A second wave of attacks on supermarket refrigeration controllers hits stores across Europe

Key points

• Attackers remotely switched supermarket refrigeration units into defrost mode overnight into Nov. 2 in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland, Cooling Post reported.
• The wave followed an October campaign in France that Finance Minister Roland Lescure told Parliament affected about 700 supermarkets, according to the Associated Press.
• France's CERT-FR named Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb controllers. It told operators to remove internet exposure and allow remote access only through a secure VPN.
• The U.S. Cybersecurity and Infrastructure Security Agency recommended in May 2025 that control system devices not be accessible from the internet, in an advisory on Danfoss AK-SM 8xxA system managers.

Attackers remotely switched supermarket refrigeration and freezer units into defrost mode overnight into Monday, Nov. 2, in what Cooling Post described as an apparent copy of the October attacks on French supermarkets. Cooling Post reported that stores in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland were thought to be affected, and that dozens of stores were hit rather than hundreds.

Stephan Moelans, CEO of Sabcobel, which operates Delhaize stores in Belgium, attributed the incident to a cyberattack and said evaporators had been switched into defrost mode, ACHR News reported, citing Belga and Reuters. An ICA store in Sjöbo, Sweden, reported that its refrigerators and freezers had been set to 50°C (122°F). In Estonia, attackers reached a computer controlling an older Danfoss refrigeration system at a Selver supermarket and changed a freezer setting to 50°C, ACHR said.

The Selver freezer rose only about 2 to 3°C before the setting was fixed within about 10 minutes, The Hacker News reported. Kitman Coldtech, the Estonian refrigeration supplier, said the incident was detected quickly and no product was damaged, according to ACHR.

Stores reported affected

The Hacker News put Coop Sweden at six or seven stores, and also reported 10 to 15 Intermarché stores in Belgium, at least 17 businesses in the Netherlands and a few smaller Kesko stores in Finland. Musgrave said a specific refrigeration model was affected at its 13 SuperValu stores, that products were removed as a precaution and that the incident was resolved, ACHR reported.

Belgium's federal prosecutor has opened a criminal investigation, and Sweden's National Cybersecurity Centre said it was working on several incidents, according to The Hacker News and ACHR. Belgium's Centre for Cybersecurity said the perpetrators may never be determined, The Hacker News reported.

October in France

In France, attackers took control of refrigeration systems in hundreds of supermarkets in October, changing temperature settings, Cooling Post reported. Lescure told Parliament on Oct. 13 that about 700 supermarkets were affected, out of about 10,000 nationwide, the Associated Press reported, as summarized by ComplexDiscovery. The Paris prosecutor's office opened an investigation, ACHR said.

Danfoss said most of the affected units were legacy products or current products running outdated firmware, Cooling Post reported on Oct. 12. It named the AK-SM800, declared end of life in 2021, and the AK-SC355, phased out in 2016, neither of which receives software or security updates, and the current AK-SM800A running outdated firmware.

"We are working with affected customers to implement appropriate mitigation measures, including firmware updates where available, stronger network protections and removing direct internet exposure where applicable," Danfoss said, according to Cooling Post.

A Copeland spokesperson "confirmed that a vulnerability was found in discontinued end-of-life controllers," Cybersecurity Dive reported in a story republished by Facilities Dive.

How many controllers were online

After the French attacks, the number of internet-exposed Danfoss StoreView hosts in France fell from 1,825 on Oct. 11 to 537 on Oct. 14, a 71% drop, according to scans by Censys reported by Infosecurity Magazine. Censys counted 2,991 exposed StoreView hosts worldwide on Oct. 11. On the same day it found 58 unpatched StoreView instances in the United States, running versions below 4.3.1.

About 350 Danfoss AK-SM 800A instances remained exposed in mid-October, down from more than 550 earlier that week, according to Shadowserver Foundation data cited by Cybersecurity Dive. It reported that 1,173 Copeland XWEB Pro and Evo instances were still exposed.

Danfoss' security advisory DSA-2025-08-01, published Aug. 1, 2025, covers AK-SM 8xxA Series system managers before version 4.3.1. It lists CVE-2025-41451, an OS command injection rated 8.7, and CVE-2025-41452, rated 6.8, and says to install version 4.3.1. None of the sources reviewed for this story say which method the attackers used.

What the advisories tell operators to check

CERT-FR's alert, first issued Oct. 12 and last updated Oct. 16, says exposing a management interface to the internet goes against good security practice. For equipment that has not been compromised, it recommends:

• Remove internet exposure from the affected units and from any unit exposed on a public IP address, after checking insurance terms before cutting data uploads to the refrigeration contractor.
• Review the full configuration, including defrost schedules.
• Restore remote access only through a secure VPN or protected network. Filtering contractors' source IP addresses on a firewall is acceptable only as a temporary measure.
• Apply the vendor's practices, which for Danfoss include updating firmware, setting the security level to Strict and confirming default passwords were changed.

For compromised equipment, CERT-FR says to remove internet exposure, reboot Danfoss devices or restore them to factory settings, and reconfigure the equipment before returning it to service. A factory reset alone is not enough, the agency says, because it removes existing persistence but leaves the device open to reinfection. It warns that keeping an end-of-life device with no security fixes exposed to the internet carries a very high risk of compromise, and that the campaigns were probably still underway.

CISA's May 2025 advisory on an authentication flaw in Danfoss AK-SM 8xxA system managers, which it said are deployed worldwide in commercial facilities, recommends that operators "minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet." It also says to place control system networks and remote devices behind firewalls, isolate them from business networks and use VPNs when remote access is required.

Sweden's National Cybersecurity Centre advised organizations to inventory their internet-connected devices, decide whether each needs a connection and keep those that remain connected updated, The Hacker News reported.

---

Sources

• Europe hit by second wave of cyber attacks, Cooling Post, Nov. 2, 2026
• European supermarkets report more refrigeration cyber incidents, ACHR News, Nov. 3, 2026
• New wave of refrigeration cyberattacks hits supermarkets across Europe, The Hacker News, Nov. 3, 2026
• Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (CERTFR-2026-ALE-012), CERT-FR, Oct. 12, 2026, updated Oct. 16, 2026
• Danfoss moves to mitigate cyberattack, Cooling Post, Oct. 12, 2026
• Refrigeration hack affected about 700 French supermarkets, government says, ComplexDiscovery, Oct. 14, 2026
• France: Internet-exposed Danfoss controllers drop 71% after cyber-attack, Infosecurity Magazine, Oct. 15, 2026
• Thousands of refrigeration devices exposed after French cyberattack, Cybersecurity Dive via Facilities Dive, Oct. 16, 2026
• DSA-2025-08-01, Danfoss, Aug. 1, 2025
• ICSA-25-140-03: Danfoss AK-SM 8xxA Series, CISA, May 20, 2025