When the Freezer Becomes an Oven: Europe’s Supermarket Refrigeration Attacks

For the second time in about three weeks, attackers have remotely taken over refrigeration controllers in European supermarkets and turned fridges and freezers into warming cabinets. The first wave hit France and nearby countries on the night of 11–12 October. The second wave came overnight into Monday 2 November and reached somewhere between seven and ten European countries. In both waves the hardware involved was mostly made by Danfoss, the Danish company whose controllers run refrigeration in a large share of Europe’s grocery stores.

Large commercial supermarket refrigeration systems are connected to network management units (like Danfoss StoreView or AK-SM controllers) to monitor and control temperatures, automate defrost cycles, and manage food safety alarms remotely.

Nobody had broken into the stores themselves. The attackers reached small web-managed controllers that had been left reachable from the public internet, and they changed a few settings.

Wave one: France, 11–12 October

On the night of 11 October, refrigeration controllers in hundreds of French supermarkets were switched into defrost mode while the cabinets were still full. Defrost mode is normally a short, scheduled cycle that melts ice off the evaporator coils. Left running for hours, it heats the cabinet. Alarms reportedly did not go off, and few staff were in the stores overnight.

By morning, many cabinets had reached around 50 °C (122 °F), and one store in Normandy reported 80 °C. Estimates of the number of stores range started from about 150 and later was increased up to 700. Affected chains included Intermarché, Netto, Carrefour, Coopérative U, Monoprix and E.Leclerc. Food losses were estimated in the tens of millions of euros. Reports also placed affected sites in Belgium, the Netherlands, Spain, Portugal, Poland and Germany.

France’s national cyber agency ANSSI, through its response team CERT-FR, published an alert on 12 October and updated it on 13 and 16 October. The alert names four product families: Danfoss AK-SM series, Danfoss AK-SC series, Copeland XWEB and Dixell XWEB. Prime Minister Sébastien Lecornu told ANSSI to investigate and to coordinate with other European countries.

Wave two: Europe, 2 November

The second wave followed the same pattern on a wider scale. Overnight into Monday 2 November, supermarket fridges and freezers were again pushed into defrost mode, with temperatures reported at about 50 °C. Belgium, Luxembourg, the Netherlands, Sweden, Finland, Estonia, Ireland and Italy were affected, along with reported incidents in Greece. Reported victims included Coop and ICA in Sweden, Ahold Delhaize stores in Belgium, the Netherlands and Luxembourg, and Spar and Carrefour in Belgium. Small independent shops were also hit, including a butcher near Athens.

An ICA spokesperson said all of its affected stores were connected to an outside refrigeration control system supplied by Danfoss. EU agriculture commissioner Christophe Hansen called it “a deliberate attempt to disrupt our food supply chain.” A European Commission spokesperson said the incidents “are not isolated” but would not say who was behind them.

The equipment: two retired models and one current one

Reporting points to three Danfoss products:

After the first wave, Danfoss confirmed that AK-SM800 and AK-SC355 systems were involved. The company described most of the affected equipment as “legacy” products that no longer get software or security updates, and said it had long urged customers to update firmware and move to current-generation systems.

The AK-SM 800A is a more uncomfortable case because it is still sold and supported. Its weaknesses are already public. In 2025 Danfoss published advisory DSA-2025-08-01, and CISA published ICS advisory ICSA-25-140-03 on an authentication flaw in AK-SM 800A system managers. In August 2026, Claroty’s Team82 described three vulnerabilities in detail:

• CVE-2025-41450: an authentication bypass through a hidden “code of the day” mechanism (CVSS 8.2)
• CVE-2025-41451: an OS command injection in the alarm e-mail settings, giving remote code execution after login (CVSS 7.6)
• CVE-2025-41452: an Nginx configuration injection that can cause denial of service (CVSS 5.4)

For more details of those vulnerabilities, read those documents:

• Team 82: Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers
• Censys: Frostbitten in France: A Danfoss StoreView Internet Exposure Report

Firmware R4.3.1 fixes these. According to the reporting, the AK-SM 800A units that were hit were the ones never updated to it. Claroty counted 2,765 AK-SM 800A devices exposed to the internet in a Censys scan, and other estimates put the number of reachable Danfoss controllers higher.

Security researcher Kevin Beaumont described the login logic on some of these devices as a password that is simply the current date. Claroty’s analysis of the same “code of the day” logic treats it as a hidden bypass rather than a default password. Either way, the result is the same: anyone who finds the controller online can log in.

No zero-day needed

Experts agree on one point: this was not sophisticated hacking. Darktrace’s Nicole Carignan said attackers got in through internet-facing controllers, end-of-life firmware and default passwords, and that no zero-day was used. Richard Horne of the UK’s NCSC said the French fridges had been connected directly to the internet with default passwords. UK cyber minister Liz Lloyd called the French attack exploitation of known vulnerabilities.

So far nobody has claimed responsibility or been named. Investigators have not established a motive. Some researchers have pointed out that the attack is simple enough for opportunistic hackers, while others note that state actors have the capability too. Both waves struck overnight, used the same technique and spread across borders, which looks more like a coordinated campaign than random vandalism.

What operators should do now

The CERT-FR alert has the clearest practical guidance:

1. Take the controllers off the internet. Remove any direct internet exposure and any device with a public IP address.
2. Use only secure remote access. Service contractors should connect through a VPN or protected network. Filtering contractor IP addresses on a firewall is acceptable as an emergency measure only, not as a permanent fix.
3. Patch and harden. On current Danfoss systems, update the firmware (R4.3.1 or later for the AK-SM 800A), set the security level to Strict, and make sure default passwords have been changed.
4. Check the configuration, especially defrost schedules, before putting a unit back into service.
5. Don’t rely on a factory reset. A reset end-of-life device is still vulnerable. CERT-FR warns that leaving an unpatched EOL controller on the internet will very likely lead to compromise again.
6. Plan to replace the AK-SC355, the AK-SM800 and any other unsupported controllers.

Retailers should also make sure temperature alarms are monitored independently of the controller that might be compromised. In both waves, the alarms that should have woken someone up apparently stayed silent.

The bigger lesson

Refrigeration is part of the food supply chain, and in hospitals and blood banks it can be safety-critical. Yet these controllers are often installed and maintained by outside contractors, connected to the internet for remote service, and then left alone for ten years or more. As Professor Aikaterini Mitrokotsa of the University of St. Gallen told AP, a fridge does not look like a security risk, and that is exactly why attackers like it.

The patches and guidance for these devices were already available before the attacks. What was missing was an inventory of the devices, a plan to retire old ones, and the habit of treating a fridge controller as an internet-connected computer. A third wave is likely, and every store with an exposed controller is a candidate.

I post links to security vulnerability news to comments of this article.

You are also free to post related links to comments.

Read the rest at https://www.instagram.com/p/Dd6QYxEiGbH/?img_index=1

I post links to security vulnerability news to comments of this article.

You are also free to post related links to comments.

I post links to security vulnerability news to comments of this article.

You are also free to post related links to comments.

I post links to security vulnerability news to comments of this article.

You are also free to post related links to comments.

I post links to security vulnerability news to comments of this article.

You are also free to post related links to comments.

I post links to security vulnerability news to comments of this article.

You are also free to post related links to comments.

I post links to security vulnerability news to comments of this article.

You are also free to post related links to comments.