When the Freezer Becomes an Oven: Europe’s Supermarket Refrigeration Attacks
For the second time in about three weeks, attackers have remotely taken over refrigeration controllers in European supermarkets and turned fridges and freezers into warming cabinets. The first wave hit France and nearby countries on the night of 11–12 October. The second wave came overnight into Monday 2 November and reached somewhere between seven and ten European countries. In both waves the hardware involved was mostly made by Danfoss, the Danish company whose controllers run refrigeration in a large share of Europe’s grocery stores.
Large commercial supermarket refrigeration systems are connected to network management units (like Danfoss StoreView or AK-SM controllers) to monitor and control temperatures, automate defrost cycles, and manage food safety alarms remotely.
Nobody had broken into the stores themselves. The attackers reached small web-managed controllers that had been left reachable from the public internet, and they changed a few settings.
Wave one: France, 11–12 October
On the night of 11 October, refrigeration controllers in hundreds of French supermarkets were switched into defrost mode while the cabinets were still full. Defrost mode is normally a short, scheduled cycle that melts ice off the evaporator coils. Left running for hours, it heats the cabinet. Alarms reportedly did not go off, and few staff were in the stores overnight.
By morning, many cabinets had reached around 50 °C (122 °F), and one store in Normandy reported 80 °C. Estimates of the number of stores range started from about 150 and later was increased up to 700. Affected chains included Intermarché, Netto, Carrefour, Coopérative U, Monoprix and E.Leclerc. Food losses were estimated in the tens of millions of euros. Reports also placed affected sites in Belgium, the Netherlands, Spain, Portugal, Poland and Germany.
France’s national cyber agency ANSSI, through its response team CERT-FR, published an alert on 12 October and updated it on 13 and 16 October. The alert names four product families: Danfoss AK-SM series, Danfoss AK-SC series, Copeland XWEB and Dixell XWEB. Prime Minister Sébastien Lecornu told ANSSI to investigate and to coordinate with other European countries.
Wave two: Europe, 2 November
The second wave followed the same pattern on a wider scale. Overnight into Monday 2 November, supermarket fridges and freezers were again pushed into defrost mode, with temperatures reported at about 50 °C. Belgium, Luxembourg, the Netherlands, Sweden, Finland, Estonia, Ireland and Italy were affected, along with reported incidents in Greece. Reported victims included Coop and ICA in Sweden, Ahold Delhaize stores in Belgium, the Netherlands and Luxembourg, and Spar and Carrefour in Belgium. Small independent shops were also hit, including a butcher near Athens.
An ICA spokesperson said all of its affected stores were connected to an outside refrigeration control system supplied by Danfoss. EU agriculture commissioner Christophe Hansen called it “a deliberate attempt to disrupt our food supply chain.” A European Commission spokesperson said the incidents “are not isolated” but would not say who was behind them.
The equipment: two retired models and one current one
Reporting points to three Danfoss products:
| Model | Status | Why it was exposed |
|---|---|---|
| AK-SC355 | End of life (reportedly 2016) | No security updates. Danfoss has advised replacing it. |
| AK-SM800 | End of life (reportedly May 2021) | No security updates. Danfoss has advised replacing it. |
| AK-SM 800A | Current product | Units still running firmware older than R4.3.1, released in 2025 |
After the first wave, Danfoss confirmed that AK-SM800 and AK-SC355 systems were involved. The company described most of the affected equipment as “legacy” products that no longer get software or security updates, and said it had long urged customers to update firmware and move to current-generation systems.
The AK-SM 800A is a more uncomfortable case because it is still sold and supported. Its weaknesses are already public. In 2025 Danfoss published advisory DSA-2025-08-01, and CISA published ICS advisory ICSA-25-140-03 on an authentication flaw in AK-SM 800A system managers. In August 2026, Claroty’s Team82 described three vulnerabilities in detail:
CVE-2025-41450: an authentication bypass through a hidden “code of the day” mechanism (CVSS 8.2)CVE-2025-41451: an OS command injection in the alarm e-mail settings, giving remote code execution after login (CVSS 7.6)CVE-2025-41452: an Nginx configuration injection that can cause denial of service (CVSS 5.4)
For more details of those vulnerabilities, read those documents:
- Team 82: Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers
- Censys: Frostbitten in France: A Danfoss StoreView Internet Exposure Report
Firmware R4.3.1 fixes these. According to the reporting, the AK-SM 800A units that were hit were the ones never updated to it. Claroty counted 2,765 AK-SM 800A devices exposed to the internet in a Censys scan, and other estimates put the number of reachable Danfoss controllers higher.
Security researcher Kevin Beaumont described the login logic on some of these devices as a password that is simply the current date. Claroty’s analysis of the same “code of the day” logic treats it as a hidden bypass rather than a default password. Either way, the result is the same: anyone who finds the controller online can log in.
No zero-day needed
Experts agree on one point: this was not sophisticated hacking. Darktrace’s Nicole Carignan said attackers got in through internet-facing controllers, end-of-life firmware and default passwords, and that no zero-day was used. Richard Horne of the UK’s NCSC said the French fridges had been connected directly to the internet with default passwords. UK cyber minister Liz Lloyd called the French attack exploitation of known vulnerabilities.
So far nobody has claimed responsibility or been named. Investigators have not established a motive. Some researchers have pointed out that the attack is simple enough for opportunistic hackers, while others note that state actors have the capability too. Both waves struck overnight, used the same technique and spread across borders, which looks more like a coordinated campaign than random vandalism.
What operators should do now
The CERT-FR alert has the clearest practical guidance:
- Take the controllers off the internet. Remove any direct internet exposure and any device with a public IP address.
- Use only secure remote access. Service contractors should connect through a VPN or protected network. Filtering contractor IP addresses on a firewall is acceptable as an emergency measure only, not as a permanent fix.
- Patch and harden. On current Danfoss systems, update the firmware (R4.3.1 or later for the AK-SM 800A), set the security level to Strict, and make sure default passwords have been changed.
- Check the configuration, especially defrost schedules, before putting a unit back into service.
- Don’t rely on a factory reset. A reset end-of-life device is still vulnerable. CERT-FR warns that leaving an unpatched EOL controller on the internet will very likely lead to compromise again.
- Plan to replace the AK-SC355, the AK-SM800 and any other unsupported controllers.
Retailers should also make sure temperature alarms are monitored independently of the controller that might be compromised. In both waves, the alarms that should have woken someone up apparently stayed silent.
The bigger lesson
Refrigeration is part of the food supply chain, and in hospitals and blood banks it can be safety-critical. Yet these controllers are often installed and maintained by outside contractors, connected to the internet for remote service, and then left alone for ten years or more. As Professor Aikaterini Mitrokotsa of the University of St. Gallen told AP, a fridge does not look like a security risk, and that is exactly why attackers like it.
The patches and guidance for these devices were already available before the attacks. What was missing was an inventory of the devices, a plan to retire old ones, and the habit of treating a fridge controller as an internet-connected computer. A third wave is likely, and every store with an exposed controller is a candidate.
Sources
- CERT-FR (ANSSI): CERTFR-2026-ALE-012 – Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération
- Facilities Dive: Hack of Danfoss refrigeration controllers in Europe causes tens of millions in food losses (13 Oct 2026)
- Facilities Dive: European grocery stores hit with second refrigeration system hack (3 Nov 2026)
- PBS NewsHour / Associated Press: Here’s what to know about another cyberattack on European supermarket fridges (3 Nov 2026)
- Claroty Team82: Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers (9 Aug 2026)
- Danfoss: Security advisory DSA-2025-08-01
- CISA: ICS Advisory ICSA-25-140-03 (Danfoss AK-SM 800A)
- Wikipedia: 2026 French supermarket refrigerator hack (background and end-of-life dates)
- The Hacker News: New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe
- CNN: What to know about the cyberattack that targeted supermarket refrigeration systems in France
34 Comments
Tomi Engdahl says:
Large commercial supermarket refrigeration systems are connected to network management units (like Danfoss StoreView or AK-SM controllers) to monitor and control temperatures, automate defrost cycles, and manage food safety alarms remotely.
Tomi Engdahl says:
Connecting essential equipment to the internet can offer benefits, particularly for remote monitoring and maintenance, but it also introduces vulnerabilities.
It’s reasonable to question whether everything really needs to be connected, especially when food supplies and critical infrastructure are involved.
Cybersecurity should be built into these systems from the outset, rather than addressed after something goes wrong.
Tomi Engdahl says:
It turns out plenty of individual store operators and local contractors didn’t secure their systems (firewall, change defaut passwords)
https://thehackernews.com/2026/11/second-wave-of-cyberattacks-hits.html?hl=en-US&m=1#:~:text=In%20the%20Belgian%20cases%2C%20attackers%20got%20into,not%20yet%20moved%20to%20a%20new%20system.
Sabcobel knows of about 20 affected units among the hundreds it manages in Belgium. In the Belgian cases, attackers got into individual supermarkets’ systems, not those of refrigeration contractors, Moelans told Belgian media. Sabcobel had advised stores to secure their internet connections, and many but not all had done so.
Mutso said old controllers that had not been updated were being targeted. Selver said the store that was hit was the last one it had not yet moved to a new system
Tomi Engdahl says:
It turns out plenty of individual store operators and local contractors didn’t.
As the second wave of refrigeration hacks expanded from France into Ireland (hitting SuperValu stores), Belgium, the Netherlands, Sweden, Estonia, and Finland, hardware vendor Danfoss and national cybersecurity agencies confirmed that a massive portion of the newly compromised sites had two glaring issues:
* Default Credentials Left Intact: Systems were still running on factory-default login credentials (like Supervisor / 12345 on older Danfoss StoreView and AK-SM units).
* Exposed directly to the Public Internet: Instead of sitting behind a secure VPN, segmented industrial network, or basic firewall, the web management interfaces for these cooling systems were directly reachable over open IP addresses.
While major supermarket chains upgraded and firewalled their systems following the initial October outbreak in France, smaller franchises, independent grocers, and localized setups running legacy hardware failed to update or change passwords. Threat actors simply used automated scanning tools to sweep European IP ranges for reachable units, logged in using factory defaults, and pushed the defrost command.
The classic OT/IoT cardinal sin—”if it isn’t broken, don’t touch it” (and leave the manual’s password as is)—ended up ruining thousands of tons of frozen food.
https://thehackernews.com/2026/11/second-wave-of-cyberattacks-hits.html?hl=en-US&m=1#:~:text=Danfoss%20also%20told%20Belgian%20broadcaster%20VTM%20that,many%20but%20not%20all%20had%20done%20so.
Tomi Engdahl says:
The European refrigeration cyberattacks directly intersect with NIS2 (governing operational operators and retailers) and the Cyber Resilience Act (CRA) (governing device manufacturers like Danfoss and Dixell).
The incident essentially serves as a case study for why the EU drafted both regulations—highlighting a classic systemic gap where neither the hardware vendor nor the local retail contractor took legal responsibility for internet exposure, default credentials, or end-of-life device patching.
1. NIS2 Directive (EU 2022/2555) — Retailer & Supply Chain Liability
While NIS1 primarily focused on energy, transport, and financial sectors, NIS2 explicitly expanded scope to include the Food Production, Processing, and Distribution sector, alongside major digital and supply chain services.
Classification & Operator Duty: Large grocery chains and food distribution logistics providers fall under NIS2 as Essential or Important entities. Article 21 mandates strict cybersecurity risk management practices, explicitly requiring operators to secure supply chains, segment Operational Technology (OT) networks, and enforce basic authentication protocols.
The “End-of-Life” (EoL) Legacy Gap: Danfoss noted that a significant portion of the compromised units (like the AK-SM 800) reached official End-of-Life (EoL) years earlier and received no security patches for recent vulnerabilities. CRA Article 13(8) forces manufacturers to define and guarantee explicit security support periods (typically a minimum of 5 years) and mandate clear end-of-support communications to OEMs and end users so legacy hardware isn’t left silently exposed.
Starting in late 2026, the CRA mandates that manufacturers must report actively exploited vulnerabilities (like unauthenticated remote code execution in ICS) to ENISA and national CSIRTs within 24 hours of discovery.
EU Cyber Resilience Act (CRA) — Manufacturer & Hardware Lifecycle Liability
The CRA introduces mandatory cybersecurity requirements for hardware and software placed on the EU market (“Products with Digital Elements”). Although its core provisions transition in through late 2027, the attack addresses the exact hardware-level root causes the CRA was built to eliminate:
Secure by Default (Eliminating Default Passwords): A core requirement under CRA Annex II is that devices must not ship with unprompted, universal factory-default passwords. Under CRA rules, devices like the Danfoss AK-SM or Dixell XWEB controllers would be required to force unique passwords or key-based authentication upon initial commissioning.
The “End-of-Life” (EoL) Legacy Gap: Danfoss noted that a significant portion of the compromised units (like the AK-SM 800) reached official End-of-Life (EoL) years earlier and received no security patches for recent vulnerabilities. CRA Article 13(8) forces manufacturers to define and guarantee explicit security support periods (typically a minimum of 5 years) and mandate clear end-of-support communications to OEMs and end users so legacy hardware isn’t left silently exposed.
Vulnerability Disclosure Obligations: Starting in late 2026, the CRA mandates that manufacturers must report actively exploited vulnerabilities (like unauthenticated remote code execution in ICS) to ENISA and national CSIRTs within 24 hours of discovery.
The incident highlighted a compliance gap: a manufacturer can release a patch, but if a third-party installation contractor or store owner never applies it—and leaves the box wired straight to the public internet—neither CRA nor NIS2 historically prevented the resulting outage.
As EU regulators evaluate the fall-out, European authorities are expected to use this case to push for tighter NIS2 enforcement on local food supply chain dependencies and third-party facility maintenance contracts.
The incident highlighted a compliance gap: a manufacturer can release a patch, but if a third-party installation contractor or store owner never applies it—and leaves the box wired straight to the public internet—neither CRA nor NIS2 historically prevented the resulting outage.
As EU regulators evaluate the fall-out, European authorities are expected to use this case to push for tighter NIS2 enforcement on local food supply chain dependencies and third-party facility maintenance contracts.
Tomi Engdahl says:
Under the EU framework—specifically the NIS2 Directive for operators/retailers and the Cyber Resilience Act (CRA) for hardware/software manufacturers—non-compliance carries severe administrative, operational, and personal penalties.
1. Penalties for Retailers & Operators (NIS2 Framework)
NIS2 separates regulated businesses into Essential and Important entities. Grocery distribution networks, food logistics, and large supermarket chains fall under these categories.
Financial Fines (Essential Entities – Large Retailers/Distributors):
Up to €10 million or 2% of total global annual turnover, whichever is higher.
Financial Fines (Important Entities – Mid-Sized Operators/Franchisees):
Up to €7 million or 1.4% of total global annual turnover, whichever is higher.
2. Penalties for Equipment Manufacturers (Cyber Resilience Act Framework)
For manufacturers of industrial controllers (such as Danfoss, Dixell, or Copeland), the CRA establishes a three-tiered penalty structure based on the severity of non-compliance:
Tier 1 (Highest)€15 million or 2.5% of global annual turnover (whichever is higher)Failure to comply with essential cybersecurity requirements (e.g., shipping with default passwords, lack of patchability) or failing to report actively exploited vulnerabilities within mandated 24-hour/72-hour windows.
Non-Monetary Market Sanctions (CRA Enforcement):
Product Recalls & Sales Bans: Market surveillance authorities can force a manufacturer to withdraw non-compliant controllers from the EU market or issue mandatory recall notices for unsafe hardware.
Mandatory Software Fixes: Orders forcing immediate public disclosure and patch deployment for known exploits.
3. Civil & Contractual Penalties (The Private Sector Fallout)
Beyond regulatory fines, incidents like the refrigeration attacks trigger immediate civil exposure:
B2B Contractual Indemnification: Franchise owners and grocers suing HVAC installation contractors for breach of duty of care for leaving factory default credentials on internet-connected gear.
Supply Chain Losses: Liability claims for millions of euros in spoiled food inventory, store downtime, and emergency fire response costs.
Tomi Engdahl says:
https://www.facebook.com/share/v/1MKzfTYXTz/
Hackers who cranked up fridge temperatures in dozens of stores across at least eight European nations likely exploited a simple weakness: default passwords on open systems that were easy to guess, a cyber security expert explains
VIDEO
https://www.facebook.com/share/v/19sRUPQCVP/
Tomi Engdahl says:
https://www.facebook.com/share/p/19zPBjX7ZH/
Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors.
The FBI is seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk. Together with partners at CISA, HHS, USDA, and the Department of Transportation, we have issued a fact sheet with clear, practical steps that network defenders can take to reduce their risk and protect operations.
We urge every organization that relies on these systems to review our guidance, implement the recommended mitigations, and report any suspicious activity to the #FBI.
https://www.ic3.gov/CSA/2026/261105.pdf
Tomi Engdahl says:
Danfoss AK-SM 800A -sarjan järjestelmämanagerit (mukaan lukien mallit AK-SM 820A, 850A ja 880A) ovat keskitettyjä valvontayksiköitä, joita käytetään elintarvikekaupan ja kylmävarastojen ADAP-KOOL®-kylmäjärjestelmien ja LVI-automation ohjaukseen. Laitteisiin on kohdistunut vakavia tietoturvahaavoittuvuuksia, joita on havaittu hyödynnettävän myös aktiivisissa hyökkäyksissä
Tomi Engdahl says:
Tietoturvatutkijat (kuten Claroty Team82) ovat löytäneet AK-SM 800A -sarjasta kriittisiä haavoittuvuuksia, jotka liittyvät laitteen verkkohallintaliittymään:
• CVE-2025-41450 (Todennuksen ohitus): Laitteen koodista löytyi sisäänrakennettu “Code-of-the-Day” -varajärjestelmä, joka generoi päivittäisen järjestelmänvalvojan salasanan pelkän laitteen päivämäärän perusteella. Algoritmin takaisinmallinnus mahdollistaa kirjautumisen ohi normaalin käyttäjätunnistuksen.
• CVE-2025-41451 (Komentoruiskutus / RCE): Haavoittuvuus sähköpostiasetusten (alarm-to-mail) kentissä. Kirjautunut tai todennuksen ohittanut hyökkääjä voi suorittaa järjestelmätason komentoja (Remote Code Execution) ja ottaa laitteen Linux-käyttöjärjestelmän täyteen hallintaan.
• CVE-2025-41452 (Palvelunestotila / DoS): Nginx-palvelimen konfiguraatioruiskuun liittyvä virhe, jolla verkkoliikennettä voidaan manipuloida tai laitteen hallintasovellus (sm_app) kaataa.
• Vanhemmat haavoittuvuudet (CVE-2023-25913, -25914, -25915): Syötteen validoinnin puutteet ohjelmistoversioissa ennen versiota 3.3, jotka voivat johtaa laitteen täydelliseen kompromettoitumiseen.
Tomi Engdahl says:
Kylmänhallintajärjestelmät ovat kriittistä infrastruktuuria. Lokakuussa 2026 Euroopassa (erityisesti Ranskassa) raportoitiin laajasta hyökkäysaallosta, jossa hyökkääjät pääsivät käsiksi julkiseen internetiin suoraan altistettuihin Danfoss- ja Copeland XWEB -ohjaimiin. Hakkerit muuttivat sulatusjaksoja ja sammuttivat jäähdytyksiä, minkä seurauksena pakastimien lämpötilat nousivat ja kaupalle aiheutui miljoonien eurojen ruokahävikki.
Tomi Engdahl says:
https://www.danfoss.com/en/products/dcs/electronic-controls/products/system-managers/#tab-overview
Tomi Engdahl says:
https://www.facebook.com/share/v/1J1f2cgdAA/
Supermarket freezers across Europe were hacked and heated to 50°C (122°F) overnight. Nobody broke into the stores. The attack came through the internet.
How can someone control a freezer from another country? This reel starts from scratch:
• How a freezer controller keeps food cold (sensor → controller → compressor, plus defrost heaters)
• What the Internet of Things (IoT) is
• How a temperature becomes 1s and 0s, gets packed into packets with IP addresses, and travels through routers and fiber cables
• Why some controllers had a login page open to the whole internet, with username “admin” and today’s date as the password
• How internet scanners find exposed devices
Timeline: up to 700 stores in France hit in October 2026, then on 2 November, stores in Belgium, Sweden, Ireland, the Netherlands, Estonia, Finland and Luxembourg.
For your home: change default passwords, keep devices updated, and don’t expose cameras or smart devices directly to the internet.
#IoT #cybersecurity #internetofthings #TechExplained #europe #bitxbyte
Video
https://www.facebook.com/share/v/1AeCrjLdjh/
Tomi Engdahl says:
https://www.uusiteknologia.fi/2026/11/05/kaupan-pakastimien-takana-heikot-iot-nettisuojaukset/
Tomi Engdahl says:
https://www.kyberturvallisuuskeskus.fi/fi/uutiset/iot-ja-ot-ymparistojen-tietoturva-alkaa-laitteiden-suojaamisesta
Tomi Engdahl says:
Incident Response
Grocery Giant Ahold Delhaize Estimates Financial Toll of October Cyberattack
The October incident will cut fourth-quarter sales by up to €250 million and has led Ahold Delhaize to lower its 2026 outlook.
https://www.securityweek.com/grocery-giant-ahold-delhaize-estimates-financial-toll-of-october-cyberattack/
Dutch-Belgian grocery giant Ahold Delhaize estimates that last month’s cyberattack, which disrupted operations in the US and the Benelux, will wipe €200 million to €250 million ($224 million to $280 million) off its fourth-quarter net sales.
The company, whose brands include Albert Heijn, Delhaize, Food Lion and Hannaford, published the estimate this week with its third-quarter results. The attack occurred after the quarter had closed.
The cybersecurity incident is also expected to cost Ahold Delhaize €75 million to €100 million ($84 million to $112 million) in fourth-quarter underlying and IFRS operating income. On top of that, the company faces incident response and remediation expenses, but believes these will have little effect on its IFRS operating income for 2026.
As a result, the retailer has revised its 2026 guidance downward. It now projects diluted underlying earnings per share, at constant exchange rates, to grow in the low single digits, rather than in the mid to high single digits it had previously forecast.
Tomi Engdahl says:
Government
US Agencies Urge Organizations to Harden Refrigeration Controllers
The recommendations come amid attacks targeting fridges and freezers in supermarkets and blood banks in Europe.
https://www.securityweek.com/us-agencies-urge-organizations-to-harden-refrigeration-controllers/
The US government is urging healthcare, chemical, food, and transportation organizations to harden their industrial refrigeration and cold chain monitoring systems.
Over the past weeks, threat actors have been hacking monitoring systems to tamper with fridges and freezers in supermarkets and blood banks across Europe, causing millions in losses.
Hundreds of supermarkets were hit on October 11, when the attackers turned the temperatures in fridges to 50 degrees Celsius (122 degrees Fahrenheit) and set freezers to defrost, spoiling food and, in some cases, causing fires.
A second wave of attacks hit more than 100 supermarkets and a blood bank this week, but only supermarkets suffered losses. Quick action from staff prevented the compromise of blood products and samples, the French Blood Establishment (EFS) said.
Russian hacktivist groups such as Noname057(16) and Z-Pentest Alliance reportedly claimed hacking Danfoss, leading to speculation that they mounted the supermarket attacks. However, nothing has been confirmed, and Iranian hacktivists or state-sponsored hackers may also be responsible, BBC notes.
CISA, the FBI, HHS, USDA, and DoT say they “are aware of malicious cyber actors targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities.”
“The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards,” the agencies note (PDF).
Hackers may exploit authentication bypasses, code injection, and weak configurations to access the management systems and tamper with refrigerator and cold storage systems’ temperature or cause denial-of-view conditions, the agencies say.
According to internet intelligence firm Censys, out of 6,695 internet-exposed refrigeration controllers identified on October 9, only 3,124 (or 47%) remain accessible from the web as of November 5.
The company’s analysis covers the widely used Copeland/Dixell XWEB and Danfoss StoreView controllers: XWEB exposure dropped 35% (3,708 to 2,420), while StoreView dropped 76% (3,004 to 708).
Per the US government’s recommendations, taking the control systems off the internet is the best action organizations can take to prevent attacks. If web access is necessary, these systems should be protected by a firewall or edge device.
https://www.ic3.gov/CSA/2026/261105.pdf
Tomi Engdahl says:
CHILLING THREAT Fears Russian hackers behind Europe-wide fridge cyber attack after supermarkets left default ‘12345’ passwords
https://www.thesun.co.uk/news/40914759/russian-hackers-launch-europe-fridge-cyber-attack/
HACKERS who took out fridges across Europe causing millions of pounds worth of damage appear to be acting from Russia, a top cyber security expert has said.
Officials are yet to confirm who is behind the hack which targeted networks which had not changed their passwords from ‘12345’.
It is understood that hackers were able to crank up the heat of the freezers after gaining access by using the username ‘Supervisor’ and the password ‘12345’.
The affected freezers are believed to have been stuck using the default factory setting.
The known flaw had been publicly documented and widely circulated.
Tech experts working in the water industry, and gas and electricity grids, are believed to be on high alert for any attempt to disable their key systems.
Tomi Engdahl says:
https://www.politico.eu/article/russia-denies-involvement-in-fridge-hacks-across-europe/
Tomi Engdahl says:
Dmitri Peskovin mukaan Venäjän perusteettomasta syyttämisestä kaikesta mahdollisesta on tullut jokseenkin pysyvä trendi Euroopassa. https://www.is.fi/digitoday/tietoturva/art-2000012393147.html?utm_term=Autofeed&utm_medium=Toimitus&utm_campaign=is_ech
Tomi Engdahl says:
Pro-Russian hackers claim attack on supermarket refrigerators: “Systemic negligence”
https://www.retaildetail.eu/news/food/pro-russian-hackers-claim-responsibility-for-attack-on-supermarket-refrigeration-systems-systemic-negligence/
As predicted, the large-scale cyberattack on European supermarket refrigeration systems is taking on geopolitical implications. Two pro-Russian hacker groups have claimed responsibility for the sabotage that affected Delhaize, Carrefour, and Edeka, among others. However, that does not necessarily mean they are actually the perpetrators.
Refrigerators as cyberweapons
Following strong suspicions raised by cybersecurity experts, the hacker groups NoName057(16) and Z-Pentest are now claiming responsibility for the cyberattacks that disrupted refrigeration systems in a dozen European countries on Monday. They published their claim of responsibility on Telegram, along with what they say are 2,500 lines of data from a database belonging to the Danish refrigeration technology supplier Danfoss, including login credentials and passwords.
The groups explicitly place the blame on the affected companies. “The problem lies not with ‘malicious hackers,’ but with the systemic negligence of European and American operators who have ignored fundamental cybersecurity requirements for years,” states Z-Pentest.
Tomi Engdahl says:
TECH WARS Russia-linked hackers behind cyberattacks on Europe’s supermarkets are revealed as warning Brit blood banks could be hit
https://www.the-sun.com/news/17255007/
Tomi Engdahl says:
https://www.verkkouutiset.fi/a/laaja-kyberisku-kauppoihin-is-kylmalaitteissa-hairioita-myos-suomessa/?hl=en-US#2dfbbf73
Tomi Engdahl says:
Chilling. https://trib.al/MCTUB5q
Out for Blood
Hackers Break Into Blood Plasma Cold Storage Units, Cranking Up Temperatures in Attempt to Destroy Lifesaving Medical Resources
Too close for comfort.
https://futurism.com/health-medicine/blood-bank-cold-storage-hack?fbclid=IwdGRjcAVbLoFjbGNrBVsucWV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEfn9lWNSLiyLCSASDlBRUz57fhcBV9QUQuVFwrCoA-9AcJUj6rO-URLY6vCnw_aem_jNjN6_LQR6c13SAtb0MLww
Europe’s industrial scale fridges continue to be at the mercy of cybercriminals, who have claimed another victim in their chilling hacking spree.
The French Blood Establishment (EFS) confirmed that its cold storage units containing blood were compromised at three of its locations on Monday. The attack allowed the hackers to crank temperatures and defrost thresholds up to “excessively high levels,” it said in a statement translated from French by CNBC.
The attack targeted Coolword, the refrigeration system provider; the EFS blood bank just happened to be collateral damage, endangering a lifesaving medical cache.
“These cold storage units — located at EFS preparation and distribution sites — are used to store blood products prior to their delivery to healthcare facilities, as well as samples intended for EFS biobanks,” the EFS said.
The attack coincided with another attack on European supermarkets that same day, spoiling food as hackers set thermostats up to 122 degrees Fahrenheit.
No blood samples were lost, but it was a close call. The blood bank’s surveillance systems were activated immediately, allowing the compromised equipment to be either brought under control — or in some cases turned off — before the heat could damage the blood stores. The samples were then quickly transferred to other facilities, per CNBC.
The French health ministry said that the “situation is now under control and is being closely monitored,” per Reuters. “The safety of the blood supplies was preserved thanks to the facilities’ monitoring and alarm systems, as well as precautionary measures immediately implemented.”
The blood bank incident comes just two weeks after hackers hijacked the fridge and freezer systems of hundreds of supermarkets across France and parts of Europe. Several major food chains were affected, including Carrefour, which said that 80 of its locations were caught in the attack.
Tomi Engdahl says:
XWEB
XWEB300D_500D_500_OPR_GB.pdf https://share.google/gKhx4x6EmspGwkpFI
Tomi Engdahl says:
https://www.danfoss.com/en/industries/food-and-beverage/dcs/monitoring-and-management/#tab-overview
Tomi Engdahl says:
Suomessa varauduttiin kauppojen kylmälaitteisiin kohdistuviin kyberhyökkäyksiin ajoissa. Kyberturvallisuuskeskuksen ohjeistuksella haavoittuvia laitteita pyrittiin poistamaan avoimesta verkosta.
https://www.iltalehti.fi/digiuutiset/a/41d3cee4-148f-4ddc-a2a9-5446eaf20c64?utm_medium=Social&utm_source=Facebook&utm_variant=nativeimage#Echobox=1794035793
Tomi Engdahl says:
The attacks exposed basic security weaknesses in connected refrigeration systems, but experts warn that similar vulnerabilities could put everything from supermarket equipment to hospital and data centre infrastructure at risk.
https://l.euronews.com/hEKv
Hackers probed Europe’s fridge systems weeks before cyberattacks. Who did it and what could they target next?
https://www.euronews.com/2026/11/07/hackers-probed-europes-fridge-systems-weeks-before-cyberattacks-who-did-it-and-what-could-?fbclid=IwVERDUAVcKQBleHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABH_UXUXuGhTTgbe35U8sxJp0SPkCsFqFjm3KjoWS_BKjOut_AqUR0wbPwZU8Y_aem_OdsEciB56KRM-50Z8UdhZw
The attacks exposed basic security weaknesses in connected refrigeration systems, but experts warn that similar vulnerabilities could put everything from supermarket equipment to hospital and data centre infrastructure at risk.
Cybersecurity researchers say they detected hackers probing internet-connected refrigeration systems across Europe in the days before a wave of cyberattacks and incidents disrupted supermarkets and blood banks, with evidence suggesting it may have been part of a coordinated operation.
Refrigeration systems in supermarkets across nine European countries as well as several blood banks in France were attacked on 2 and 3 November.
Hackers exploited weak cybersecurity and vulnerabilities in manufacturer Danfoss’s AK-SM refrigeration system manager to put fridges and freezers on defrost settings, in some cases temperatures were set as high 50 degrees Celsius.
The incidents forced many grocery stores to throw away spoiled produce from their fridges and freezers and have become a very visible example of how easily cyberattacks can disrupt everyday life by targeting infrastructure systems that are often taken for granted.
For cybersecurity firm Lupovis, the signs point to a coordinated operation potentially involving a state actor — one that was preceded by days of probing.
The company says it saw a period of reconnaissance targeting these systems just days before the attacks.
The company observed over 276 attempts coming from 91 different threat actors matching specific components of Danfoss controllers during this 10-day period. Activity peaking on 26 October, before coming to a halt at the end of the month.
“Between the 20th and 30th of October, what we saw was a wave of what we call reconnaissance,” CEO Xavier Bellekens told Euronews Next.
“Between the 20th and 30th of October, what we saw was a wave of what we call reconnaissance,” CEO Xavier Bellekens told Euronews Next.
“We see a huge peak suddenly for 10 days where adversaries are trying the default passwords. They are trying a couple of those vulnerabilities.”
Lupovis operates a system of so-called “honeypots”, which replicate its clients’ online systems and technologies. The company equips them with sensors and then deliberately exposes them to hackers, encouraging attacks so it can track how these systems are accessed and exploited.
This intelligence can then be used to identify vulnerabilities without putting the clients’ real systems at risk.
It was through this system that Lupovis, whose clients include the Scottish government, Orange, Telefonica and a number of retail companies, detected what it describes as “reconnaissance” on Danfoss systems in the days before November’s attacks.
“You can think of it as like burglars, driving through your neighbourhood and identifying the houses they are going to go and break into,” said Bellekens.
Who was behind the attacks?
Lupovis then traced what it describes as the digital “breadcrumbs” left by the probing and attacks, finding that so-called “bulletproof hosting” was used — web hosting services that are designed to resist takedown requests and law enforcement intervention.
“On the one hand, you have Amazon Web Services, they are the opposite of a bullet-proof hosting. If you do something malicious with one of their servers, that’s it, they cancel your account. Bulletproof hosting is the opposite. You do something malicious, It’s out of jurisdiction,” Bellekens said.
“We realised that some of those bulletproof hosting had been used by Russian groups in the past,” says Bellekens.
According to the CEO, Lupovis sensors in South America, Africa, North America and Asia did not record the same activity. It was only picked up by sensors in Europe.
He also believes the ability to coordinate attacks across Europe helps narrow down the list of suspects.
“You [the attacker] have to be able to coordinate this attack because most of it happened within a 24-hour period.”
“All of this makes us point to an adversary that, to us, is not a script kiddie [an unskilled amateur]. They are not a lone wolf. It looks like a well-planned operation. So a state fits the bill.”
“When we pull on the thread it does look like it could well be Russia. So, that is basically where we’re at.”
The incidents come amid wider concerns about hybrid threats and suspected Russian-linked activity targeting European countries.
However, the precise identity and motivation of the attackers remain unclear.
George Nott, technology editor at The Grocer, said the attacks appeared to have relied on relatively basic security weaknesses rather than highly advanced hacking techniques.
“Attackers managed to access refrigeration systems by simply finding their log-in pages on the open internet, and exploiting already patched vulnerabilities and weak passwords rather than some highly advanced technology,” he told Euronews Next.
Tomi Engdahl says:
Hack of Danfoss refrigeration controllers in Europe causes tens of millions in food losses
Hack of Danfoss refrigeration controllers in Europe causes tens of millions in food losses | Facilities Dive https://share.google/DzCSn1o4oWgTAPryi
The incident, which affected hundreds of European supermarkets, should be a wake-up call to U.S. facilities with internet-vulnerable building automation systems, a security specialist says.
Facilities Dive
Sign up
menu
Dive Brief
Hack of Danfoss refrigeration controllers in Europe causes tens of millions in food losses
The incident, which affected hundreds of European supermarkets, should be a wake-up call to U.S. facilities with internet-vulnerable building automation systems, a security specialist says.
Published Oct. 13, 2026
Robert Freedman’s headshot
Robert Freedman
Lead Editor
Share
License
Add us on Google
Add us as a Google Preferred Source to see more of our articles in your search results.×
Danfoss, grocery store refrigeration system breach, Modbus, Intermarché, Carrefour, Coopérative U, E Leclerc
Intermarché La Pallice supermarket photographed June 28, 2019, in La Rochelle, France. Intermarché is among the European grocery store companies whose refrigeration systems were breached on Oct. 12, 2026, causing widespread loss of refrigerated products. AdrianHancu via Getty Images
Dive Brief:
Hundreds of European supermarkets were forced to throw away tens of millions of dollars worth of grocery products Monday when hackers accessed a network-vulnerable control system and locked refrigeration units into defrost mode for several hours, according to news reports.
Danish control system manufacturer Danfoss, which acknowledged the breach of its systems late Monday, said its AK-SM800 and AK-SC355 refrigerator regulator systems were involved in the incident. In a statement to Agence France-Presse, Danfoss called most of the affected equipment “legacy” products that “no longer receive software or security updates,” AFP reported.
Danfoss, a major supplier of building control systems in the United States, told AFP that it has long advised supermarkets to update the firmware of these models and to “migrate legacy systems to current-generation solutions.”
Dive Insight:
By locking the defrost setting on, the hackers raised the temperature of the refrigeration units to up to 122 degrees Fahrenheit overnight, Reuters reported.
Units in France, Spain, Portugal, Poland, Germany and Belgium were affected, Reuters reported based on an analysis by Sekoia Threat Detection and Research, a private cybersecurity company.
An estimated 150 refrigeration units operated by Intermarché, a France-based grocery store chain, were affected. Units in stores owned by Carrefour, Coopérative U and E Leclerc, among other European grocery stores, were also affected, according to reports.
“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented,” Coopérative U CEO Dominique Schelcher said in a statement Monday posted on X.
Cybersecurity specialists have been raising concerns over network-connected building system vulnerabilities for years, in part because of their reliance on protocols that were designed decades ago without security in mind. In Europe, Modbus is a widely used communication protocol for building automation systems, according to a report by Armis from ServiceNow. The DanfossAK-SM800 and AK-SC355 refrigerator regulator systems are on Modbus, according to Danfoss documentation on its website. The company didn’t immediately respond to a request for comment.
“The cyber attack … should raise the alarm for any company that is responsible for handling temperature-sensitive products,” he wrote. “Industrial control systems such as refrigeration controllers are often assumed to be on safely isolated networks [but] many of these devices are directly exposed to the public internet.”
Cybersecurity specialists previously flagged the Danfoss vulnerabilities. The U.S. Cybersecurity and Infrastructure Security Agency published an advisory on an authentication flaw in Danfoss’s AK-SM 800A system managers. And Claroty’s Team82 unit called out that system’s vulnerabilities in August.
“Our research uncovered a hidden ‘code-of-the-day’ authentication mechanism that could be abused to bypass normal authentication,” the Claroty analysis said. Other vulnerabilities were found as well.
In a report released earlier this month, Armis from ServiceNow said 73% of organizations have at least one known exploited vulnerability in their building systems. That exposure is likely to grow, it said, because 91% of the systems that organizations are using communicate over insecure protocols.
The high proportion of vulnerable systems stems in part from the legacy BACnet standard that most building systems in the U.S. use, the company says. The standard was introduced in the 1990s without security protocols because the systems at the time weren’t network-connected. The widely used Modbus standard in Europe has the same legacy vulnerabilities, according to the Armis from ServiceNow report.
“Modbus and similar standards were built for reliability in isolated networks, often without authentication or encryption,” the report says.
Having network-connected systems makes maintenance easier and reduces costs because it enables engineers to troubleshoot issues remotely, Preminger said. But “it also lowers the barrier to entry for attackers.”
Tomi Engdahl says:
Russian hacktivists have claimed some of the attacks
Hacked blood banks, breached supermarket fridges and plane bomb hoaxes: What’s going on in Europe?
After a week in which several European sectors were thrown into disarray, how concerned should the continent be of hybrid warfare by hostile adversaries? Alex Croft reports
https://www.independent.co.uk/news/world/europe/uk-europe-cyber-attacks-b3079159.html?fbclid=IwdGRjcAVcWW5jbGNrBVxZXmV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEfCYFDsGBuAzl4XjWZgjYRsJEmbDCNEJddx2BG16eta1dw8DztTVet7ddOP00_aem_sCcKf94FNmPWso_bLc7-2A
Tomi Engdahl says:
controllers with poor security (outdated firmware) connected to Internet without firewall protecting it (like shown on documentation). You can blame the equipment manufacturer, installers and owners
Tomi Engdahl says:
they have multi security system with many configurable setting. Then all that is managed through web control interface. Once you get in, you can change almost all settings, and that’s what they seem to have done. The web control interface authentication was an operational joke – many have not changed the default password!
And still connected it directly to Internet (which was not recommended).
There were also an other other way to get in…
Tomi Engdahl says:
world needs to have people who knows cyber security – so this type of systems would be built so that they are safe and risks are analyzed.
There seems to be too much ignorance and sloppiness throughout this cool storage industry! And many industries.
Tomi Engdahl says:
The AK-SM series is widely used in the United States. Major US supermarket chains and commercial refrigeration contractors utilize Danfoss AK-SM system managers to oversee compressor racks, monitor display case temperatures, manage defrost cycles, and coordinate energy optimization (including integration with \text{CO}_2 refrigeration systems).