European Supermarkets Rush to Lock Down Fridge Controllers After Second Wave of Hacks

A second wave of cyberattacks on supermarket refrigeration systems hit stores across Europe overnight into Monday, November 2, 2026, cranking fridge and freezer temperatures as high as 50°C (122°F) and forcing retailers to throw away food. On Tuesday, chains from Belgium to Sweden were rushing to update, isolate or disconnect their refrigeration controllers, Reuters reported. The attacks closely mirror the October 11-12 wave that hit roughly 700 French supermarkets, and Danfoss controllers are once again among the systems targeted. No group has claimed responsibility, and officials have not publicly explained how the attackers got in.

What happened

More than 100 stores in several European countries saw their fridges and freezers heat up overnight from Sunday to Monday, according to SecurityWeek. The attacks hit early in the morning, when staff were least likely to notice and respond right away, Censys noted. Stephan Moelans, CEO of Belgian refrigeration firm Sabcobel, told the Belga news agency that attackers forced the units' evaporators into defrost mode, as happened in France.

The targeted systems are store refrigeration controllers whose web management interfaces were reachable from the internet:

• Danfoss: Reuters reports that Danfoss systems were "again among those targeted." Censys says reports suggest Danfoss StoreView, the web interface used on Danfoss AK-SM controllers, was involved again. An Estonian refrigeration supplier said the units attacked there were older Danfoss models.
• Copeland: Dutch broadcaster NOS reported that, as far as is known, the targeted devices were made by Danfoss and Copeland.

In the October wave, France's CERT-FR named four product families in its alert CERTFR-2026-ALE-012: Danfoss AK-SM series, Danfoss AK-SC series, Copeland XWEB and Dixell XWEB. Danfoss said most of the devices affected in France were older AK-SM 800 and AK-SC 355 systems that had reached end of life and no longer get patches (support for the AK-SM 800 ended in May 2021, and the AK-SC 355 was discontinued in 2016). Some current AK-SM 800A controllers running outdated firmware were also affected.

Is there a CVE?

No CVE has been officially tied to these attacks. The CERT-FR alert does not link the compromises to any specific vulnerability, and neither Danfoss nor French authorities have tied the attacks to previously disclosed flaws, SecurityWeek reported. Security researcher Kevin Beaumont said people he spoke with confirmed that every freezer hit on Monday had a management interface reachable from the internet, and that many of the devices are end-of-life with no patch available.

Two other findings are worth knowing, even though neither has been linked to the attacks:

• Known Danfoss AK-SM 8xxA flaws. Danfoss and CISA (advisory ICSA-25-140-03) list three vulnerabilities. CVE-2025-41450 is an authentication bypass, fixed in firmware R4.2. Claroty Team82 traced it to a hidden "code-of-the-day" login mechanism. CVE-2025-41451 is a post-authentication OS command injection that can lead to remote code execution, and CVE-2025-41452 is a post-authentication Nginx configuration injection that can cause denial of service. Both are fixed in R4.3.1. According to Censys, Claroty showed in August 2026 how CVE-2025-41450 and CVE-2025-41451 could be chained to achieve remote code execution.
• Default-credential scanning. Deception security firm Lupovis told SecurityWeek that between October 20 and 30 it saw suspicious activity aimed at its Danfoss AK-SM decoy sensors. Most login attempts used factory-default credentials that Danfoss documents publicly. "The activity peaked on 26 October, and importantly, we had not observed this behaviour on these sensors before 20 October," said Lupovis CEO Xavier Bellekens.

Who is affected

Reports differ on how many countries were hit. Reuters counts stores in eight European countries, while the BBC lists problems in at least 10: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany and Sweden. Reported impacts include:

• Belgium (hardest hit): Delhaize reported an IT incident that disrupted refrigeration at several dozen stores. Carrefour counted 15 affected Belgian stores, after 80 of its franchised French stores were hit three weeks earlier. Colruyt said five franchised Spar shops were attacked, and an IKEA store in Mons was also hit. The Belgian federal prosecutor's office has opened an investigation.
• Sweden: ICA said all 23 stores hit had equipment connected outside the chain's centrally managed store network. Coop said seven stores were hit; they are back up and running with their refrigeration systems disconnected from the internet. Swedish police said around 10 police reports had been filed.
• Ireland: Musgrave Group's SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was affected.
• Luxembourg: four Delhaize outlets were affected.
• Netherlands: Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.
• Germany: Edeka had fridges hacked at a store in Reisbach, and a Rewe store in western Germany reported disruption.
• Estonia, Finland, Italy, Portugal: at least one Estonian supermarket was attacked, according to public broadcaster ERR, and Censys lists the Selver chain among those affected. Kesko reported temperature problems at a few smaller Finnish stores. In Italy, at least four Coop supermarkets in Sicily and one business in Tuscany were affected. In Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.
• UK: NCSC chief executive Richard Horne said hackers tried to target small meat-processing firms, but the impact was minimal.

EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain. He said the bloc's food security is not under threat for now. The BBC reports that food losses from the French wave were estimated in the tens of millions of euros.

How exposed are these controllers?

Censys sees just over 1,000 Danfoss StoreView interfaces exposed online worldwide. France has the most, followed by Belgium and the US. Exposure in France fell from 1,825 before the October attacks to 220. Censys estimates patch status by matching firmware build dates:

Country	Exposed StoreView hosts	Running 4.3.1+ (patched)
France	220	41%
Belgium	138	68%
Netherlands	51	37%
Sweden	50	58%

Source: Censys, November 2, 2026. Censys also counted 6 exposed hosts in Luxembourg (4 patched), 3 in Ireland (2 patched) and 2 in Estonia (both patched).

Patching alone may not be enough. Moelans said a software update does not fully fix the weakness and the equipment also needs to be physically modified. Danfoss said that on October 13 it had told customers to cut their systems' internet connections and reconnect only through a secure network. "Most stores took action at that time, but a small number did not," a company spokesperson told NOS.

Timeline

• 2025: Danfoss discloses and patches AK-SM 8xxA flaws. Censys says CVE-2025-41450 (fixed in R4.2) was disclosed in March 2025, and CVE-2025-41451 and CVE-2025-41452 (fixed in 4.3.1) in August 2025.
• October 11-12, 2026: First wave. About 700 French supermarkets, including Intermarché, Carrefour, Coopérative U and Monoprix stores, have refrigeration units forced into defrost mode. Food is spoiled, and the attacks reportedly cause fires.
• October 12: CERT-FR issues alert CERTFR-2026-ALE-012 covering Danfoss AK-SM and AK-SC controllers.
• October 13: CERT-FR adds Copeland XWEB and Dixell XWEB to its alert. Danfoss tells customers to disconnect from the internet.
• October 16: CERT-FR updates its recommendations.
• October 20-30: Lupovis sees new login attempts against its Danfoss AK-SM decoys, peaking on October 26.
• November 1-2 (overnight): Second wave hits stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands, Sweden and other countries.
• November 3: Retailers rush to disconnect and upgrade systems. The UK NCSC says it is on "heightened alert."

What to do: retailers and IoT/OT operators

• Find every refrigeration controller and check whether it is internet-facing. That includes Danfoss AK-SM/AK-SC (StoreView), Copeland XWEB and Dixell XWEB units, and anything installed or remotely managed by a refrigeration contractor outside your central store network. Run an external scan of your own IP ranges.
• Take them off the public internet now. CERT-FR's first step is to remove internet exposure from affected units and from any unit on a public IP address. It also says to check your insurance contract terms before cutting data feeds to your refrigeration service provider.
• Restore remote access only through a secure VPN or protected network. CERT-FR says filtering by your contractors' source IPs on a firewall is acceptable only as a temporary emergency measure, not a long-term fix.
• Check the configuration, especially defrost schedules and temperature setpoints. In France, Le Monde reported that attackers stretched defrost cycles from one hour to as many as eight, which delayed alarms.
• Update firmware. Danfoss AK-SM 8xxA controllers should run R4.3.1 or later, which fixes CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452. For Danfoss gear, CERT-FR also recommends setting the security level to Strict and making sure default passwords have been changed. For XWEB units, follow Copeland/Dixell's hardening guidance, which CERT-FR links in its alert.
• Replace end-of-life controllers. Older units such as the AK-SM 800 and AK-SC 355 no longer get security updates. CERT-FR warns that a factory reset alone is not enough for a compromised EOL device that stays exposed, because it will remain vulnerable and is likely to be compromised again.
• If you've been hit, disconnect the unit, reboot it or restore it to factory settings, and reconfigure it before putting it back into service. Then file a report with your national CERT and the police.
• Monitor for changes. Set alerts for unexpected setpoint or defrost changes and for new logins, and keep OT networks segmented from corporate IT.

"With disconnecting, you haven't fixed the root cause but you've at least isolated those systems so that an attacker is not able to do this anymore," Deloitte cybersecurity expert Frank Groenewegen told Reuters.

Sources

• Reuters: European supermarkets rush to patch vulnerabilities after region-wide fridge hack
• CERT-FR (ANSSI): CERTFR-2026-ALE-012, Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération
• SecurityWeek: Over 100 European Stores Hit as Supermarket Fridge Attacks Return
• SecurityWeek: Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers
• Censys: European refrigerator controller redux: A new wave of refrigeration attacks
• BBC News: Europe on alert after supermarket freezers hit by cyber-attacks in 10 countries
• Danfoss: Security Advisory DSA-2025-08-01 (CVE-2025-41451, CVE-2025-41452)
• CISA: ICS Advisory ICSA-25-140-03, Danfoss AK-SM 8xxA Series

Featured image: Security Breaches original graphic.