In the early hours of November 2, 2026, supermarkets and butcher shops in Belgium, Sweden, the Netherlands, Ireland and other countries were hit by attacks that remotely raised the temperatures of their refrigeration and freezer equipment. According to refrigeration equipment maker Danfoss, the method was the same as in the attack in France on the night of October 11. France's computer emergency response team, CERT-FR, warned on October 12, and Belgium's Centre for Cybersecurity (CCB) on October 13, that affected equipment should be disconnected from the internet. However, Danfoss says the equipment attacked in the Netherlands was not connected to a protected network and still used its default passwords. Meanwhile, some of the older units confirmed as victims in the first attack are products whose support has already ended and which no longer receive security updates. The latest attack highlights two problems in store equipment management: equipment on which recommended security measures had not been implemented, and older units that cannot be fixed with updates.
Early on November 2, freezers at stores across Europe were operated remotely
Carrefour in Belgium said 15 of its 700 stores in the country were affected. The Colruyt Group, also in Belgium, confirmed damage at five stores. In Sweden, Coop said unauthorized manipulation of freezer equipment occurred at 7 of its 800 stores, and disclosed that Danfoss is one of its equipment suppliers. Ireland's wholesale company Musgrave announced that 13 stores of its SuperValu supermarkets were affected. IKEA confirmed damage at one store in Belgium and has not ruled out that other stores may have been affected.
These are figures that each company released about its own damage, not figures showing the total number of cases across Europe. Specific accounts have also come from stores. The manager of an ICA-affiliated store in Stockholm said the attack occurred around 2 a.m., but that he only noticed the problem several hours later. According to ICA, the affected stores were a limited number that used external equipment contractors and were connected through routes separate from ICA's central network.
In the Netherlands, a Danfoss spokesperson said that the refrigeration systems of at least 17 companies were tampered with in the previous night's attack and their temperature settings changed. The main victims were butcher shops and small local businesses, and as far as the company is aware, large supermarket chains were not among them. At a frozen food storage facility that was hit, equipment normally kept at minus 20°C rose to minus 10°C, but the problem was dealt with quickly. An Estonian equipment contractor also said the attackers had gained access to older Danfoss systems. In the case of the Netherlands in particular, Danfoss has gone as far as to comment on the network configuration and authentication settings of the attacked equipment.
A second wave, 21 days after CERT-FR's warning
The first large-scale attack took place on the night of October 11 in France. According to Les Mousquetaires, the parent company of the Intermarché supermarket chain, refrigeration equipment was illicitly switched to defrost operation and heated to as much as 50°C. The Paris prosecutor's office has received about 10 complaints and estimates the number of victims at about 700. No claim of responsibility has been issued so far.
Defrost operation is a mode for melting frost that builds up on the evaporator of refrigeration equipment. The evaporator is a heat exchanger that absorbs heat from inside the unit and is kept cold during normal cooling operation. However, if an attacker uses remote access to switch to defrost operation and keeps it in that state, the temperature inside the unit may rise. In other words, the technique does not physically destroy the equipment or simply shut it down; it abuses an operating function the equipment already has to take away its cooling capacity. CERT-FR's request that owners check equipment settings in general, and defrost schedules in particular, is thought to have such attacks in mind.
CERT-FR published the alert "CERTFR-2026-ALE-012" on October 12. On the 13th it added information on targeted equipment, and on the 16th it updated its recommended measures. The latest version lists Danfoss's AK-SC series and AK-SM series, Copeland's xweb and Dixell's xweb as affected equipment. The top-priority measure is not to expose management interfaces directly to the internet, and where remote connection is necessary, it asks that this be done via a VPN (virtual private network) or a protected network. For Danfoss products, it also recommended updating firmware, changing the security level to "Strict," and changing default passwords.
In the same alert, CERT-FR pointed out that the attack campaign is likely to be continuing. In particular, it warned that continuing to expose equipment whose support has ended and which no longer receives security fixes to the internet makes compromise highly likely. Belgium's CCB issued a similar advisory on October 13, explaining that the management screens targeted in the attacks appear to have been accessible from the public internet. According to a Danfoss spokesperson, the company also advised customers in the Netherlands on October 13 to disconnect their systems from the internet and reconnect only via a protected network.
| Date | Event |
|---|---|
| August 1, 2025 | Danfoss publishes security advisory "DSA-2025-08-01" and provides fixed version 4.3.1 for the AK-SM 8xxA |
| August 2026 | Claroty Team82 publishes research findings on vulnerabilities in the AK-SM 800A |
| Night of October 11, 2026 | First-wave attack occurs in France |
| October 12 | CERT-FR publishes first version of its alert |
| October 13 | CERT-FR adds affected equipment. CCB publishes an advisory, and Danfoss says it recommended that Dutch customers disconnect from the network |
| October 16 | CERT-FR updates its recommended measures |
| Early November 2 | Second-wave attack occurs across Europe |
Twenty-one days passed between October 12, when CERT-FR issued its first alert, and November 2, when the second wave occurred, and 20 days since October 13, when Danfoss says it advised Dutch customers to disconnect. This attack did not occur without any warning. About three weeks after the attack method became known and authorities and the manufacturer presented specific countermeasures, similar damage was repeated. Moreover, the fixed firmware for the known vulnerabilities in the AK-SM 800A had been released more than a year before the first attack.
More than 17 companies hit in the Netherlands; Danfoss points to unchanged default passwords
On November 2, a Danfoss spokesperson explained that the refrigeration systems attacked in the Netherlands were not connected to a protected network and that their default passwords had not been changed. As of October 13, the company had recommended disconnecting from the internet, and it takes the view that some stores that did not take the measures were damaged. Danfoss's explanation is that the attacks could have been prevented with appropriate measures, but this is not the result of independent third-party verification. In addition, this explanation concerns the case of the Netherlands; the configuration of the equipment damaged in other countries, such as Belgium and Sweden, has not been disclosed. Neither authorities nor manufacturers have announced the specific intrusion route, including which vulnerabilities or credentials were actually exploited, for either the first or second wave.
Claroty, which researches industrial systems security, updated its blog on November 2 to add Danfoss's explanation of the damage in the Netherlands. The company says details of the intrusion route in the first attack in France are also still unknown. Meanwhile, Sweden's ICA explained that the affected stores used external equipment contractors and connection routes separate from ICA's central network. These reports suggest that the network environment in which each store's refrigeration equipment was managed is an important factor in understanding the damage.
In Belgium, Stephan Moelans, CEO of Sabcobel, which maintains Delhaize's refrigeration equipment, explained that the attack used exactly the same method as in France. Specifically, the attackers switched evaporators to defrost mode. Of the several hundred units the company manages, about 20 were affected, he said. CCB spokesperson Katrien Eggers said the identity of the attackers is unknown and may never be identified. Belgium's federal prosecutor's office has opened an investigation, but no claim of responsibility has been confirmed.
The published information suggests that, at least for some of the damaged equipment in the Netherlands, the basic security measures recommended by authorities and the manufacturer had not been implemented. However, not all of the damage can be explained by misconfiguration alone. The particular problem is the older products that Danfoss cited as damaged equipment in the first wave in France. These include units whose support has already ended and whose known vulnerabilities cannot be addressed through firmware updates.
AK-SM800 and AK-SC355 cannot be updated; fixes cover only current models
On October 12, Danfoss issued a statement on the attack in France, explaining that the damaged equipment included older products and current products running old firmware. The older models named were the "AK-SM800" and the "AK-SC355," neither of which receives software or security updates. According to the newsletter "Tech Insider" that the company issued in October 2025, the AK-SM800 had its end of support declared in May 2021, and the AK-SC355 was discontinued in 2016. Meanwhile, for the current product "AK-SM800A," units using old firmware were reportedly damaged.
This difference bears directly on how known vulnerabilities can be handled. The security advisory "DSA-2025-08-01" that Danfoss published on August 1, 2025 covers the AK-SM 8xxA series and does not include the older AK-SM800 or AK-SC355. Because no fixed version exists that can be applied to the older units, they cannot be dealt with by updating firmware as current models can. There is also no information that any of the published CVEs (Common Vulnerabilities and Exposures identifiers) was actually exploited in this attack, and neither authorities nor the manufacturer have disclosed the intrusion route.
DSA-2025-08-01 reports two vulnerabilities in AK-SM 8xxA series devices before version 4.3.1. "CVE-2025-41451" is an issue that allows remote code execution through command injection after authentication. "CVE-2025-41452" is a vulnerability that could allow an authenticated user to rewrite web server settings and cause a service outage. Danfoss asks customers to update to firmware 4.3.1 as the countermeasure, and the workaround field of the advisory says "N/A." The vulnerabilities were reported by Team82, Claroty's research division.
In August 2026, Team82 published detailed research findings on the vulnerabilities in the AK-SM 800A. The research also reported "CVE-2025-41450," an issue that allows normal authentication to be bypassed by using a daily-changing code. In addition, a survey using Censys, a search service that scans internet-exposed devices, found 2,765 AK-SM 800A units accessible from the public internet. According to Claroty, these issues are fixed in firmware R4.3.1. However, in its October 12 blog, the company said it does not know how many of the 2,765 units confirmed have the fixed version applied.
| Equipment | Support and damage status | Published fix | Source |
|---|---|---|---|
| AK-SM800 | End of support declared in May 2021. No security updates | None | Danfoss statement, Tech Insider |
| AK-SC355 | Discontinued in 2016. No security updates | None | Danfoss statement, Tech Insider |
| AK-SM800A | Current product. Danfoss says units running old firmware were damaged | 4.3.1 (August 2025). Fixes CVE-2025-41451 and CVE-2025-41452. According to Claroty, CVE-2025-41450 is also fixed in R4.3.1 | DSA-2025-08-01, Claroty Team82 |
| Copeland xweb | The older-generation XWEB EVO, where vulnerabilities were confirmed, is end-of-service. XWEB PRO is a current product | No security fixes will be provided for XWEB EVO | Copeland product notice |
| Dixell xweb | Designated by CERT-FR as affected equipment. Support status unconfirmed | Could not be confirmed | CERT-FR alert |
Even among refrigeration equipment made by Danfoss, the measures that can be taken differ greatly by model. For the AK-SM800A, updating firmware to 4.3.1 addresses the published vulnerabilities. For the AK-SM800 and AK-SC355, however, no fixed version has been provided, so there is no option of resolving known problems by updating software. For such older units, isolating them from the network and replacing the equipment itself are important.
Danfoss cites its own support policy and European law as reasons for ending update provision to older units. According to Tech Insider, at the company, declaring end of support leads to the end of subsequent service provision. It further explained that, in light of European cybersecurity legislation, it strictly applies its policy of ending service for older units whose support has already ended. In the company's view, continuing to service older units would create a new legal obligation to maintain security updates. For that reason, it had been urging customers to consider replacing equipment through its sales contacts.
This is not the first time older units have been targeted. In the same newsletter, Danfoss describes a 2022 case in which supermarkets using the AK-SM800 at 16 stores in Russia were targeted. That same year, 40 stores in Israel were also hacked; all of them used the AK-SM800 and had not installed proper firewalls or VPNs. Given such past damage, the company had reiterated its policy of ending service for older units to customers in October 2025. About a year later, the first wave of this attack occurred in France.
Manufacturers other than Danfoss also face security problems with older units. Copeland has acknowledged that specific vulnerabilities exist in the controller generation whose support has ended, and no security fixes will be provided for the older XWEB EVO. XWEB PRO, meanwhile, is treated as a current product. Moelans of Belgian equipment maintenance company Sabcobel explained that software updates alone are not sufficient and that physical modifications may be needed. He added that the simplest approach is to manage equipment through a secure network connection.
Even EU law does not require updates for older units; stores must decide between isolation and replacement
According to the EU Agency for Cybersecurity (ENISA), the EU's Cyber Resilience Act distinguishes between the vulnerability-handling obligations and the reporting obligations that manufacturers bear. Reporting obligations continue after a product's support period ends, while handling obligations, including fixing vulnerabilities and providing free security updates, are limited to the support period. In other words, manufacturers have no obligation to keep providing security fixes for products whose support has ended. In addition, according to the European Commission, products placed on the EU market before December 11, 2027 fall outside the scope of the Act, except for reporting obligations, unless they undergo a substantial modification after that date. The AK-SM800 and AK-SC355, which Danfoss cited as damaged equipment in the first wave, are products whose support has ended or which have been discontinued.
In this situation, simply hoping that fixed versions will be provided for older units cannot resolve the security problem. The realistic measures recommended by authorities and manufacturers are to eliminate the internet exposure of management interfaces and to replace older units with supported products. CERT-FR and the CCB ask that management screens be cut off from the public internet, and Danfoss explains that it has long recommended migrating from older units to current ones.
However, when disconnecting store refrigeration equipment from the network, operational checks are also needed. CERT-FR and the CCB ask owners to check the terms of their insurance policies before stopping data transmission to maintenance contractors. If remote monitoring for temperature control or similar is a requirement under the contract, cutting the connection may cause other problems. They also recommend reviewing the equipment's entire configuration, centered on defrost schedules, to check whether any unauthorized changes remain. Both agencies warn that even if a compromised device is reset to its factory state, it may be attacked again if its internet exposure has not been eliminated.
The manufacturer announcements and European authority advisories do not include damage in Japan or warnings from Japanese authorities. However, if maintenance contractors remotely manage the refrigeration equipment of stores and warehouses over the internet, the checks that European authorities set out could also serve as a reference for equipment management in Japan. First, it is necessary to check whether management interfaces are accessible from the public internet and whether default passwords have been changed. Next, it is advisable to check for suspicious changes to settings such as defrost schedules and, if remote connections are to be cut, to check the effect on maintenance and insurance contracts.
If Danfoss's explanation is correct, some of the equipment attacked in the Netherlands might have been protected by disconnecting from the internet or changing default passwords. For the AK-SM800 and AK-SC355, which receive no security updates, isolation from the network and equipment replacement are the more important measures. CERT-FR has pointed out that the attack campaign may be continuing, and the risk of operating older units exposed to the internet remains. It is still unknown which vulnerabilities or credentials were specifically exploited in the two attacks. What to watch next is how far technical investigation results from Danfoss and national authorities, together with the investigations by the Paris prosecutor's office and Belgium's federal prosecutor, clarify the intrusion route and the causes of the spread of damage.