Hacked freezers and a $6 billion heist: what EU cybersecurity law expects

The authors of this blog participate in the EU-funded project CRACY, helping SMEs understand cybersecurity and comply with the Cyber Resilience Act. 

Within a single week, malicious actors turned supermarket freezers in Belgium into ovens and stole more than six billion dollars from the world's largest crypto exchange. Neither began with a technical masterstroke. One began with a default password nobody had changed, the other with a job interview that was not what it seemed. With cyberattacks hitting both shops around the corner and global companies, this blogpost dives into what happened, while laying out the legal framework and what the EU expects from businesses. 

1. EU-wide hacked freezers turned into ovens 

1.1. What happened? 

Overnight into Monday 2 November, fridges and freezers in dozens of Belgian shops started warming up. Delhaize, Carrefour, Intermarché, Spar and IKEA all reported affected stores, and a butcher near Antwerp lost around €15,000 of meat. It’s very notable that this widespread attack appeared to not only target big companies, but small local shops as well. Evidently, no one is immune to supply chain attacks. 

Shops all across Europe, from Sweden and Finland to Ireland, Estonia and Romania, were hit the same night, three weeks after a similar attack on hundreds of French supermarkets. More than 10 other EU Member States were affected. The Belgian federal prosecutor has opened a criminal investigation. As of 4 November 2026, these cyberattacks have been claimed by pro-Russian hacker collectives NoName057(16) and Z-Pentest, but their involvement has not been confirmed by authorities. ENISA, the EU cybersecurity agency, published a joint statement, urging organisations to take immediate action to mitigate exposure in affected systems. 

So how do you hack a freezer? Supermarket refrigeration is run by small computers that contractors manage over the internet, so anyone who can log in can change the settings. In the Netherlands, the manufacturer of these freezers said the systems that were hit were reachable online and still used their factory-default passwords, which are published in public manuals. Hackers used these published passwords to remotely push the temperatures up to 50°C, spoiling food. 

1.2. What the law expects 

The European Cyber Resilience Act (CRA) targets exactly this problem. It requires manufacturers of connected products to ship them with a secure default configuration and protection against unauthorised access. This implies in most cases no default passwords and certainly not printing these default passwords out. However, these rules only apply to new products placed on the EU market from 11 December 2027. This means that while newer products should be more secure, older products do not necessarily have to be updated, leaving a large part of European connected products at risk of similar vulnerabilities. 

One part of the CRA does already apply. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents involving their products to the national CSIRT and ENISA, with a first warning within 24 hours, also for products sold before 2027. The freezer attacks are among the first large-scale tests of this regime. 

The shops themselves may fall under NIS 2, the law that mandates organisational security for a number of entities active in critical sectors. Food retail as such is not covered, but wholesale distribution of food is. Retail groups that supply franchised or affiliated stores from their own distribution centres should verify their NIS 2 qualification if they have not done so already. When AI allows for more larger scale and more complex attacks, it becomes increasingly important to secure the supply chain. 

2. One job interview worth six billion dollars to Binance 

2.1. What happened? 

On 29 October, attackers drained over six billion US dollars in crypto-assets from Binance, likely the biggest crypto theft in history. The FBI has attributed it to North Korea. 

In September, a Binance software engineer was approached through a legitimate job platform by someone posing as a project director at another company. After a video interview, he was asked to download a coding test onto his work laptop, which contained malware that the company's security tools did not detect. 

From there, the attackers moved patiently. Using the infected laptop and an internal AI tool, they took over the computers of two more engineers, one of whom had access to the system that signs transactions. This allowed the hackers to give their own software partial control over Binance’s internet-connected wallets, which hold the funds for everyday customer withdrawals, and to drain them within a few hours. 

2.2. What the law expects 

Crypto exchanges operating in the EU must comply with the Digital Operational Resilience Act (DORA), the same cyber resilience rulebook that applies to banks, insurers and payment institutions. DORA requires strict control over who can access which systems, makes security awareness training compulsory for staff and requires major incidents to be reported to the supervisory authority. 

The lesson reaches beyond finance. NIS 2 requires organisations in scope to address human resources security, access control and cyber hygiene training, and makes management bodies responsible for overseeing these measures. Any organisation whose developers install tools freely, or whose staff use work laptops for personal matters, faces the same risk and potential management liability. The Binance case illustrates that those losses can be astronomical. 

3. AI makes this everyone's problem In its 2026 

Threat Landscape, the EU’s cybersecurity agency ENISA warned that AI will likely lower the barriers to entry into cybercrime. AI puts technically complex attacks within reach of far more people, including those with little real technical expertise. ENISA cites an AI-assisted intrusion that reached administrator access within 8 minutes. The Binance attackers even turned the company’s own AI tool against it. Patient, multi-step attacks of that kind are becoming accessible to ordinary criminal groups.

AI also makes technically simple attacks more frequent and more convincing. Criminals use it to write flawless phishing emails at scale, create deepfakes of managers’ voices and faces, and make fake recruiters and suppliers sound genuine. The attack itself is no more technically sophisticated than before, but more people fall for it. 

Meanwhile, the simplest attacks of all were always almost free. Trying factory passwords on thousands of connected devices costs an attacker next to nothing. As we’ve seen in these attacks, no business is too small or too unremarkable to be a target, not least because a small supplier or contractor can be the way into a much larger customer in the supply chain. Cybersecurity can therefore no longer be left to big IT departments alone. 

4. First things first, change your default passwords 

In the Netherlands, the shops that had secured their refrigeration systems after the French attacks were not hit. The ones that had not, were. 

Accordingly, there are clear lessons here for everyone. First of all, take stock of every internet-connected device in your organisation and home, from firewalls and cameras to freezers and building controls. Once you have this inventory, make sure none still runs on its factory password, take offline what does not need to be online, and switch on multi-factor authentication wherever you can. Then ask your suppliers and maintenance contractors the same questions.

5. How Timelex can help 

Timelex advises manufacturers, retailers, financial institutions and public bodies on EU and Belgian cybersecurity law. We can help you with: 

• Scoping. Whether NIS2, the CRA or DORA applies to your organisation or products, including registration with the Centre for Cybersecurity Belgium. 

• CRA compliance. Product classification, security requirements and a reporting process that can meet the 24-hour deadline. 

• Incident response. Coordinating notifications under NIS 2, the GDPR, the CRA and DORA when the clock is ticking. 

• Contracts. Security, remote access, updates and liability in your agreements with suppliers and maintenance providers.

• Board training. Helping management bodies meet their NIS 2 training obligation and understand what they are signing off on. 

Do you make, sell or rely on connected equipment, or run systems that hold client assets? Book a 30-minute call with Pedro Demolder or Wout Platteau, to find out whether the CRA, NIS 2 or DORA applies to you and what to do first, via pedro.demolder@timelex.eu or wout.platteau@timelex.eu.