Hackers Turned Supermarket Freezers Into Ovens Across Europe Twice in Three Weeks. France's Cyber Agency Says the Controllers' Management Pages Were on the Internet. Here Is What Prevents It.
If you run refrigeration for a store, a restaurant, a warehouse or a pharmacy, find out today whether your controller's web page can be reached from the internet. Attackers remotely changed temperature settings and forced defrost cycles at supermarkets in France in October, and again overnight into Monday, November 2, at more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. France's national CERT says the main factor in the French wave was the exposure of the controllers' management interfaces on the internet, which it calls contrary to good practice. The fix is to take that page off the internet. Everything else on the list is second place.
What happened
France, October 11 to 12. Reports say hackers remotely forced defrosting of refrigeration systems in numerous stores and altered temperatures, destroying fresh and frozen stock. Reported counts vary by outlet. CBS, citing AFP, put it at at least 300 Intermarché or Netto shops, more than 100 Coopérative U outlets, several E.Leclerc stores and 80 Carrefour supermarkets. Paris prosecutors confirmed the attack had sparked fires. Danfoss said its AK-SM800 and AK-SC355 regulator systems were notably affected, that one AK-SM800 version ran outdated firmware, and that most affected equipment was legacy and no longer receives security updates. CERT-FR's alert lists the Danfoss AK-SC and AK-SM series and the Copeland and Dixell XWEB supervisors.
Europe, overnight into November 2. BleepingComputer counts more than 115 stores across six countries, including about 40 Ahold Delhaize stores in Belgium and Luxembourg, 15 Carrefour stores in Belgium, 13 SuperValu stores in Ireland, and at least four ICA and seven Coop stores in Sweden. A Swedish store manager said settings were pushed to 50 degrees Celsius and could not be changed, forcing the store to throw out frozen food. Belgian refrigeration contractor Sabcobel began disconnecting installations about 1 a.m. The article says the attacker used the same vulnerability as in France but does not describe it, does not name the controllers, and does not say whether the devices were reachable from the internet. No group has been named, nobody has claimed it, and nobody knows whether the two waves are the same actor.
What France's CERT says to do
CERT-FR's alert CERTFR-2026-ALE-012, first published October 12 and updated October 16, covers the Danfoss and Copeland or Dixell controllers. It names no CVE and no indicators. For equipment that is not compromised it says:
Remove internet exposure from the controller and from any unit reachable on a public IP address.
Check your insurance conditions before cutting the data link to your refrigeration contractor.
Review the whole configuration, especially the defrost schedules.
Restore access only through a secure VPN or a protected network. Filtering the contractor's source IP addresses on a firewall is acceptable as a short-term measure only.
Apply vendor practice: firmware updates and, on Danfoss devices, setting the security level to Strict. The page also advises confirming default passwords were changed.
For a compromised controller, restart it or factory reset it, take it off the internet, and reconfigure it before it returns to service. The alert warns that campaigns are probably still ongoing, that keeping end-of-life equipment on the internet carries a very high probability of compromise, and that a factory reset alone removes persistence but leaves the device just as vulnerable. Dixell's own guidance for the XWEB supervisors is a separate document that the alert links. A Belgian refrigeration contractor quoted by BleepingComputer said the simplest solution is to manage the refrigerators over a secure internet connection, and the article reports that most of Sabcobel's clients adopted this after the French attack.
Could this have been prevented?
For the stores, mostly yes, and the order matters. The French wave happened three weeks before the November wave, with a public national alert in between. The step that removes the most risk is the one CERT-FR puts first: the management page should not be reachable from the internet. After that, access through a VPN, changed default passwords, the Strict setting and firmware matter in roughly that order. The hard case is old equipment that no longer receives updates, where only replacement or isolation works. The same contractor said a software update alone is not enough because the refrigerators also need physical modifications.
For us, the honest answer is no. These are not our systems, and our feed and edge shield do not reach a store's refrigeration controller. We also did not warn about exposed refrigeration controllers before October. The nearest things we had published were a July post on the Nichirei attack, which shut down a frozen-food supply chain by taking networks offline, a different mechanism, and a July census of exposed management interfaces on server controllers. Both make the same point, that the freezer is critical infrastructure and management pages do not belong on the internet, but neither named these controllers.
How many are exposed
We ran an aggregate count against Shodan today, and we are printing counts only, never addresses. Hosts whose web page title includes XWEB number 7,570. The largest groups are Italy with 2,787, Greece with 1,418, Israel with 946, Slovakia with 374, Belgium with 200 and the Netherlands with 170. France has 120. Belgium and the Netherlands are both in the November wave. This is a fingerprint on a page title, so it will include some false positives, it counts what Shodan last saw, and it does not say that any of these hosts is vulnerable or has been attacked. Our attempts to fingerprint the Danfoss AK-SM and AK-SC pages returned zero, so we cannot size that population, and it is the one named in France.
What to do
Find out if you are exposed. Look up your own public addresses on an internet scanning service, or ask your refrigeration contractor in writing where the controller's web page is reachable from. This is our suggestion, not CERT-FR's.
If it is exposed, take it off the internet and use a VPN. Read the insurance and contractor terms first, as CERT-FR says.
Change default passwords and, on Danfoss units, set the security level to Strict.
Check the defrost schedules and the full configuration for changes you did not make.
Ask your vendor for the model's support status. If it no longer receives updates, plan replacement and keep it off the internet in the meantime.
Have a cold plan. Know how to move stock to refrigerated trucks and who to call, because the stores that saved stock did it by acting early.
What we do about it, and what we cannot
We are not a news site, so here is where we stand, as of this writing.
There is nothing to block yet. CERT-FR lists no indicators and BleepingComputer lists none. If attacker infrastructure is published, we ingest it the same day and add a dated update here.
Our edge does not see these controllers. A store's refrigeration page is not behind our edge shield. Your protection is closing the exposure.
We watch for a CVE. None has been published as of this writing, and our KEV index has no entry for these products.
Free API keys for our blocklist feed are open to anyone, but until someone publishes attacker addresses, taking the management page off the internet is the whole defense.
Limits
The French details come from CERT-FR's alert, which we read directly, plus CBS reporting and search summaries of other outlets. The November details come from one BleepingComputer article, and we could not open CNN's piece. The exposure counts are from one Shodan query set run today and are unvalidated. We did not touch any device, and we cannot say how the attackers got in. Reported store counts vary between outlets.
Five percent of this is wrong somewhere. It always is.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments