What happened

  • First wave, overnight 11 to 12 October: around 700 French supermarkets, including Intermarché, Carrefour, Coopérative U and Monoprix, had their refrigeration forced into defrost (SecurityWeek). The Paris prosecutor's office cited food losses and fires (AFP). Dark Reading puts the French retailers' losses in the tens of millions of euros, possibly more, and reports that a smaller number of stores in Belgium, Germany, the Netherlands, Portugal, Poland and Spain were also hit.
  • Second wave, overnight 1 to 2 November: more than 100 stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden, with problems also reported in Finland, Italy and Portugal (SecurityWeek). The Register lists confirmed cases in Germany as well. Setpoints went as high as 50°C.
  • Belgium took the heaviest hit: around 40 Delhaize stores across Belgium and Luxembourg (BBC), 15 of more than 700 Carrefour stores, five franchised Spar shops at Colruyt and an IKEA in Mons (SecurityWeek). Belgium's federal prosecutor has opened an investigation. In Ireland, SuperValu pulled chilled and frozen goods from 13 stores.
  • Beyond retail: the French Blood Establishment (EFS) says cold-room controls at three of its sites were manipulated (Politico). The Register reports setpoints changed from -30°C to 110°C. Staff stepped in and no blood products were lost. In the UK, the Association of Independent Meat Suppliers (AIMS) says members became "collateral". One saw cold units rise to 100°C. They were empty at the time (BBC).

The way in

Unspectacular. CERT-FR's alert covers Danfoss AK-SM and AK-SC controllers, plus Copeland XWEB and Dixell XWEB. Danfoss says most of the units hit in France were legacy models it no longer updates, the AK-SM 800 and AK-SC 355 (The Hacker News). In the Netherlands, the systems that were hit sat on unsecured networks with default passwords, a Danfoss spokesperson told NOS. Danfoss had told customers on 13 October to disconnect. "Most stores took action at that time, but a small number did not."

The UK's NCSC says the attacks weren't AI-enabled and used vulnerabilities that had been "out there for a long period of time" (The Guardian). In August, Claroty disclosed three vulnerabilities in Danfoss AK-SM 800A controllers and 23 in Copeland's XWEB Pro platform (Claroty).

Censys figures (via SecurityWeek): France had 1,825 Danfoss StoreView interfaces exposed online before the October attacks and 220 at the latest count, an estimated 41% of them patched. Belgium: 138 exposed, 68% patched. Netherlands: 51, 37%. Sweden: 50, 58%.

Lupovis honeypots logged 256 attempts from 91 sources between 20 and 30 October. Most used the factory-default credentials Danfoss publishes in its own documentation. Only the European honeypots got probed.

Who's behind it: On the Radar

There's no formal attribution. Lupovis sees overlap with infrastructure previously tied to Russian-linked operations. In a report to customers, Sekoia says the attack fits both Russian hacktivists or the Russian state and Iranian-aligned actors, who compromised around 40 Israeli supermarkets running Danfoss controllers in 2022. To the BBC, Sekoia said it has "no technical evidence" of Russian-speaking groups so far and is sceptical of a claim by NoName057(16) (BBC). In the US, the Pentagon is investigating whether cyberattacks knocked out freezers at at least six military commissaries in August (Axios, Stars and Stripes). Belgium's Centre for Cybersecurity says it may never be possible to identify the attackers (Politico). Evidence for either camp is still thin.

What this means for you

This applies to any business with connected cold storage. Claroty's Sean Tufts names pharmaceutical storage, food distribution centres and industrial facilities (Dark Reading).

  • Settle ownership. Remote access usually exists so the refrigeration contractor can monitor the kit and fix faults (The Hacker News). That settles who repairs it. Who owns its security is something the operator has to decide separately.
  • Work through CERT-FR's list. Take devices off the public internet. Check defrost schedules. Restore access only through a VPN or protected network. Change default passwords, and on Danfoss kit set the security level to Strict. Check your insurance contract before cutting the contractor's data feed.
  • Plan for the old kit. CERT-FR warns that end-of-life devices left online are very likely to be compromised, and a factory reset alone won't stop that. Stephan Moelans, CEO of Belgian refrigeration contractor Sabcobel, says a software update alone isn't enough: the installations also need physical changes (Belga, via SecurityWeek).

CERT-FR says the attack campaigns are probably still underway.

So far the cheapest defence came from Langridge Organic, a London wholesaler, which unplugged its cold stores from the internet at the wall. No budget request needed.

Sources: SecurityWeek · Dark Reading · The Register · BBC · Politico Europe · The Hacker News · The Guardian · Axios · AFP · NOS · Belga · Claroty · Stars and Stripes · CERT-FR, alert CERTFR-2026-ALE-012