Frozen out: how hackers heated supermarket fridges across Europe — and how to stop it

At around 4 a.m. on Monday, 2 November, Delhaize store managers in Belgium got a warning that the temperature in their refrigeration systems was rising. At an ICA supermarket in Sjöbo, southern Sweden, the freezers had been set to 50°C overnight. The store closed for the morning while staff carried out chilled and frozen stock, and the manager told TV4 that staff could not adjust the controls.

It was the second wave. On the night of 11 October, up to about 700 French supermarkets had discovered the same thing: refrigeration controllers that had been remotely told to defrost, with the food still inside. The Danish manufacturer Danfoss has now confirmed that its products were involved in incidents in several countries, naming the AK-SM 800 and AK-SC 355 controllers.

What happened

Wave one: France, 11–12 October

Shortly before midnight on Sunday 11 October, refrigeration controllers across France began forcing defrost cycles. Cabinets that should sit at around −27°C climbed past 50°C over four to six hours, and one Normandy supermarket reported freezers at 80°C. At some sites the heat melted equipment or started fires that set off sprinklers. Intermarché, Coopérative U, Carrefour, Monoprix and E.Leclerc outlets were hit, and the Paris prosecutor's cybercrime section opened an investigation. Intermarché's parent company said the cost would run to "tens of millions of euros nationwide in a single day".

Nobody has claimed responsibility and no ransom has been demanded, which investigators told Reuters they found puzzling. CERT-FR published alert CERTFR-2026-ALE-012 the next day, naming Danfoss AK-SM and AK-SC controllers, later extended to Copeland and Dixell XWEB supervisors.

Wave two: Belgium, Sweden and beyond, 1–2 November

Sabcobel, the refrigeration installer that manages Delhaize's cooling, told Belga the Belgian attack used exactly the same mechanism as the French one: the evaporators were remotely switched to defrost mode. European Agriculture Commissioner Christophe Hansen called it an attempt to disrupt the food supply chain, while stressing that food security was not currently at risk.

This was not the first of its kind. Fridges at about a dozen US military commissaries went into unscheduled defrost cycles in late August, and Danfoss's own customer newsletter records attacks on 16 Russian supermarkets and 40 Israeli stores in 2022.

The hardware: why a supermarket's cold chain is online at all

A supermarket's refrigeration is run by a central controller: a box that sets temperatures, defrost schedules and alarm thresholds for every cabinet and compressor. Most chains outsource the maintenance to specialist contractors, and so that a technician can clear an alarm at 3 a.m. without driving to the store, the controller has an embedded web server and a data link to the contractor. Convenient, cheap and, for years, rarely questioned.

Exposure is not hypothetical. When Claroty's Team82 went looking before any of these attacks, they found 2,765 AK-SM 800A interfaces on Censys alone. After the French attack, Reuters counted at least 4,500 Danfoss interfaces still visible on Shodan, and the French scanning firm Onyphe said only a small minority appeared to run the latest software.

How did they get in? What we know, and what is disputed

This is the part where public reporting diverges, so it is worth being precise.

Confirmed by authorities: an exposed management interface

• CERT-FR says the exposure of a management interface to the internet is "contrary to good practice", and its remediation steps start with removing internet exposure.
• ANSSI's director, Vincent Strubel, told the French Senate the incident came down to "basic security flaws, starting with the direct exposure of refrigeration equipment to the internet and its administration without any particular security measures, weak passwords, that sort of thing", according to reporting by the Financial Times and Silicon UK.
• Security researcher Marta Rybczyńska told the Guardian many freezers appeared to be running a default password, and that the attackers could modify or turn off alerts, so shops only noticed when the first employee arrived in the morning.
• Danfoss says many of the units hit had "reached end of life and no longer receive software or security updates", and others were "running outdated firmware".

Disputed: a specific software flaw

In August 2026 Claroty's Team82 published research on the newer AK-SM 800A. It described a hidden "code of the day" authentication mechanism (CVE-2025-41450), a command-injection bug leading to remote code execution (CVE-2025-41451) and an Nginx configuration injection issue. Danfoss had disclosed the first in March 2025 and fixed the set in firmware R4.3.1. Wikipedia's summary of the French attack and a vendor write-up from Aviatrix both link these flaws to the incident, and the Wikipedia article says many controllers were reachable with the username admin and the current date as the password.

But ANSSI's current assessment, as quoted to the Senate, is that these vulnerabilities were not exploited. CERT-FR's alert itself names no CVE, firmware version or indicator of compromise, and as of 2 November neither CERT-FR nor Danfoss had named a CVE or a firmware update for the two end-of-life models. Those two models are not the one Claroty analysed.

What the attackers did once in

Both waves used the same trick, and it is clever in its simplicity. A defrost cycle is a legitimate function: evaporators heat up to melt frost. The attackers did not need malware or an exotic exploit chain, only the ability to tell the controller to defrost, extend the defrost window by hours and, according to early investigation findings reported by the Guardian, suppress or modify the alarms. The equipment behaved exactly as designed, just on the attacker's schedule.

Who did it?

Unknown. Wavestone's Gérôme Billois said the most feasible scenarios are youngsters or activists "who wanted to blow up a few freezers to prove what they could do", or sabotage by a state actor; he named Iran and Russia as known practitioners of such destabilisation. Ken Munro of Pen Test Partners noted the culprits could just as easily be "kids messing around", given how easy the flaws were to reach. It is not yet known whether the same people were behind both waves. Treat any confident attribution as speculation.

What made this so effective — analysis, not confirmed findings

What follows is our reading of the public facts, labelled as analysis. It is not an official post-mortem.

1. Nobody owned the risk

French retailers commonly outsource refrigeration to contractors and do not manage its security. ICA said the affected stores' connections sat outside its central network. Coop said its affected equipment was not from Danfoss and that the attack came through "a technical connection". Whatever the vendor, the pattern is the same: operational technology bought, installed and connected by someone other than the IT security team, and sitting outside every inventory and monitoring tool the company owns.

2. A known weakness, publicly signposted

End-of-life notices for these controllers date back to 2016 and 2021, Danfoss says it had "long recommended" updates or replacement, and exposed controllers were findable with a search engine. After the French attack, Danfoss's Dutch spokesperson told NOS that most customers had acted on the warnings, but some had not, and the second wave found them. The three-week gap between the waves is the clearest lesson here: the playbook was public and the targets were still there.

3. The fix is capital spending, not a patch

Sabcobel's CEO said a software update alone is not enough and that installations need a physical change too, "that requires investment". A security team can push a patch tonight. It cannot push new hardware tonight, which is why unsupported OT stays online for years.

4. Detection relied on people who were asleep

The attacks ran overnight. In France the hack did not trigger alarms and many staff were not present. In Belgium the first warning went out around 4 a.m. and staff who rushed in managed to pause the defrost in time at some stores. Time-to-detection decided the size of the loss.

5. A low barrier

No ransomware crew, no zero-day broker, no foothold in corporate IT. Scan the internet, find a login page, try the obvious passwords. Combined with the sheer physical consequences (spoiled food, melted equipment, fire), the cost-to-impact ratio is attractive to anyone from hacktivists to state sabotage units.

Red: why attackers love this one

• Thousands of controllers are discoverable with Shodan or Censys, no scanning skill needed.
• End-of-life firmware means there is nothing to patch, and public research maps the attack surface.
• The malicious action looks like a normal feature, so it can slip past tools looking for malware.
• Real-world, visible consequences within hours: a powerful signal for sabotage or intimidation.
• Outsourced ownership: no single party feels responsible for the exposure.
• The same hardware and the same contractors recur across chains and countries, so one technique scales.

Blue: prevention and response, step by step

Step 3 restates CERT-FR's guidance. The rest is our recommendation, consistent with Danfoss's and Claroty's advice, ordered by what closes the door fastest.

Step 1 — Find every refrigeration and building controller

List every Danfoss AK-SM/AK-SC, Copeland XWEB, Dixell XWEB and comparable supervisor, with model, firmware version and whoever manages it. Ask your refrigeration contractors for their list too, and compare. Convenience stores, petrol-station shops and franchises that sit outside central IT are the ones most likely to be missing.

Step 2 — Check what is reachable from the internet

Test from the outside, not from the store network. Only scan ranges you own or are authorised to test.

# From a host OUTSIDE your network: do management ports answer?
nmap -Pn -p 80,443,8080,8443 203.0.113.0/28

# Search engines already know about you. Shodan CLI, own org/ranges only
shodan search 'org:"Your Company" http.title:"StoreView"'
shodan search 'net:203.0.113.0/24 danfoss'

A login page answering from the internet is the finding. Do not log in to a controller you do not own to "check".

Step 3 — Remove the exposure, then restore access safely

• Pull any controller off a public IP address. CERT-FR's first instruction for both compromised and unaffected units.
• Check your insurance and service contracts first before cutting the data uplink to the refrigeration contractor, as CERT-FR advises, then agree an alternative path.
• Restore access only via a secure VPN or a protected network. Allow-listing your contractor's source IPs on a firewall is an emergency stopgap, not a permanent design.
• Check the whole configuration, especially defrost schedules, which is what the attackers manipulated.

Step 4 — Fix authentication and configuration

• Change default, shared and weak passwords on every controller and give each contractor technician a named account.
• Enable the vendor's hardening. CERT-FR's example for Danfoss: update the firmware, set the security level to Strict, and confirm default passwords are changed. For XWEB, follow Dixell's published secure-use recommendations.
• Update supported models (for example AK-SM 800A to firmware R4.3.1 or later).

Step 5 — Replace what cannot be patched

AK-SC 355 and AK-SM 800 units will never get a fix. Put replacement in the capital plan with a date. Until then, keep them off the internet entirely and behind a firewall that only a VPN can pass.

Step 6 — Segment the cold chain from everything else

Put refrigeration and building-management controllers on their own VLAN, apart from POS and office systems, with default-deny rules in both directions. One compromised controller should stay one store's problem. Convenience and franchise stores whose connections sit outside central networks need the same treatment, not an exemption.

Step 7 — Add a safety net that does not trust the controller

In these attacks the controller itself was the thing under attacker control. Fit an independent temperature sensor or data logger with its own power, its own cellular or separate network uplink and its own alert to a named on-call phone. It will tell you about a 50°C freezer at 01:00 even if the controller's alarms were switched off. This is the control that turns a total loss into a minor incident: the Belgian stores that caught it in time paused the defrost before temperatures climbed far.

Step 8 — Hold contractors to a standard

• Make secure remote access, patching and password hygiene explicit contract terms.
• Ask for evidence: current firmware list, last access review, who can reach which store.
• Agree who is called, and who may physically intervene, when an alarm fires overnight.

If you think a controller was compromised

1. Take the unit off the internet first. CERT-FR warns that a factory reset alone is not enough on an end-of-life unit: it clears the attacker's persistence, but the device stays vulnerable and will probably be compromised again.
2. Restart the Danfoss device or factory-reset it, then reconfigure from a known-good baseline, including defrost schedules.
3. Restore remote access only through a VPN or protected network, and apply vendor hardening.
4. Move product to a safe cold store, record temperatures and times, and involve food-safety and insurance contacts early.
5. Report to your national CERT or authority, and keep logs: Belgium's CCB, Sweden's NCSC at FRA and France's CERT-FR are all actively collecting incidents.

If you run a small shop or restaurant

1. Ask your refrigeration installer one question today: "Is our controller reachable from the internet, what model is it, and is it still supported?"
2. Ask them to confirm in writing that default passwords are changed and remote access runs through a VPN.
3. Buy a stand-alone temperature alarm with a phone alert. It is a small cost compared with one night of spoiled stock.
4. Know who to call at night, and write the number next to the freezer.

The lesson for everyone else

OT is part of your attack surface. If it is connected, it is in scope, even if a contractor installed it and facilities pays the invoice. Your asset inventory should include controllers, not only laptops and servers.

End-of-life is a security event. The AK-SC 355 went out of support in 2016. We made the same point about unsupported PHP in PHP2Shell: published end-of-life dates are deadlines, and the attacker reads them too.

Exposure first, patching second. A patch would not have saved the unsupported units at all. Removing the public IP would have. The cheapest control on CERT-FR's list needs no vendor at all.

Detect the misuse of legitimate features. A defrost command is not malware. "Defrost started outside the usual window on every cabinet at once" is a behaviour rule that needs no signature. Like the volume alerts we discussed in the CPR breach, the controls that matter watch for things that should never happen.

Danfoss fridge attacks FAQ

What happened to the supermarket fridges in Europe?

Attackers remotely forced refrigeration controllers into defrost mode: at up to about 700 French stores on 11 October 2026, and at dozens of stores in Belgium, Sweden, Luxembourg, the Netherlands, Estonia and Ireland on 1–2 November. Cabinets climbed to 50°C or more.

Which Danfoss products were affected?

Danfoss named the AK-SM 800 (end of life since May 2021) and AK-SC 355 (phased out in 2016). CERT-FR also lists the wider AK-SM and AK-SC series and Copeland and Dixell XWEB supervisors.

Was a software vulnerability exploited?

Disputed. Claroty's findings (CVE-2025-41450 and CVE-2025-41451, disclosed in 2025 and published in August 2026) are linked to the attacks by some write-ups, but ANSSI told the French Senate its assessment is that they were not exploited, and points to internet exposure and weak passwords.

Is a patch available?

Not for the two end-of-life models. Supported AK-SM 800A units should run firmware R4.3.1 or later. For everything else the fix is removing internet exposure and, eventually, replacing the hardware.

Do I need to worry if my stores use another vendor?

Yes. Coop says its affected Swedish equipment was not from Danfoss, and CERT-FR also names Copeland and Dixell XWEB. The weakness is the pattern, not one brand.

Sources

• CERT-FR — CERTFR-2026-ALE-012: Security incident targeting remote controllers of refrigeration systems
• Claroty Team82 — Freeze the Controller, Defrost the Food
• Danfoss — security advisory DSA-2025-03-01 (CVE-2025-41450)
• Nordisk Post — Danfoss refrigeration systems hit in new cyberattacks across Europe
• The Brussels Times — Suspected cyberattack hits fridges and freezers at dozens of Belgian supermarkets
• Euronews — Cyberattack hits supermarket fridges and freezers in Europe
• Aktuell Säkerhet — Cyberattack slog ut kylar och frysar hos Ica och Coop
• eBuilder Security — ICA and Coop cyberattack heats Swedish store freezers to 50°C
• Brandefense — Supermarket refrigeration cyberattack playbook
• The Guardian — Not cool: who hacked France's supermarket fridges?
• Silicon UK — Hackers exploit 'basic flaws' to attack French supermarket fridges
• Martin Cid — After France's 50°C fridge hack, 4,500 Danfoss controllers are still online
• Aviatrix — Frozen Out: how unpatched fridge firmware burned 700 European supermarkets (links the CVEs to the attack; disputed by ANSSI's statement above)
• Wikipedia — 2026 French supermarket refrigerator hack