Danfoss Fridge Controllers Hacked Again as Freezers Hit 50°C in Ten European Countries

Freezers in more than 100 stores across ten countries went warm overnight, some set to 50°C. Three weeks after France. The boxes running them were still online, after the maker told stores to take them off.

It started again on the night of Sunday, November 1. Around midnight, the cooling in stores across Belgium began to change. Fridges and freezers switched to defrost, some shut down completely, and in a few the settings were pushed up until the units were producing heat instead of cold. By Monday morning the same thing had happened in Sweden, Ireland, Luxembourg, Estonia, Finland, Italy, Portugal, the Netherlands and Denmark.

At an ICA supermarket in Sjöbo, in the south of Sweden, the morning staff found the fridges and freezers set to 50°C, which is 122°F. The store posted on Facebook that the cooling had been hacked. The manager told reporters they could not change the temperatures back, and the store stayed closed that morning. On the island of Öland, the manager of a small village shop found a puddle of water on the floor and the cooling set to 55°C. The shop had no fresh or frozen food left to sell.

The most stores were hit in Belgium. By Monday afternoon, local media had counted at least 76 supermarkets and other shops with refrigeration problems. Delhaize said an “IT incident” had affected the cooling in several dozen of its stores, around 40 according to most reports. Carrefour counted 15 of its 700 locations in the country. Its spokesman put it plainly: “It’s a cyberattack, there is no other reason.” Five franchised Spar shops, around 15 Intermarché stores and the IKEA in Mons were hit as well.

The losses per store were large. The manager of one store near Brussels called the consequences “catastrophic”. His store threw out all of its fresh and frozen food. Another store had to throw away at least €60,000 worth of food. At a butcher shop south of Antwerp, the fridges climbed to 18°C, and about €15,000 worth of meat was lost.

The list kept growing. In Ireland, 13 supermarkets of one chain had to pull chilled and frozen products from sale. Four stores in Luxembourg were affected. In Estonia, attackers set a freezer in one supermarket to 50°C, but the alarm was answered within ten minutes and the temperature rose only two to three degrees. The chain said it was the last of its stores where the new system was not yet in use.

In Sicily, at least four supermarkets were hit, plus one business in Tuscany. The general director of the group that runs the Sicilian stores said the attack came at 4:00 in the morning. Its chief executive said the attackers got into the remote-control system for the frozen food cases. The Italian government scheduled a cybersecurity meeting with its intelligence services for the next day. In Finland, a few smaller grocery stores recorded strange temperatures, and the chain’s head of security said interference over the network had not been ruled out. In Portugal, seven stores confirmed problems. In the Netherlands, at least 17 businesses were hit, mostly butcher shops and small food stores.

In Denmark, the government’s civil security agency knew of five companies whose cooling systems were hit. They got the attackers out quickly, it said, without major outages. At one food producer, the refrigeration supplier caught the attack, stopped it and then sounded the alarm. In Romania, the national cybersecurity directorate reported a possible attack on six stores of one chain. Around 1:30 in the morning their refrigeration equipment climbed to very high temperatures, and the problem was only noticed at 8:00. The controllers went online through GSM routers, small boxes that connect over the mobile phone network, each with a fixed IP address that could be reached straight from the internet. The software on them was old.

The European Commission reacted the same day. Christophe Hansen, the EU commissioner for agriculture and food, said in a statement: “The repeated occurrence of these cyberattacks is deeply concerning.” He called the attack “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it.” Federal prosecutors in Brussels opened a criminal investigation. In Sweden, the National Cybersecurity Centre took up the case, and its head called it serious because the food supply is part of the country’s infrastructure. So far, the attack is unclaimed.

This was the second time in three weeks.

On the night of October 11, it happened in France. The finance minister told parliament that about 700 of the country’s 10,000 supermarkets were affected. Some units ran hot for hours before the first employees arrived, the food went in the bin, and the Paris prosecutor’s office spoke of fires. I wrote about that attack on October 13, and about the boxes that made it possible.

A supermarket has many cooling units, from display cases to cold rooms, and above them sits one box that ties them together: the system manager. From its web page, a technician can see the temperature of each unit, change the settings, and plan the defrost cycles. Defrosting is normal. Ice builds up, the unit warms for a while to melt it, and then goes back to cooling. Leave it in defrost, or set the target temperature to 50°C, and the food inside is gone by morning. To let the maintenance company check a store without driving there, that web page was often put straight on the internet.

On Monday, Danfoss confirmed to the Danish broadcaster DR that the incidents in several countries involved its products. After the French attack in October, it had named two controllers: the AK-SM800 and the AK-SC355. The AK-SC355 was phased out in 2016. The AK-SM800 reached its end of life in 2021. Neither gets software or security updates anymore.

A refrigeration company in Estonia said the system attacked there was an older type of Danfoss system. “The signature is the same, but I can’t comment further yet,” its director added. The supermarket chain from Sjöbo said the stores it had affected were all connected to an outside refrigeration control system from Danfoss. Dutch reports said devices from a second maker, an American company, were also among the targets.

So the attackers went back to the same boxes, after two warnings.

• → October 13. Danfoss wrote to its customers and told them to cut the internet connection of these systems and to restore access only through a secured network. This week, a company spokesperson told the Dutch broadcaster NOS: “Most stores took action at that time, but a small number did not.” In the Netherlands, the spokesperson added, the systems hit on Monday were not on a secured network and still had a default password. On that same October 13, CERT-FR, the French government’s computer emergency team, widened its alert. Besides Danfoss, it now also named the XWEB controllers made by Copeland and Dixell, which do the same job. The second maker that Dutch reports now mention was on the French list three weeks ago.

• → October 16. The French team updated its alert for the last time. In its current form, one line reads: “Des campagnes d’attaques sont probablement toujours en cours visant ces équipements.” In English: attack campaigns against this equipment are probably still going on. The same alert warns that a factory reset is not enough on an old box that no longer gets patches. The box stays vulnerable and will most likely be broken into again.

• → October 20 to 30. The security company Lupovis runs decoy controllers on the internet, built to look like Danfoss units and to record who tries to log in. In those ten days it saw login attempts against them, with a peak on October 26. Most of the attempts used the factory default login details, the ones Danfoss documents in public. The decoys rejected them. Somebody was out looking for these boxes a week before the attack. Whether they were the same people who struck on Monday is not known.

• → November 2, the day itself. The security researcher Kevin Beaumont wrote that he had checked with people involved. In his words: “I’ve confirmed with folks the impacted freezers in the countries impacted today are all mgmt interface facing internet.” Many of them, he added, are end-of-life with no patch available.

One Belgian refrigeration installer, which manages hundreds of these installations, started securing them after the October attack. On Monday its chief executive said around 10 percent were not finished yet, and some of those were in the shops that got hit. He knew of about twenty affected units. According to him, the same weakness was used as in France, and a software update alone does not close it. The boxes also need physical changes, which cost money.

Censys, a company that scans the internet around the clock, counted how many of these boxes are still reachable. It looks for the web page of the Danfoss system manager, the screen called StoreView. Before October 11 it found 1,825 of them in France. On October 14 it was 537. On Monday it was 220. Across the internet, the count is a little over 1,000. Belgium has 138, the Netherlands 51, Sweden 50, Luxembourg 6, Ireland 3 and Estonia 2.

The scan also estimated which software those boxes run. One of the holes I described last time was a hidden second password in the AK-SM 800A, a “code of the day” calculated from the device’s own date and time. Whoever knows the calculation can work out the code and log in without the administrator’s password. That hole, CVE-2025-41450, was fixed in version 4.2 in March 2025. Of the boxes still reachable in France, 45 percent run software older than that. In the Netherlands it is 41 percent, in Sweden 38 percent, in Belgium 28 percent. The version is read from a timestamp the web server gives out, so it is an estimate. And for the two old models that Danfoss named, no fix exists at all, whatever version they run.

How the attackers got in this time has not been made public. A security expert at Zscaler named the two likely ways in to AFP: a known hole in the software, or a login with credentials that had been stolen or leaked. After October, Vincent Strubel, the head of the French national cybersecurity agency ANSSI, put the first attack down to “basic security shortcomings”. The boxes were directly exposed to the internet, and the passwords were weak. An engineer at the French security firm Synacktiv said these systems normally sit on a closed network and “are not supposed to be accessible from the Internet”. Many of them could still be reached by somebody with only basic knowledge, he said. “The attack was not extremely sophisticated.”

Changing a temperature or a defrost schedule is an ordinary function of the system manager. With a working login, an attacker changes it the same way the technician does. In Sweden, the supermarket chain Coop said its affected stores were connected through a 4G mobile network and not through its updated 5G system, and that this made them “more exposed”.

The pattern did not start in Europe.

In the last week of August, freezers at US military commissaries, the supermarkets on military bases, went into defrost overnight. At least six stores confirmed it, from Fort Huachuca in Arizona to Naval Station Newport in Rhode Island. Since my first post, the investigation has grown. The Pentagon says a unit of US Cyber Command is now working on it with other agencies, and the Army’s criminal investigators are working with French law enforcement. That does not prove the same people did both. It is still not public which company made the controllers in those stores, and the military has not confirmed that the systems were broken into.

On the same night as the October attack in France, Ahold Delhaize took systems offline after a separate security problem. The group also reported suspicious activity in its network to Dutch police. Three weeks later, the cooling in dozens of its Belgian stores was tampered with. In October the company said there was no reason to link its incident to the attack in France, and so far nothing connects the two.

By Monday afternoon, some chains reported that their fridges and freezers were working normally again. The installer had pulled the affected units off the network. The stock that had warmed up overnight was already in the bin. Who did it is still unknown, and so is whether they will come back a third time.

Want to see your own network the way an internet scanner saw these fridge controllers, and find what you left open? My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

CERT-FR: CERTFR-2026-ALE-012 | Censys: A new wave of refrigeration attacks | CISA: ICSA-25-140-03 Danfoss AK-SM 8xxA Series | Danfoss: DSA-2025-03-01