Hacked Supermarket Freezers: ⚡ Danfoss Flaws Exposed (2026)

What happened across European supermarkets

The reported incidents began in France. Finance Minister Roland Lescure told Parliament on October 13 that about 700 supermarkets had been affected. Groupement Mousquetaires, which operates Intermarché and Netto, said 300 stores were affected. Cooperative U reported problems at 80 of about 2,000 shops. Some display cases at Mousquetaires stores were still out of service the following Tuesday.

France's national cybersecurity agency, CERT-FR, said it was aware of numerous compromises involving remote-control modules made by Danfoss and Copeland. It said attackers forced equipment into a continuous defrost cycle. That can raise temperatures, spoil stock, and, in some stores, contribute to fires. A defrost cycle is part of refrigeration maintenance, but the security issue is whether someone can trigger or manipulate it without authorization.

A second wave of refrigeration problems was reported on Monday in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, and Sweden. The details varied by retailer and country. Carrefour reported disruption at about 15 of its 700 Belgian stores. Four Delhaize outlets in Luxembourg reported problems. In Ireland, Musgrave counted 13 affected SuperValu stores, while Mosqueteiros confirmed incidents at seven Intermarché stores in Portugal.

Italy's Radenza Group said the incident started at 4 a.m. local time and targeted remote controls for frozen-food sections. In Sweden, Coop said six of its roughly 800 stores were affected. Ica also reported problems at a limited number of stores, some of which used an external Danfoss control system. Neither Swedish chain confirmed that its incident was a cyberattack. Finland's Kesko said network interference had not been ruled out.

The scale is significant, but the numbers need context. Reported outages don't prove that every affected store was breached in the same way, and the incidents have not all been independently linked to one campaign. Investigators have not announced an attacker, and no group has claimed responsibility. EU Agriculture Commissioner Christophe Hansen described the events as a deliberate attempt to disrupt the food supply chain, while technical and attribution questions are still unresolved.

The operational effects are clearer. Refrigeration failures can mean lost inventory, disrupted store operations, repair costs, and potential food-safety concerns. Lescure said food supplies were not at risk nationally, while acknowledging that the incident raised food-security concerns. That distinction matters: disruption at individual locations doesn't automatically translate into a broader shortage.

How a refrigeration controller becomes an attack path

Commercial refrigeration is a physical process run through digital controls. A controller can read sensors and operate equipment such as compressors, fans, and defrost systems. Remote access lets a retailer or refrigeration contractor diagnose faults and adjust settings without sending a technician to every location. It also means the equipment may be reachable through a store network, a service connection, and sometimes - depending on how it's deployed - the public internet.

The same remote capability that makes support easier can increase exposure. If a controller is reachable online, uses weak authentication, runs outdated software, or sits on a network with broad access, an attacker may have more ways to reach it. The exact path used in these reported incidents hasn't been confirmed, so it's not appropriate to claim that one specific flaw was exploited.

CERT-FR said it identified compromised remote-control modules from Danfoss and Copeland. Separately, security researchers at Claroty disclosed flaws in Danfoss AK-SM 800A controllers in August, including an authentication bypass. Claroty said it found 2,765 of those devices exposed online. Danfoss said it addressed the reported issues in firmware version R4.3.1.

These facts point to a real exposure risk, but they don't prove that the disclosed vulnerabilities caused the supermarket incidents. The affected controller models and the attackers' specific methods haven't been fully established in public reporting. A device could be compromised through an unpatched flaw, weak or reused credentials, exposed remote-access services, compromised contractor credentials, or another route. Without forensic evidence, these remain possibilities rather than confirmed causes.

It also helps to understand what the system can do when it's wrong. Defrost is a routine process to manage ice buildup, but a continuous or badly timed cycle can interfere with temperature control. If a unit is pushed to an extreme temperature - Estonian units were reported at 50°C (122°F) - the problem stops being just a display-case malfunction. Food quality, safe handling, equipment condition, and whether stock must be discarded become practical concerns. Actual decisions about affected food depend on the retailer's food-safety procedures and local rules; a reported controller state alone doesn't determine whether specific products are safe.

This is a familiar issue in operational technology (OT): an IT security weakness can produce a real-world consequence. The controller isn't just another device to patch. Its availability and behavior affect store operations, and changes made during incident response can affect refrigeration itself. Security teams, facilities staff, refrigeration contractors, and store managers therefore need one shared response plan, not separate procedures that don't connect.

What investigators know - and what remains uncertain

The public record supports a cautious view. France saw a significant wave of freezer disruptions, and CERT-FR linked compromises to remote-control modules from two manufacturers. Similar problems were reported later in nine additional countries. Some operators identified Danfoss equipment or older Danfoss models in affected stores, while others reported network interference or refrigeration malfunctions without confirming a cyberattack.

That's enough to justify defensive steps. It's not enough to conclude that every incident had the same cause, used the same vulnerability, or came from the same actor. Investigators haven't said whether Monday's incidents were connected to the French cases. No group has claimed responsibility, and the campaign has not been publicly attributed to a state, criminal group, or other organization.

CERT-FR also warned that the campaigns were probably ongoing. The warning pointed to a broader problem: end-of-life devices left unpatched and reachable from the internet carry a very high risk of compromise. That isn't a claim that every old controller is vulnerable in exactly the same way. It's a practical assessment of what happens when a device can be reached remotely but no longer gets security updates or can be maintained safely.

Claroty's count of exposed devices is useful for estimating exposure, but it isn't the same as the number of compromised devices. Claroty reported finding 2,765 AK-SM 800A controllers exposed online, and public reporting doesn't say that all - or any specific portion - were involved in the supermarket incidents. Likewise, the existence of an authentication-bypass flaw doesn't prove attackers used it in these cases.

Symptoms also have limits. A freezer entering an unexpected defrost cycle could reflect a cyber incident, but it could also be caused by equipment failure, a configuration mistake, or a communications problem. One anomaly is a reason to investigate, not proof of an attack. And the lack of a confirmed breach doesn't mean an internet-exposed controller is safe to ignore.

For operators, the practical divide is between incident attribution and risk management. Attribution requires evidence: logs, device configuration, network records, forensic analysis, and coordination with relevant authorities. Risk reduction can start before attribution is settled. Actions like limiting public access, checking firmware, and reviewing service paths make sense because they reduce exposure regardless of who caused a particular outage.

That also helps avoid two common mistakes: assuming there's a coordinated, continent-wide attack before the evidence supports it, or treating uncertainty as a reason to do nothing. The right posture is measured urgency - protect systems, preserve evidence, and keep conclusions tied to what investigators can verify.

How operators can reduce the risk

CERT-FR's immediate advice was to remove controllers from the public internet. That's a clear first step when direct exposure is present, but it isn't always just a matter of unplugging a cable. Retail refrigeration may rely on remote monitoring by a contractor, and changes can remove visibility or disrupt service workflows. Operators should map how each site is connected first and agree on a safer monitoring and support path.

A practical response can be organized into four stages:

1. Find and classify the equipment

   Create an inventory of refrigeration controllers, gateways, and related remote-access services. Record the manufacturer, model, firmware, physical location, network connection, who supports the system, and whether security updates are still being delivered. Store-level inventories are often incomplete, especially when equipment was installed by contractors over many years.

   Focus on devices that are internet-accessible, unsupported, running outdated firmware, or connected to networks that also carry normal business traffic. Don't assume a controller is isolated just because it's physically in a plant room or behind a service desk.

2. Remove unnecessary exposure

   Where possible, remove direct public-internet access and move to controlled remote access instead. This could mean a managed VPN or another approved access method, using individual accounts, strong authentication, and access limited to the people and systems that need it. Avoid shared credentials that are hard to revoke or audit.

   Network segmentation can limit damage if one device is compromised. Refrigeration controls shouldn't automatically inherit broad access to payment systems, office computers, or other store technologies. Segmentation needs to be tested against real operational requirements - blocking a legitimate monitoring service can create a different failure.

3. Patch where supported, plan where not

   Check vendor advisories and compare installed firmware to supported versions. The Claroty-reported Danfoss AK-SM 800A issues were addressed in firmware R4.3.1, but operators still need to verify that it applies to their exact model and deployment before upgrading. Firmware changes on operational equipment should follow a maintenance and rollback plan, not be pushed during trading hours.

   Older equipment can require difficult choices. Sabcobel's CEO said many older units require physical modifications that involve investment. If a controller can't be patched or safely isolated, document it as an accepted risk with an owner, compensating controls, and a replacement plan. "We can't upgrade it" is a constraint to manage, not a security strategy.

4. Prepare for a physical incident

   Define what staff should do if temperatures or controller behavior change unexpectedly. The plan should spell out who can switch equipment to a local or manual mode, who contacts the refrigeration contractor, how affected stock is assessed, and how logs and configurations are preserved. It should involve store operations and food-safety leads - not only the IT team.

   Test the communications path before an incident. A central team needs a reliable way to reach stores and service providers if remote monitoring is unavailable. Similarly, a technician arriving on site should know how to avoid overwriting useful evidence while restoring safe operation. The goal isn't to stall recovery for forensics. It's to regain control while keeping enough information to understand what happened.