Supermarket freezers failed again Monday morning, this time across at least six countries. Staff in Belgium, Sweden, Ireland, Estonia, the Netherlands and Luxembourg found freezer cases warming up and the same equipment names turning up again.
What Happened?
It started before dawn on November 2. Belgium reported more than 50 stores. The Record counted over a dozen more across Ireland, Estonia, the Netherlands and Luxembourg. Sweden has not given a count.
Freezers were reportedly pushed to 50°C, which is 122°F. One Estonian store had normal temperatures back within 15 minutes, once technicians pulled the units off the network.
A contractor there said the attackers reached an older Danfoss system. Dutch broadcaster NOS reported Copeland gear was targeted too. A Belgian service firm said a full fix needs a physical change on top of a software update.
Two waves. Same open door.
The October cases were pinned to refrigeration controllers reachable from the public internet. Three weeks later the pattern repeated in six more countries, with the same equipment types turning up.
- About 700 supermarkets affected, per France’s finance minister to Parliament, out of roughly 10,000 nationwide. Other counts run lower
- Counts reported across five retail groups, from about 30 stores to several hundred each
- Controllers named: AK-SM 800, AK-SC 355, AK-SM 800A
- Two of the three models passed end of service years ago
- No malware reported and no indicators published. Entry method unconfirmed
- Belgium: more than 50 stores identified
- Sweden: a limited number of smaller stores
- Ireland, Estonia, Netherlands, Luxembourg: over a dozen combined by one tally, higher by others
- An older Danfoss system reported in Estonia; Copeland equipment reported in Belgium
- A full fix needs a physical change on top of a software update
Sources: French government statement to Parliament, CERT-FR alert CERTFR-2026-ALE-012, The Record, NOS, ERR, and vendor statements. No group has claimed either wave, and investigators have not said whether they are linked.
What Is Actually Confirmed
Nobody has been named. No group has claimed either wave, and investigators have not said whether the two are linked.
The October case has more on the record. France’s finance minister told Parliament that about 700 supermarkets were affected on the night of October 11 to 12, out of roughly 10,000 nationwide. Other counts run lower.
France’s cyber agency pointed at refrigeration controllers reachable from the public internet. It has not named an entry method or a flaw.
Three Danfoss models came up: AK-SM 800, AK-SC 355 and AK-SM 800A. The maker stopped supporting the first two in 2021 and 2016. Some affected units of the current model were running old firmware.
No malware has been reported, and no indicators of compromise have been published. There is no file for scanning tools to look for.
What to hunt for, and what nobody has published
| Model | Status | Detail |
|---|---|---|
| Danfoss AK-SM 800 | End of service | Past end of life since May 2021. No patches available. Vendor advises replacement. |
| Danfoss AK-SC 355 | End of service | Phased out in 2016. No updates. Vendor advises replacement. |
| Danfoss AK-SM 800A | Patchable | Current model. Affected units were running outdated firmware. Package 5.3.x was the latest listed on October 13, 2026. A 3.x system moves to 4.x first, and 5.3.x cannot be rolled back. |
| Copeland XWEB Pro | Patchable | 23 known flaws affect firmware below 1.13. Reported as targeted in the November wave by Dutch broadcaster NOS. |
| Copeland E3 / Site Supervisor | Patchable | Frostbyte10 flaws affect E3 firmware below 2.31F01. |
| CAREL boss / pCOWeb | Patchable | 11 known flaws. Of 513 pCOWeb services observed, only 287 returned an authentication prompt. |
| CVE | Type | Affected builds |
|---|---|---|
| CVE-2025-41450 | Date based authentication bypass that can skip the configured admin password | AK-SM 8xxA before R4.2 |
| CVE-2025-41451 | Command injection in email alert settings, code execution after login | Before R4.3.1 |
| CVE-2025-41452 | Web server weakness that can disrupt the management interface | Before R4.3.1 |
- Setpoint or defrost changes outside an approved maintenance window. Both waves ran overnight. Any temperature or defrost write at 02:00 local time deserves a case.
- Logins to a controller from an address that is not a known jump host. Compare controller audit logs against your authorized engineering set.
- Alarm suppression followed by a configuration change. Silencing the alarm first is how a temperature change goes unnoticed until opening time.
- Temperature that only recovers once a unit is pulled off the network. Reported at an Estonian store, where normal temperatures returned within 15 minutes of disconnection. If unplugging fixes it, the change came from outside.
- Any controller management interface answering from a public IP. Audit port forwarding rules, NAT entries and public IP assignments per site.
- Shared or stale contractor credentials still valid. Check every account your refrigeration service provider uses, across every site they touch.
- Remote access tooling running on an OT gateway. TeamViewer, AnyDesk, RustDesk, VNC variants and ScreenConnect on a refrigeration gateway are worth a look.
Compiled from the CERT-FR alert of October 12, 2026, CISA advisory ICSA-25-140-03, Claroty Team82 research, Forescout Research exposure scanning, and vendor statements. Exposure counts mean a service answered a scan, not that a device was compromised. Validate every item against your own environment before building a detection on it.
Why It Keeps Working
One security research firm counted 12,976 exposed refrigeration service observations in October, sitting on 6,017 public addresses across 99 countries. Those span several vendors. About 80% of the Danfoss StoreView services it saw ran firmware older than 4.3.1.
Another firm found that 61% of exposed Danfoss StoreView hosts sat in France before the attack. Within three days of it, French exposure fell 71%. Stores can close this door fast. They just waited for a reason.
So this is not a fridge problem. It is an access problem. Freezer controls sit outside most security programs. A refrigeration contractor patches them, if anyone does.
Not a fridge problem. An access problem.
No malware has been reported and no indicators published. What investigators have pointed at is a management screen reachable from the open internet, on gear a security team rarely owns.
Sources: CERT-FR alert CERTFR-2026-ALE-012; Forescout Research; NL Times; vendor statements. The entry method and the actors behind both waves remain unconfirmed.
What’s the Impact?
Stock goes in the bin and aisles close. The Record reports that makers face no legal duty today to fix products attacked this way. That gap narrows in December 2027, when the main rules of the EU Cyber Resilience Act start to apply.
How to Avoid This
- Inventory every controller. Write down the model and firmware, store by store.
- Take the control screens off the public internet. If staff need to log in from outside, send them through a VPN.
- Rotate every shared password, including the ones your refrigeration contractor uses.
- Replace anything the maker no longer supports. No patch is coming for those models.
- Set an alarm for anyone changing a temperature or defrost setting outside planned repair hours.
Your Freezers Have an Owner. Your Controllers Don’t.
The October wave came down to three gaps: assets nobody had inventoried, logins nobody had rotated, and changes nobody was watching. Secure.com’s governed AI Teammates carry that work, and your team keeps the approvals.
- Red Teammate maps what an attacker can reach from outside, including the controllers your asset list missed.
- Cloud Security Teammate flags the public addresses and port forwarding rules that publish a control screen by accident.
- SOC Teammate catches off hours setting changes and logins from machines outside your approved list.
- Actions that matter wait for your approval, and every decision is logged.