What happened

Over the first weekend of November 2026, hackers reached into supermarket refrigeration systems in at least eight European countries and turned the cold off. Freezers in Belgium, Estonia, Ireland, Luxembourg, the Netherlands, Denmark, Sweden and Finland were switched to defrost or set to 50°C. Stores found out hours later, when the stock was already gone.

One ICA store in Stockholm was hit at about 2 a.m.; employees did not notice until hours after. A Belgian butcher lost roughly €15,000 of meat when case temperatures climbed to 18°C. SuperValu pulled chilled and frozen product from 13 stores in Ireland. In the Netherlands, at least 17 companies were affected.

This was the second wave. In October, attackers took control of refrigeration controllers at hundreds of French supermarkets. Forescout has since counted nearly 13,000 internet-reachable refrigeration systems in 99 countries, many running outdated software, and more than 20 claimed attacks on cold storage, wineries, fruit storage and food processors in 2026 alone. (Cybernews, Nov 2026)

Why it worked

Nobody broke into a store. The controllers that run the cases were reachable from the internet, often with default passwords and old firmware, and the attackers simply logged in and changed the settings. A defrost cycle or a 50°C setpoint looks like any other command to the controller, so no alarm fired.

The damage came from the delay. Every temperature reading the store had came from the same controller the attacker was holding. The display on the case, the alarm system, the remote monitoring portal, the overnight log: all of it reported what the controller had been told to report. When the only thermometer in the building is the one the intruder controls, the first warning is a puddle on the floor.

A reading that doesn't come from the controller

The fix for a compromised source of truth is an air-gapped one: a second reading with no network path between it and the first. In the aviation and process industries this is routine: a critical reading gets an independent sensor, on its own wiring, feeding its own display, with no path back to the control system. If the two disagree, someone goes and looks.

For a walk-in or a display case, that means a plain thermometer with its own probe in the product zone and a display big enough that nobody has to go looking for it. Not a smarter controller. Not another connected monitor on the same network. Something that cannot be reached from outside the building because there is nothing to reach it with.

The BD923: nothing to hack

The BD923 Big Digit Thermometer has been in our line for years, and it was built for exactly this: a reading you can trust from across the room. Its red numbers are 3 inches tall on a 5.5 × 9.5 inch screen, readable from 75 feet. The probe is hardwired and waterproof, with 18 feet of cable, and goes in the case or the walk-in; it can be extended to 100 feet.

What it does not have is the point. No Wi-Fi. No Bluetooth. No app, no cloud account, no login, no firmware to patch. It plugs into a wall outlet and reports the temperature at the end of its probe. There is no way to change what it says without standing in front of it.

What it does, and what it doesn't

The BD923 does not stop an attack. It makes one visible. If a controller is told to defrost at 2 a.m., the case starts warming within minutes, and the big red number on the wall climbs with it. Night staff, a cleaning crew, a manager walking in at 5 a.m.: anyone who glances at it sees the problem before the product is lost, instead of after.

It also does not replace your records. The display shows the temperature now; it does not log it. For the audit trail, pair it with a data logger that writes to its own memory. The BD923 tells you the moment something is wrong; the logger proves it later.

We would rather say this plainly than call anything "hack-proof." The honest claim is simpler: there is nothing on it to hack.

When no one is in the store

A big red number only helps if someone is there to see it. Overnight, and in the hours the European attacks were timed for, there often isn't.

For that, add a T&D TR71A2 data logger alongside the BD923. It has two probe inputs, a Wi-Fi connection of its own, and reports to T&D's WebStorage service, which sends a text or email to your phone the moment a case drifts out of range. It is connected, so we won't call it air-gapped. But it is a separate path from the refrigeration controller: it can only report a temperature, never set one. Compromising it changes a graph, not a freezer.

The pairing covers both gaps. The BD923 is the reading nobody can tamper with. The TR71A2 is the one that wakes you up, and keeps the record that shows the inspector what happened and when. One logger covers two cases; a walk-in and the case bank beside it is a common split.

Where to put one

One per walk-in, mounted outside the door at eye level, probe inside in the product zone. One per bank of display cases, placed where staff pass it on every trip to the back. Anywhere a reading matters and the only other reading comes from a controller with an Ethernet cable.

The BD923 comes with its probe hardwired on 18 feet of cable; if the display needs to sit farther from the sensing point, we extend it, up to 100 feet total. For washdown areas, add the WPE1 enclosure. For a fixed probe position, add the WLHS4N thermowell. If the outlet is on a circuit that gets switched off, add the battery pack.

Questions about an installation, or a quote for several locations: call 303-841-7567 or email sales@techinstrument.com.

Tech Instrumentation has supplied thermometers, probes and calibration services to food processors, hatcheries, laboratories and cold-chain operators since 1986.