When the Freezer Becomes an Oven: Europe’s Supermarket Refrigeration Attacks

For the second time in about three weeks, attackers have remotely taken over refrigeration controllers in European supermarkets and turned fridges and freezers into warming cabinets. The first wave hit France and nearby countries on the night of 11–12 October. The second wave came overnight into Monday 2 November and reached somewhere between seven and ten European countries. In both waves the hardware involved was mostly made by Danfoss, the Danish company whose controllers run refrigeration in a large share of Europe’s grocery stores.

Nobody had broken into the stores themselves. The attackers reached small web-managed controllers that had been left reachable from the public internet, and they changed a few settings.

Wave one: France, 11–12 October

On the night of 11 October, refrigeration controllers in hundreds of French supermarkets were switched into defrost mode while the cabinets were still full. Defrost mode is normally a short, scheduled cycle that melts ice off the evaporator coils. Left running for hours, it heats the cabinet. Alarms reportedly did not go off, and few staff were in the stores overnight.

By morning, many cabinets had reached around 50 °C (122 °F), and one store in Normandy reported 80 °C. Estimates of the number of stores range started from about 150 and later was increased up to 700. Affected chains included Intermarché, Netto, Carrefour, Coopérative U, Monoprix and E.Leclerc. Food losses were estimated in the tens of millions of euros. Reports also placed affected sites in Belgium, the Netherlands, Spain, Portugal, Poland and Germany.

France’s national cyber agency ANSSI, through its response team CERT-FR, published an alert on 12 October and updated it on 13 and 16 October. The alert names four product families: Danfoss AK-SM series, Danfoss AK-SC series, Copeland XWEB and Dixell XWEB. Prime Minister Sébastien Lecornu told ANSSI to investigate and to coordinate with other European countries.

Wave two: Europe, 2 November

The second wave followed the same pattern on a wider scale. Overnight into Monday 2 November, supermarket fridges and freezers were again pushed into defrost mode, with temperatures reported at about 50 °C. Belgium, Luxembourg, the Netherlands, Sweden, Finland, Estonia, Ireland and Italy were affected, along with reported incidents in Greece. Reported victims included Coop and ICA in Sweden, Ahold Delhaize stores in Belgium, the Netherlands and Luxembourg, and Spar and Carrefour in Belgium. Small independent shops were also hit, including a butcher near Athens.

An ICA spokesperson said all of its affected stores were connected to an outside refrigeration control system supplied by Danfoss. EU agriculture commissioner Christophe Hansen called it “a deliberate attempt to disrupt our food supply chain.” A European Commission spokesperson said the incidents “are not isolated” but would not say who was behind them.

The equipment: two retired models and one current one

Reporting points to three Danfoss products:

After the first wave, Danfoss confirmed that AK-SM800 and AK-SC355 systems were involved. The company described most of the affected equipment as “legacy” products that no longer get software or security updates, and said it had long urged customers to update firmware and move to current-generation systems.

The AK-SM 800A is a more uncomfortable case because it is still sold and supported. Its weaknesses are already public. In 2025 Danfoss published advisory DSA-2025-08-01, and CISA published ICS advisory ICSA-25-140-03 on an authentication flaw in AK-SM 800A system managers. In August 2026, Claroty’s Team82 described three vulnerabilities in detail:

• CVE-2025-41450: an authentication bypass through a hidden “code of the day” mechanism (CVSS 8.2)
• CVE-2025-41451: an OS command injection in the alarm e-mail settings, giving remote code execution after login (CVSS 7.6)
• CVE-2025-41452: an Nginx configuration injection that can cause denial of service (CVSS 5.4)

For more details of those vulnerabilities, read those documents:

• Team 82: Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers
• Censys: Frostbitten in France: A Danfoss StoreView Internet Exposure Report

Firmware R4.3.1 fixes these. According to the reporting, the AK-SM 800A units that were hit were the ones never updated to it. Claroty counted 2,765 AK-SM 800A devices exposed to the internet in a Censys scan, and other estimates put the number of reachable Danfoss controllers higher.

Security researcher Kevin Beaumont described the login logic on some of these devices as a password that is simply the current date. Claroty’s analysis of the same “code of the day” logic treats it as a hidden bypass rather than a default password. Either way, the result is the same: anyone who finds the controller online can log in.

No zero-day needed

Experts agree on one point: this was not sophisticated hacking. Darktrace’s Nicole Carignan said attackers got in through internet-facing controllers, end-of-life firmware and default passwords, and that no zero-day was used. Richard Horne of the UK’s NCSC said the French fridges had been connected directly to the internet with default passwords. UK cyber minister Liz Lloyd called the French attack exploitation of known vulnerabilities.

So far nobody has claimed responsibility or been named. Investigators have not established a motive. Some researchers have pointed out that the attack is simple enough for opportunistic hackers, while others note that state actors have the capability too. Both waves struck overnight, used the same technique and spread across borders, which looks more like a coordinated campaign than random vandalism.

What operators should do now

The CERT-FR alert has the clearest practical guidance:

1. Take the controllers off the internet. Remove any direct internet exposure and any device with a public IP address.
2. Use only secure remote access. Service contractors should connect through a VPN or protected network. Filtering contractor IP addresses on a firewall is acceptable as an emergency measure only, not as a permanent fix.
3. Patch and harden. On current Danfoss systems, update the firmware (R4.3.1 or later for the AK-SM 800A), set the security level to Strict, and make sure default passwords have been changed.
4. Check the configuration, especially defrost schedules, before putting a unit back into service.
5. Don’t rely on a factory reset. A reset end-of-life device is still vulnerable. CERT-FR warns that leaving an unpatched EOL controller on the internet will very likely lead to compromise again.
6. Plan to replace the AK-SC355, the AK-SM800 and any other unsupported controllers.

Retailers should also make sure temperature alarms are monitored independently of the controller that might be compromised. In both waves, the alarms that should have woken someone up apparently stayed silent.

The bigger lesson

Refrigeration is part of the food supply chain, and in hospitals and blood banks it can be safety-critical. Yet these controllers are often installed and maintained by outside contractors, connected to the internet for remote service, and then left alone for ten years or more. As Professor Aikaterini Mitrokotsa of the University of St. Gallen told AP, a fridge does not look like a security risk, and that is exactly why attackers like it.

The patches and guidance for these devices were already available before the attacks. What was missing was an inventory of the devices, a plan to retire old ones, and the habit of treating a fridge controller as an internet-connected computer. A third wave is likely, and every store with an exposed controller is a candidate.

I post links to security vulnerability news to comments of this article.

You are also free to post related links to comments.

Over the past six years ABB has sold off the grid business it built in Finland, then started buying its way back in, this time on its own terms. Two things happened in 2026 that show where it’s going. ABB bought Finnish grid automation company Netcontrol, and it announced a joint venture with Mitsubishi Electric aimed at Asia. To see why these deals matter, start with what ABB gave up.

The Big Exit: Power Grids Goes to Hitachi (2020–2022)

In 2020 ABB completed the multi-billion-dollar sale of its global Power Grids division to Hitachi. The business first operated as Hitachi ABB Power Grids. Hitachi bought out ABB’s remaining share in 2022, and the company is now Hitachi Energy.

The deal took a lot of Finnish industrial history with it. High-voltage power transmission, large-scale utility infrastructure and grid automation software all left ABB:

• The transformer factory in Vaasa: This large, historic plant designs and builds specialized transformers for power grids, wind farms and heavy industry. Transformers have been made industrially in Finland for over 110 years.
• The MicroSCADA product line: The whole R&D team and ownership of the product went too.
• Grid automation and systems: The engineering, service and project delivery units for high-voltage substations and utility-scale systems also moved.

MicroSCADA: A Finnish Success Story Changes Owners

MicroSCADA probably has the deepest Finnish roots of anything in the deal. The Finnish electrotechnical company Strömberg Oy created it in Vaasa in the early 1980s, and Strömberg later became part of ABB. Over four decades, MicroSCADA grew into a widely used system for monitoring and controlling power networks and substations.

MicroSCADA had always been a core Power Grids product. So when that division went to Hitachi, ABB didn’t really choose to sell MicroSCADA on its own. It went along with the rest of the division.

One thing stayed the same: Vaasa. The main global R&D and product development center for MicroSCADA is still there. It now belongs entirely to Hitachi Energy Finland Oy, and the product turned 40 in 2023 under its new owner.

What ABB Kept

ABB didn’t leave Finland, and it didn’t stop doing electrification. It narrowed its focus to electrification and industrial technology, the products that sit closer to factories, buildings and the distribution grid:

• Distribution Solutions (Smart Power & Electrification): This is ABB’s large unit in Vaasa. It designs and makes medium-voltage switchgear, protection relays such as the Relion series, and smart grid components.
• Motors and Generators: Finnish factories and engineering teams build heavy-duty industrial motors and generators.
• Drive Products: These teams work on low- and medium-voltage variable speed drives, which make industry more energy efficient.

In short, ABB kept the medium-voltage and industrial side of electrification. Hitachi Energy got the high-voltage transmission side. ABB also has ABB’s Symphony SCADA and distributed control system (DCS) lineage.

Back to SCADA in Finland: The Netcontrol Acquisition (2026)

You might have expected ABB to stay out of utility SCADA after selling MicroSCADA. It hasn’t. In May 2026 ABB completed its acquisition of Netcontrol, a Northern European company started in Finland that sells grid automation solutions to energy companies. Netcontrol has SCADA software, SCADA RTUs and utility communications solutions.

Netcontrol was founded in 1991 and has about 100 employees. It is headquartered in Helsinki, and also has offices in Sweden, Norway and the UK. Before the sale it was owned by the Swedish private equity firm Procuritas Partners.

Netcontrol’s customers are mostly network operators. They include electricity distribution companies, district heating companies, power producers and energy-intensive industry.

Netcontrol’s business rests on the Netcon product family. It covers the whole automation chain, from field devices up to the control room:

• Netcon 3000 SCADA: This is the main platform for supervising and controlling power networks. It is built to handle distributed energy resources such as solar, wind and storage, which have made distribution grids much harder to run.
• Netcon RTUs and substation devices: These remote terminal units and gateways collect data from substations and secondary substations, and carry out control commands sent from the SCADA system. Netcon 5000 is sold under the ABB brand.
• Medium- and low-voltage network monitoring: Products such as Netcon 100 were developed to monitor and control medium-voltage networks and to monitor low-voltage networks. Netcon 200 is already sold under the ABB brand as a medium-voltage grid component.
• Engineering services. Netcontrol also designs, integrates and commissions complete automation systems.

Finland’s power automation scene is small, and for decades two domestic SCADA products shared it. MicroSCADA came from Strömberg’s Vaasa tradition and grew into a global product under ABB. Netcontrol, founded in Helsinki in the early 1990s, took a different path. It focused on the needs of Nordic distribution companies and offered a complete package of SCADA, RTUs and engineering from one supplier.

That focus let Netcontrol win against much bigger international suppliers. It grew from Finland into Sweden, Norway and then the UK. In 2025, Vattenfall’s UK independent distribution network business, Vattenfall IDNO, chose Netcontrol for network automation. Vattenfall hosts Netcon 3000 in its own secure industrial cloud, and Netcon RTUs connect its sites to it. The goal is faster fault detection, less downtime and better service continuity.

Developed by Netcontrol, Netcon 3000 is a prominent Supervisory Control and Data Acquisition (SCADA) and energy management software platform widely deployed across power generation and distribution networks, particularly in the Nordic region. It is engineered to provide robust real-time process visualization, comprehensive alarm handling, and detailed event history tracking for electrical power systems. While the foundational software architecture was built on the core iFIX realtime database engine and SCADA framework, Netcontrol extensively reworked and replaced major subsystems over several generations of development. Through companion hardware like Netcon gateways running Netcon NFE software, the system supports conversion across more than 50 serial and IP-based telecontrol protocols, ensuring smooth integration with legacy RTUs and modern IEC 61850 substations.

This creates a twist. In 2020, MicroSCADA, the system ABB had owned and developed for decades, went to Hitachi Energy. Six years later, ABB owns the competitor that had been bidding against MicroSCADA for Nordic utility contracts all along. In Finland, the two Finnish SCADA systems now compete under two global brands, one Japanese-owned and one Swiss-Swedish.

The reasoning is clear, though. Distribution networks are getting more complicated because of renewables, EV charging and electrified heating, and utilities want automation software that works with the switchgear and relays ABB already makes. With Netcontrol, ABB can again offer a software and systems layer to go with its hardware.

Heading East: The Mitsubishi Electric Joint Venture

ABB’s newest move is outside Europe. On the back of record Q3 orders, driven largely by surging data centre demand], ABB announced a joint venture with Mitsubishi Electric to grow in the Asia-Pacific region.

The terms, according to reports:

- ABB’s Japanese unit will buy 51% of Mitsubishi Electric’s power distribution and control equipment business for about ¥82.4 billion (approximately €467.62 million Euros)
- Mitsubishi Electric will keep 49%.
- Completion is planned for October 2027, pending antitrust and other approvals.

The joint venture fits the same pattern. ABB isn’t buying back high-voltage transmission. It’s adding to the distribution and electrification business, which is growing fast because of data centres and electrification in general.

The Bigger Picture

Put all this together and you get a company that is cleanly splitting its business:

2020–2022: Power Grids sold to Hitachi (incl. MicroSCADA, Vaasa transformers) – Leave high-voltage transmission, Keep distribution, motors, drives in Finland, Focus on electrification and industry
May 2026: Acquire Netcontrol – Add grid automation software to distribution
2026–2027: Mitsubishi Electric JV (51%) – Grow distribution in Asia-Pacific

Vaasa is an unusual case. It’s now home to two global companies whose grid businesses have the same origins. Hitachi Energy builds transformers and develops MicroSCADA there. A short distance away, ABB makes switchgear and protection relays. Both businesses come out of the same Strömberg engineering tradition (Strömberg became part of ABB in 1988), which still shapes how the world’s electricity grids are run.

Over the next few years we’ll see whether ABB’s strategy of staying medium-voltage while adding software and growing in Asia pays off. With electrification and data centre demand accelerating, its timing looks good.

About the Author: A View from Inside Netcontrol

This article isn’t written from the outside. Its editor, Tomi Engdahl, worked at Netcontrol for twenty years, from 2003 to 2023. During that time he worked on several parts of the Netcon product family described above:

• NFE (Network Front End): He has been a developer Netcontrol’s NFE software, which works as a SCADA front end, a protocol converter, and an RTU communications concentrator or gateway.
• SCADA components: He has built software components for Netcontrol’s SCADA systems.
• Netcon 100: He was the system architect for Netcon 100, a system for monitoring and controlling medium-voltage networks and monitoring low-voltage networks.
• Netcon 200: He was also the system architect for Netcon 200, which ABB now sells under its own brand as a medium-voltage grid component.
• Netcon 500: He has been one of the center persons in developing GW502 processor module running a hardened, long-term support Linux kernel. The Netcon 500 is a cybersecure, modular Remote Terminal Unit (RTU) and substation automation gateway designed primarily for primary power distribution substations, industrial grids, and utility automation.

He left Netcontrol in 2023, two years before ABB announced the acquisition, so he played no part in the deal. He did see the years and contributed to products that made Netcontrol worth buying. Over those two decades it grew from a Finnish company into a supplier for utilities in Sweden, Norway and the UK. Distribution networks also changed in that time, from basic remote control of substations to real-time monitoring all the way down to the low-voltage grid.

That background shapes how he sees this story. When MicroSCADA left ABB for Hitachi Energy, it was business news. When ABB bought Netcontrol, it was more personal. Products he designed as system architect now carry the ABB name and will be sold worldwide, while their old rival from Vaasa continues under Hitachi Energy.

Many Finnish engineers built their careers on one side of this rivalry or the other. Equipment from both companies keeps power networks running in Finland and beyond. This article has tried to cover both sides fairly. Readers should know the author spent twenty years on the Netcontrol side.

While modern communications have largely shifted to fiber optics and digital packets, legacy copper pairs (POTS—Plain Old Telephone Service) and specialized analog telemetry loops remain widely deployed. Because these lines often run outdoors for hundreds of meters—or even kilometers—they act as giant antennas.

When a nearby lightning strike, power line induction, or electrostatic discharge (ESD) occurs, high-energy transients can travel directly down the copper pair. Without proper over-voltage protection, these surges will instantly destroy sensitive modem chipsets, telephone interfaces, or monitoring hardware.

Drawing from a robust design originally conceived in 1995 that has stood the test of time for nearly three decades, this post revisits the architectural philosophy of building a multi-stage surge protector capable of handling thousands of volts without sacrificing signal integrity.

The surge path on a POTS line is often underestimated, and a proper clamping stage plus a series resistor is what actually saves the modem front end.

The Engineering Challenge: High Energy vs. Fast Response

Designing an effective transient voltage suppressor for telecommunications requires balancing two contradictory demands:

1. Handling Massive Energy: Direct or indirect lightning strikes deliver thousands of amperes with high microsecond-to-millisecond energy profiles.

2. Preserving Signal Transparency: The circuit must not degrade normal telephony operations, which include low-frequency audio (300 Hz–3.4 kHz), high-voltage ringing signals (up to 90–110 V RMS AC), and high-impedance DC idle voltages (~48 V DC).

Here is the picture of the telephone line protector product. It is designed to be installed to a DIN rail within and automation cabinet. There are screw connections for line IN and OUT. In addition to there is a flat metal “abiko” contact for good ground connection. The IN side connects to the phone line connected to outdoor telephone network. The OUT side is connected to the modem.

Grounding is Everything: A surge protector is only as good as its earth connection. The ground lead from protector grounding connection must be kept as short and thick as possible, tied directly to a low-impedance earth ground.

Let’s see what is inside (old 1990′s version):

That white thing is a deal gas discharge tube over-voltage protector that dissipates most of the over-voltage surge. It is followed with two other layers of protection (VDR and surge protectors. There are multiple protection components because no single component can handle both extremes effectively. A component tough enough to absorb a lightning bolt is usually too slow or has too much parasitic capacitance, whereas a fast semiconductor clamp would instantly burn out from a heavy surge.

The solution is a coordinated, multi-stage protection cascade that divides and conquers the transient energy across progressive layers. This design works well with normal telephone lines and fixed modem-to-modem wired connections.

1. Stage 1: The Primary Heavy Lifter (Gas Discharge Tube)
The Component: A heavy-duty ceramic/glass Gas Discharge Tube (GDT)—represented by the white cylindrical element in the hardware layout.
Role: The first line of defense connected directly between the incoming tip/ring lines and earth ground.
How it works: Under normal conditions, the noble gas inside the tube acts as an insulator with extremely high resistance and low capacitance. When a high-voltage surge exceeds the DC breakdown voltage (typically 230V–350V+), the gas ionizes and creates a low-resistance plasma arc.
Advantage: GDTs can divert massive surge currents (often 5kA to 20kA+ per line) safely to ground.

Limitation: They have a relatively slow response time (taking a fraction of a microsecond to fire) and will “follow-on” with a short circuit if DC holding current is present, which is why subsequent stages are necessary.

2. Stage 2: The Medium Clamping Layer (VDR / MOV)
The Component: A Varistor (Voltage Dependent Resistor / MOV) placed downstream of the primary GDT.
Role: Bridges the gap between the coarse, high-voltage breakdown of the GDT and the sensitive semiconductor electronics downstream.
How it works: As the transient voltage rises, the MOV’s resistance drops non-linearly, clamping the peak voltage to a safer intermediate window before it reaches the final stage.

Coordination: A small series resistance or inductance is typically placed between Stage 1 and Stage 2. This delay/impedance ensures the slow-igniting GDT has enough time to fire and take the brunt of the high-energy pulse, preventing the MOV from taking the full direct strike energy.

3. Stage 3: The Precision Clamping Layer (Surgector / Transient Diodes)
The Component: A fast semiconductor clamping device (such as a thyristor surge protector/surgector or fast avalanche diode network).
Role: The final gatekeeper right before the protected electronics.
How it works: Semiconductors react in nanoseconds, clipping any remaining high-frequency spikes or voltage overshoot that escaped the GDT and VDR stages.

Final clamping level: Ensures that the voltage differential seen by the modem or transceiver IC never exceeds absolute maximum ratings (typically matching or slightly above the maximum ringing voltage envelope).

A coarse GDT handles the massive bulk energy of a slow surge, while a coordinated series resistor and downstream fast semiconductor clamp (like a low-capacitance TVS diode array) catch the fast-rising initial transient that the GDT missed.

Fusing & Fail-Safe Design: In catastrophic failure modes (e.g., continuous power-cross where high-voltage AC mains accidentally short onto the telephone line), components like MOVs can overheat and short. The resistors used in this design are resistors that will safely fail in case if serious overload. This fail-safe mechanisms ensures the device fails open safely without causing a fire hazard. The gas discharge tube voltage rating is selected according to telephone line protection requirements (will not conduct in expected failure cases for phone line when it should not, like grounding failure or mains voltage touches line).

Limitations of this design: Because telephone lines cab carry voice and data (such as ADSL or FSK caller ID), excessive parallel capacitance from protection components will attenuate high-frequency signals. This design was originally designed for normal analogue telephone frequencies in mind, and as higher capacitance than what is preferred with ADSL frequencies (not tested but analyzed that would attenuate ADSL signals considerably).
When protecting high-speed data lines (such as VDSL2, ISDN, Ethernet, or industrial serial buses), choosing between Gas Discharge Tubes (GDTs) and Metal Oxide Varistors (MOVs / VDRs) involves a strict engineering trade-off between energy handling capability, response speed, and parasitic capacitance. GDTs Win Here: GDTs consist of two or three metallic electrodes separated by a noble gas inside a small ceramic or glass capsule. Because the dielectric medium is primarily gas, the parallel capacitance is negligible (often under 1 pF). This makes GDTs virtually invisible to high-frequency signals, preserving eye patterns and preventing signal attenuation on fast differential data lines. MOVs are generally unsuitable for direct placement across high-speed data lines. Instead, engineers typically use a coordinated two-stage hybrid architecture combining a heavy-duty Gas Discharge Tube (GDT) for coarse energy dissipation and a ultra-low-capacitance Transient Voltage Suppression (TVS) diode array for precision clamping. My original design would have needed some component values changes to work well with ADSL signals – that would have been probably been some simple design changes, but the testing and re-certifying the modified version would have have taken too much effort (time and money) to be feasible.

Over the time some of the components needed to be be changed due component availability. Here is a picture if one later version:

There is was another version that has transformer isolation. This is designed to work with fixed line modem-modem connections. The transformer provides isolation between incoming line (several kV). This arrangement can provide protections against ground potential rise situations. This second transformer isolated version is built to the same circuit board as the first version shown above.

Links to related material:
https://www.epanorama.net/blog/2025/03/03/phone-line-over-voltage-protection/
https://www.epanorama.net/documents/surge/telesurge.html
https://www.epanorama.net/documents/surge/surgesuppres.html

When you enter an FCC ID, FCCID.io finds the matching filing and presents it more clearly than the FCC’s own search tool. A filing typically includes:

• Test reports with RF exposure (SAR) and emissions measurements
• Internal and external photos, often showing the circuit boards before the product is released
• User manuals, block diagrams and schematics, when they aren’t held confidential
  Frequency ranges, output power and grant dates

• Information about the company that filed the application

The site is popular with electronics hobbyists, repair technicians, security researchers and tech journalists. People use it to identify unknown devices, find the radio chips inside a product, get manuals for older equipment, or spot new products in FCC filings before they’re announced. When hardware manufacturers want to sell wireless or RF-emitting devices in the US, they are legally required to submit these teardowns and test reports to the actual government.

While fccid.io mirrors official United States government data, the website itself is not run by the Federal Communications Commission (FCC). It is an independent, third-party database. It acts as a scraper and web mirror. The official government portal (run by the FCC’s Office of Engineering and Technology) can be notoriously slow, clunky, and difficult to navigate. The creators of fccid.io scraped that public data to build a faster, highly indexed, and much more user-friendly search engine. Every single schematic, block diagram, user manual, and internal photo you see on the site in said to come straight from the official FCC Equipment Authorization Electronic Filing System (EAS). fccid.io simply packages that public domain data into a cleaner interface (and monetizes it via web ads).
If you ever need the absolute, primary source without the third-party middleman, you can use the official government tool at apps.fcc.gov/oetcf/eas/reports/GenericSearch.cfm.

Go to web site https://fccid.io/

Look this video:

Check also older 555 post
https://www.epanorama.net/blog/2011/02/07/555-timer-design-contest/

Read the rest at https://www.instagram.com/p/Dd6QYxEiGbH/?img_index=1