet connection, sometimes via its own router, sometimes through a port forward on the company network. IT, if the business has any, often knows nothing about it. The NCSC says as much: many organisations are unaware that their refrigeration systems are reachable from the internet or run by external providers.

For a family butcher with four branches, that is understandable. For a hospital laboratory, a hospital pharmacy or a pharmaceutical logistics firm, it is not. These sites store medicines, samples or vaccines whose cold chain normally has to be fully documented. A tampered setpoint there is not just lost stock; it becomes a quality and liability issue. Anyone who files refrigeration under «facilities» and leaves it out of the security concept has a gap in their risk management.

Organisations covered by the reporting obligation under Article 74b of the Information Security Act (ISG) have an extra formal duty: cyberattacks must be reported to the NCSC within 24 hours of discovery, even when «only» building services are hit. If you have not yet clarified your obligations, our piece on the ISG, CSV and NIS2 covers the basics.

A five-step refrigeration check

These steps are based on guidance from the NCSC, CERT-FR and Danfoss. Most businesses can get through them in an afternoon, as long as the refrigeration contractor picks up the phone.

1. Take an inventory. Which cooling and refrigeration systems do you have, which controller, which manufacturer, which firmware? Ask your maintenance provider in writing whether and how the controller can be reached remotely. Units in rented premises and branch sites count too.
2. Check internet exposure. Can the web interface be opened via a public IP address? A test from outside the company network, for example over mobile data, or a look at the router’s port forwarding rules gives a first answer. Your IT partner can check this properly.
3. Close direct access. Management interfaces do not belong on the open internet. Remote access should run only via VPN or a centrally managed access point. CERT-FR accepts filtering to the contractor’s IP addresses as a stopgap, but not as a permanent fix.
4. Update and change passwords. Install available firmware; for Danfoss AK-SM 800A that means at least version 4.3.1 with «Strict» mode. Replace default passwords with unique ones straight away. Replace units that no longer get updates, or isolate them strictly.
5. Verify the configuration and test alarms. Compare setpoints, defrost schedules and alarm limits against what they should be, back up the configuration and check that alarm texts or emails actually arrive.

One detail in the CERT-FR alert is worth its weight in gold: before you cut the data link to your refrigeration contractor, check your insurance terms. Some policies require remote monitoring. That is no reason to leave the system exposed, but it is a good reason to agree the move to VPN with both the contractor and the insurer.

If the system has already been tampered with

• Disconnect it from the internet, as the Köniz butcher did. Food and product safety come first.
• Preserve evidence: photos of the displays, controller logs, time of discovery, temperature records.
• Do not simply reset the unit and put it back online. CERT-FR is explicit: a factory reset removes traces of the compromise, but an unpatched device stays vulnerable and will very likely be hit again.
• Report it: file a complaint with the cantonal police and report to the NCSC, within 24 hours if you are subject to the reporting obligation. Bring your insurer in early.

Many of the principles in our first-24-hours playbook apply here too, from preserving evidence to communicating with customers.

Our assessment

The refrigeration attacks are a textbook case of operational technology becoming an entry point without anyone misconfiguring a firewall. There simply was none. The attackers apparently needed no sophisticated exploits, just open web interfaces, old firmware and default passwords. According to Claroty, a Danfoss spokesperson told Dutch broadcaster NOS that the systems hit were not on secure networks and were protected by a default password.

That is the good news: the defences are well known and affordable. The less comfortable part is that they require management to ask a question nobody has asked before: «What else of ours is connected to the internet?» Refrigeration is just today’s trigger. Building management systems, access control, solar inverters and heating controls follow the same pattern. If you are doing the inventory for cooling now, include the rest of your building services while you are at it. For the authorities’ view of the overall picture, see our analysis of the latest BACS report, and for why Bern wants to hold makers of connected products more accountable, read our piece on the Swiss counterpart to the CRA.

Sources

• NCSC/BACS: Cooling and refrigeration control systems: Identifying, updating and protecting systems, 10 November 2026
• SRF: Berner Metzgerei Opfer von Hackerangriff – auch Volg betroffen (German), 5 November 2026
• Keystone-SDA/swissinfo.ch: Metzgerei in Köniz muss nach Cyberangriff vorübergehend schliessen (German), 5 November 2026
• 20 Minuten: Bund warnt nach Kühlregal-Hack in Bern: Bedrohung «bleibt hoch» (German), 9 November 2026
• France Diplomatie: Déclaration d’attribution à l’Iran de cyberattaques visant la France (French), 9 November 2026
• CERT-FR: CERTFR-2026-ALE-012, security incident targeting remote refrigeration controllers (French), 12–16 October 2026
• Danfoss: Security Advisory DSA-2025-08-01 (AK-SM 8xxA)
• Claroty: European Supermarket Hacks Expose Risks of Internet-Facing Refrigeration Systems
• NCSC/BACS: Reporting obligation: who has to report?