Europe’s hacked supermarket freezers had no patch to apply
At 2am on Monday, someone got into the refrigeration controls of an ICA store in Stockholm.
Staff noticed hours later. “There has been a cyberattack and all our freezers reached 50 degrees,” the sales manager told Reuters.
The same night, around 40 Delhaize stores in Belgium and Luxembourg had their evaporators switched into defrost mode. One branch in Hoeilaart put its loss at €100,000, before counting the cost of closing the doors. Shops in Ireland, Sweden, Estonia and the Netherlands reported the same symptoms. At least 7 countries, in a single night.
Three weeks earlier it was France. About 700 of the country’s 10,000 supermarkets were hit, and some stores caught fire. Intermarché’s chief executive put the damage at tens of millions of euros nationwide in a single day.
And there’s one detail I keep coming back to.
Danfoss, whose controllers sat at the centre of the French attack, said most of the affected units were AK-SM 800 and AK-SC 355 systems. It stopped supporting the AK-SM 800 in May 2021. The AK-SC 355 was discontinued in 2016.
There was no patch to apply. That kit had been running without vendor support for 5 years or more, quietly keeping the ice cream frozen, until somebody else took the controls.
How many controllers in your estate are still doing their job perfectly, years after the vendor stopped looking after them?
The freezer had a login page
The method, stripped back, is almost boring.
A supermarket’s chillers and freezers are run by a supervisory controller. It sets temperatures, schedules defrost cycles and raises alarms. It also has a web interface, so the refrigeration contractor can check on it from anywhere.
Plenty of those interfaces sit on the public internet. After the French attack, Reuters counted more than 4,500 Danfoss control interfaces reachable online, over half of them in France. UK Cyber Defence told The Grocer it had found the “front doors” to more than 800 UK retailer fridge control systems in the same state.
In the Netherlands, Danfoss said affected systems sat on unsecured networks with default passwords. In France, according to Le Monde, the attackers stretched defrost cycles from 1 hour to 8 so the alarms stayed quiet. Then they let the food warm up.
The only payload was a skip full of melted ice cream and mince.
The warning arrived years ago. Danfoss’s own technical newsletter, from October 2025, records attacks on the AK-SM 800 back in 2022: 16 supermarkets in Russia and 40 stores in Israel. All 40 Israeli sites lacked a proper firewall or VPN.
In August this year, Claroty’s Team82 took their research on refrigeration controller flaws to DEF CON. Two months later, France.
“With thousands of these interfaces still online, I expect more incidents like this.” Tom Hegel, SentinelOne, speaking after the French attack in October
He was proved right within 3 weeks.
The orphaned controller problem
I’ve started calling this the orphaned controller problem.
The vendor walked away years ago, and the security team never adopted the device in the first place, because refrigeration lives with facilities. It sits on no one’s patch list and in no one’s threat model. It works, so it stays.
Then there’s the contract.
Supermarkets often buy refrigeration as a service. The provider guarantees performance, as long as it gets a constant stream of data from the kit. So the controller stays online because the commercial model needs it online.
That model is sensible, and I’d probably sign the same contract. But it means your attack surface includes the remote access habits of a company you probably audit once a year, if that.
Sabcobel, which runs Delhaize’s refrigeration in Belgium, was blunt after Monday’s wave. A software update won’t be enough; the units need physical changes, and those cost money. Most of its customers had moved to secure connections after France. Some hadn’t.
Here’s where I’ll stick my neck out. The failure sat in procurement, years before any attacker logged in. Someone bought a connected controller with no end-of-support plan, then signed a service contract that required it to be reachable, and the question of year 6 never came up.
What aviation does with parts that age out
In aviation, some components are life-limited. Engine discs, for example, carry a hard limit counted in flight cycles. When a part reaches it, it comes off the aircraft, however good it looks under inspection. The limit is set before the part ever flies, and its records follow it for life.
Operational technology tends to get the opposite treatment. If the freezer is cold, the controller is “fine”. The end-of-support date sits in a vendor PDF filed with the original purchase order.
I’ve spent more than 25 years in infrastructure, a lot of it across UK government and banking. The systems that worried me most were rarely the ones on the risk register. They were the ones so reliable that everyone forgot they existed.
The life-limit framework for OT
1. Give every controller an expiry date
Vendor end-of-support is your life limit. Past it, the device can stay in service only on a network it can’t be reached from, with a dated replacement plan that a named person owns. For kit that’s still supported, patch it: Danfoss shipped firmware R4.3.1 for the AK-SM 800A and Copeland shipped 1.13 for the XWEB Pro. Coop in Sweden had an update booked for the Wednesday. The attack came on the Monday.
Action: pull the end-of-support date for every OT controller into your asset register this week, and flag anything already past it.
2. Treat the contractor’s access as your access
If a third party can reach your kit, your security posture now includes theirs: their credentials, their laptops, their staff turnover.
Action: ask each OT supplier, in writing, how they connect, from where, and whether default credentials have been changed on your devices.
3. Take the login page off the internet
A management interface on a public IP address will be found. Scanning is cheap and automated. Put access behind a VPN or private connection, and treat contractor IP allow-listing as a stopgap.
Action: run an exposure check against your own IP ranges for refrigeration and building-control interfaces. Shodan, Censys or your attack surface tool will do it in an afternoon.
4. Alarm on the physics
The French attackers stretched defrost cycles specifically to keep the alarms quiet. If the controller raises the alarm, whoever controls the controller controls the alarm.
Action: fit one independent temperature sensor, with its own alerting path, in your highest-value freezer.
5. Price the loss before your insurer does
Brokers told Reuters that cyber policies typically exclude physical loss. Intermarché said its cover didn’t extend to this incident.
Action: ask your broker, in writing, whether stock spoiled by a remote defrost attack is covered, and get the answer before the next wave.
Where the UK stands
No UK supermarket has been confirmed as hit. Several UK meat processors did report overnight tampering with fridges running Dixell XWEB software. One found its defrost set to run every hour; another found its fridges set to 100°F.
On Tuesday, NCSC chief executive Richard Horne said the agency had alerted “handfuls of organisations” and was aware of “a couple of incidents where vulnerable technology has been exploited”.
Who did it? No group has claimed it. Some researchers read the missing ransom demand as sabotage. A Swedish expert reckons the hack is simple enough for amateurs. I’d hold the geopolitics until somebody shows evidence, because the controls that would have stopped this are the same whoever was at the keyboard.
The decision on someone’s desk this week
Somewhere in your organisation there’s probably a controller past its support date. It’s online, managed by a contractor, and keeping a few hundred thousand pounds of stock cold.
Does it stay connected for another quarter?
Last time that question came up, it was most likely answered by default. This time, make sure a name goes next to the answer.
Refrigeration engineers: Sabcobel says these units need physical changes and that a software update won’t cover it. What does that retrofit actually involve on an AK-SM 800 site, and what does it cost per store? I’d like to hear from someone who has done one.
Sources for the numbers above: Reuters, The Grocer, BBC, Le Monde, CSO Online, SecurityWeek and the NCSC. Full fact-check notes on request.
The CERT-FR alert covering Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers: CERTFR-2026-ALE-012.
#OTSecurity #DevSecOps #CriticalInfrastructure #CyberSecurity #RetailTech