The second attack in three weeks on European supermarket freezers caused temperatures to rise to 50 degrees Celsius in more than 100 stores, while investigators have yet to identify the culprit.

On the morning of November 2, refrigerators and freezers in a series of European supermarkets were remotely adjusted to about 50 degrees Celsius, damaging goods in more than 100 stores, according to retailers and equipment suppliers. This is the second attack in three weeks, after a similar attack on about 700 victims in France in October, where a store was also burned. No agency has yet identified the culprit.

Belgium suffered the heaviest damage, with more than 50 stores identified, including about 40 Delhaize stores, 15 of more than 700 Carrefour stores, five Spar stores and one IKEA store. In Ireland, SuperValu said a line of refrigeration equipment was compromised in 13 of its 223 stores. Sweden has ICA and Coop, with Coop reporting six stores affected. The Netherlands has at least 17 businesses, mainly butchers and small shops. Estonia, Luxembourg and Finland also recorded unusual temperatures, and later Portugal, Italy and Germany reported more incidents. A supermarket manager in southern Sweden said the temperature could not be adjusted, heat blew straight into the freezer and everything was spoiled.

How to attack the remote controller of the cooling system. French cybersecurity agency ANSSI said Danfoss AK-SM and AK-SC series controllers, along with Copeland and Dixell XWEB series devices, were compromised. An installer in Belgium said the unit was forced into defrost mode like in France, and Danfoss said the incident in the Netherlands was similar to the one in France. In Estonia, an attacker hacked into an older Danfoss system, and a contractor said he blocked the intrusion in just a few minutes.

The notable weakness lies in the age of the device. After the incident in France, Danfoss and Copeland said the majority of attacked devices were products that had been discontinued and no longer received security updates. A British cybersecurity official said this was not an AI attack and did not use an unknown vulnerability: the attacker entered through an internet-connected controller, out-of-support firmware and default password, also known as "due technical debt". Security company Lupovis noted that from October 20 to 30 there was suspicious login activity targeting sensors simulating Danfoss controllers, most of them using default passwords that the company publicly announced. Censys found more than 1,000 internet-accessible Danfoss StoreView interfaces worldwide.

Fixing it is also not simple. Belgian installer Sabcobel said about 20 devices were affected out of hundreds of devices the company manages, and that software updates were not enough, and the devices also needed to be physically modified. Danfoss has announced a "hard shutdown" policy for older lines starting from October 2025, citing new European cybersecurity laws, because continued support would put the company under a legal obligation to maintain patches. The EU's Cyber ​​Resilience Act will force manufacturers to provide a support period corresponding to the product's lifespan from December 2027, and there is currently no legal obligation to fix these attacked devices. On November 3, Danfoss's security advisory page has not posted any announcements about this round.

As for the perpetrators, no government has named anyone. Two Russian posts attributed to the groups Z-Pentest Alliance and NoName057(16) appeared on November 4, unverified. An assessment by SentinelLABS considers pro-Russian groups as credible suspects but says blame remains open. The Belgian Cyber ​​Security Center said it was concerned about the increase in the number of cases, partly due to the intentional use of AI to find and exploit vulnerabilities in the past six months, but it was not known whether AI was used in these cases or not.

At the time of writing, ANSSI said it had been investigating refrigeration system intrusions since mid-October and coordinating with potentially affected industries. The Swedish Cyber ​​Security Agency is sharing information with agencies in the Nordics and Europe.