Europe’s freezer cyberattacks: how hackers turned refrigeration systems into cyber-physical weapons

A technical deep dive into OT security, internet-exposed controllers, authentication weaknesses and the new threat to Europe’s cold chain. 3 November 2026.

Imagine walking into a supermarket and discovering that every freezer has stopped preserving food and started destroying it.

No ransomware note. No encrypted database. No traditional IT outage.

Instead, refrigeration equipment has been remotely manipulated, temperatures have climbed, and stock must be thrown away.

This is no longer a hypothetical industrial cybersecurity scenario. In October and November 2026, retailers across Europe had their refrigeration management systems attacked, exposing a weakness that is easy to overlook: the convergence of IT, operational technology (OT) and internet-accessible industrial control systems.

The uncomfortable lesson: an attacker does not need to encrypt your servers to disrupt your business. Sometimes, changing a physical process is enough.

1. What happened across Europe?

The first wave hit France on the night of 11 October 2026. Hundreds of supermarkets were affected, including stores run by Intermarché and Netto (Les Mousquetaires), Carrefour, Coopérative U, Monoprix and E.Leclerc. CERT-FR issued an alert the next day.

Attackers gained control of remotely managed refrigeration controllers. Les Mousquetaires said its fridges and freezers were put into defrost and heated to as much as 50°C. Intermarché said affected stores had to discard the products concerned, and some damage reports described equipment beginning to catch fire.

On 2 November, a second wave hit retailers in Belgium, Sweden, Luxembourg, Ireland, Estonia, Finland, the Netherlands, Portugal and Italy. Reported targets included Delhaize, Carrefour, Intermarché, Spar, ICA, Coop, SuperValu, Selver, Kesko and an IKEA store in Mons, Belgium.

At an ICA store in Sjöbo, Sweden, fridges and freezers were reportedly set to 50°C and goods were thrown away, although ICA itself has not confirmed a cyberattack.

The operational consequences went well beyond equipment malfunction:

Loss of temperature-sensitive stock.
Emergency disposal of fresh and frozen food.
Disruption to store operations and replenishment.
Potential food safety incidents.
Financial losses and reputational damage.
Emergency call-outs for refrigeration engineers and security teams.

The attackers’ identity is unknown, and it has not been established whether both waves were one campaign. Belgium’s Centre for Cybersecurity has said the perpetrators may never be identified, and Belgium’s federal prosecutor has opened a criminal investigation.

The important distinction: the physical impact is confirmed, but the full intrusion sequence and attribution remain under investigation.

2. The technical architecture: how do you hack a freezer?

Modern supermarket refrigeration is not a set of standalone appliances with mechanical thermostats. Larger installations use networked controllers and supervisory management platforms to coordinate compressors, evaporators, sensors, alarms, temperature limits and schedules.

A simplified architecture looks like this:

Remote maintenance provider or operator
↓
Internet or remote-access network
↓
Refrigeration management interface
↓
Supervisory controller / system manager
↓
Local refrigeration controllers and field devices
↓
Compressors, valves, evaporators, defrost equipment and temperature sensors

Systems such as Danfoss’s AK-SM and AK-SC families provide central monitoring and configuration. CERT-FR’s alert also covers Copeland xweb and Dixell xweb controllers.

An authorised operator may be able to:

Change temperature setpoints.
Configure defrost schedules.
Monitor alarms and historical measurements.
Change operating parameters.
Troubleshoot installations remotely.
Administer users and access permissions.

These capabilities are necessary for efficient operations, but they create an important security boundary. A remote management interface designed for maintenance becomes a remote process-manipulation interface when an unauthorised party gains administrative access.

That is why industrial cybersecurity has to consider more than confidentiality and data theft. It must protect the integrity of physical processes.

3. Reconstructing the likely attack chain

The following is a representative model based on public reporting and official advisories. It is not a verified forensic reconstruction of every incident.

Stage 1: Internet exposure and discovery

The first weakness is that operational management systems can be reached from public networks. Refrigeration systems often need remote support from external engineering contractors, and in some environments the management interface is exposed through an internet-connected gateway, router or embedded web server.

That creates a discoverable attack surface. An attacker can find exposed interfaces, identify device families and software versions, and look at the authentication on offer. Claroty researchers previously found thousands of publicly accessible Danfoss AK-SM 800A management interfaces.

The problem is not remote management itself. It is offering remote management without tightly restricting who can reach and log in to it.

Stage 2: Unauthorised access to the management plane

Once an interface is reachable, authentication becomes the critical control. Weak passwords, default credentials, undocumented authentication mechanisms and outdated software all create openings.

In late October, ANSSI director Vincent Strubel told the French Senate that the attacks were made possible by “fundamental security failures”, citing weak passwords and refrigeration equipment directly exposed to the internet. His initial findings pointed to basic security shortcomings rather than sophisticated software vulnerabilities. Danfoss has said affected Dutch systems were not on a secure network and still used default passwords.

This matters: a vulnerability being present on a product does not prove it was used in an attack. Security teams must distinguish confirmed intrusion evidence from theoretical exploitability.

Stage 3: Manipulation of refrigeration control parameters

With enough management privileges, the threat shifts from unauthorised access to physical process manipulation.

Refrigeration systems run periodic defrost cycles to remove ice. Depending on the equipment, defrost can mean temporarily stopping cooling, using electric heating elements or other thermal methods. That is legitimate when run to engineering specifications, and dangerous when schedules, setpoints or control parameters are maliciously changed.

Potential consequences include:

Excessive or prolonged defrost cycles.
Unexpected changes to temperature setpoints.
Cooling suppression.
Abnormal equipment operating conditions.
Failure to maintain safe storage temperatures.

In the November incidents, the CEO of Belgian refrigeration service provider Sabcobel said attackers switched cooling units into defrost mode, affecting around 20 of the hundreds of units the company manages.

An attacker who can change critical control parameters can cause significant losses without deploying ransomware.

Stage 4: Cyber-physical impact

This is the most significant aspect of these incidents. In a conventional IT attack, an adversary steals information or interrupts software services. In an OT attack, the attacker manipulates a control system that governs a physical process, with consequences such as temperature excursions, equipment damage, lost production or safety hazards.

The freezer attacks show a cyber-physical attack path:

Unauthorised remote access → control parameter manipulation → abnormal refrigeration operation → temperature excursion → physical and economic damage.

This is an integrity attack on operational processes, with direct consequences for availability, food safety and business continuity.

4. The broader risk: Danfoss controller research

On 9 August 2026, Claroty’s Team82 published research (“Freeze the Controller, Defrost the Food”) into vulnerabilities in the Danfoss AK-SM 800A refrigeration management platform. Three CVEs illustrate the wider exposure.

CVE-2025-41450: Improper authentication

Affects AK-SM 8xxA firmware before 4.2. Researchers described a hidden, date-derived “code-of-the-day” authentication mechanism that can bypass normal login. When an alternative mechanism like this exists, the strength of a user’s configured password stops mattering. It is a classic example of undocumented maintenance functionality weakening the entire authentication model.

CVE-2025-41451: OS command injection

Affects AK-SM 8xxA firmware before 4.3.1. Input in the alarm-to-email configuration was not properly neutralised and could be passed into an operating-system command, enabling post-authentication remote code execution. The failure is a broken trust boundary between configuration data and OS command execution, and it shows why embedded OT management applications need the same input validation and secure coding expected of enterprise software.

CVE-2025-41452: Web server configuration manipulation

Also affects firmware before 4.3.1. An authenticated attacker could inject web server configuration directives, potentially causing denial of service.

Together, these findings show that a refrigeration controller can have a much broader software attack surface than its industrial function suggests: embedded web servers, reverse proxies, authentication services, CGI handlers, configuration parsers and OS interfaces.

Important: these CVEs are documented vulnerabilities, but exploiting them has not been established as the cause of the October and November attacks. Danfoss has said most of the units hit in France were older models no longer receiving updates (the AK-SM 800, end-of-life since May 2021, and the AK-SC 355, phased out in 2016), with some AK-SM 800A units running outdated firmware. Danfoss released fixes for the AK-SM 8xxA issues (versions 4.2 and 4.3.1). End-of-life controllers cannot be patched and need replacement or compensating controls.

5. Why traditional IT security controls are not enough

Many organisations protect their IT estate with endpoint detection and response, SIEM, managed SOC services and cloud security tools. Refrigeration controllers and similar OT equipment usually sit outside that coverage, for five reasons.

Incomplete asset visibility. Security teams may not know which industrial controllers exist, what firmware they run, who administers them, or whether they are publicly reachable.

Insufficient segmentation. When OT management services are exposed without proper network boundaries, attackers can reach systems that control physical operations directly.

Third-party access risk. Refrigeration maintenance is often outsourced. The retailer owns the equipment while a contractor manages connectivity, firmware, credentials and configuration. Without explicit responsibilities and security requirements, critical controls fall into an ownership gap.

Legacy technology. Industrial devices stay in service far longer than IT systems. Older firmware may lack modern authentication, logging or vendor support.

Little physical-process monitoring by security teams. A conventional SOC may alert on suspicious network traffic but never see that a refrigeration controller has started an abnormal defrost cycle. That leaves a dangerous gap between security monitoring and real operational consequences.

6. Detection engineering: what should defenders monitor?

Defending refrigeration infrastructure means correlating security events with process telemetry, not relying only on malicious IPs or malware signatures.

A. Identity and remote access

Administrative logins from unexpected sources.
Access outside approved maintenance windows.
Changes to privileged accounts.
Repeated authentication failures.
Unexpected remote support sessions.
Changes to remote-access gateways or firewall rules.

Vendor access should be individually attributable and logged wherever technically feasible.

B. Configuration integrity

Temperature setpoints.
Defrost start times and durations.
Alarm thresholds.
Control modes.
Equipment schedules.
Safety-related settings.

Each change should be checked against an authorised maintenance request or an approved operating baseline.

Detection scenario: a controller starts a defrost cycle outside its approved schedule, followed by a rapidly rising cabinet temperature. That should raise a high-priority operational security alert, especially if it coincides with an unusual remote login. Thresholds must be set with refrigeration engineers and manufacturers, not copied from generic IT rules.

C. Cyber-physical correlation

Correlate three kinds of signal:

Identity: who accessed or changed the system?
Configuration: what command or setting changed?
Process: how did the physical equipment respond?

An isolated temperature alarm may be an equipment fault. An isolated admin login may be legitimate. An unexpected admin session followed by unauthorised defrost changes and abnormal temperatures is a much stronger sign of malicious activity.

D. Independent alarm paths

Where feasible, critical temperature monitoring should run independently of the supervisory management interface. Otherwise the same compromise that changes refrigeration behaviour can also hide the alarms. Independent sensing, local protections and tested escalation procedures reduce the risk of silent process manipulation.

7. A practical defensive roadmap

The priority is to reduce exposure while keeping refrigeration operating safely.

Immediately: identify and contain exposure

Inventory refrigeration management controllers, gateways and remote-access services.
Identify devices reachable via public IP addresses or insecure remote-access paths.
Remove unnecessary direct internet exposure.
Check authentication and eliminate weak or default credentials.
Review defrost schedules, temperature settings and other sensitive parameters.
Investigate unusual configuration activity and temperature anomalies.

Coordinate any network changes with refrigeration engineers, so you don’t interfere with essential maintenance, monitoring and safe operation. CERT-FR also advises checking insurance terms before cutting a contractor’s data uplink.

Short term: secure remote administration

Segmented OT management networks.
A secure VPN or equivalent controlled remote access. CERT-FR treats source-IP filtering only as a temporary measure.
Multi-factor authentication at supported access gateways.
Least-privilege access.
Named vendor identities rather than shared accounts.
Centralised access logging.
Time-limited maintenance access.
Change control for sensitive operational settings.

For Danfoss equipment, CERT-FR also recommends updating firmware, changing default passwords and setting the security level to Strict where supported.

Medium term: build resilience

A complete OT asset and firmware inventory.
Vendor advisory and end-of-life tracking.
Regular configuration integrity checks.
Continuous temperature and operational anomaly monitoring.
Tested restoration procedures.
An incident response playbook for compromised refrigeration controllers.
Independent safety and temperature protections where appropriate.
Formal security requirements for refrigeration maintenance providers.

Prioritise unsupported controllers for replacement or compensating controls. A factory reset is not remediation if the controller goes straight back into the same vulnerable, internet-exposed configuration. CERT-FR says explicitly that a factory reset alone is insufficient in that case, because the device is likely to be compromised again.

8. The wider implications: from refrigeration to critical infrastructure

These incidents are not just a retail problem. The same architecture exists in:

Pharmaceutical cold storage.
Hospitals storing temperature-sensitive medicines.
Food processing and distribution warehouses.
Commercial building management systems.
Industrial HVAC.
Temperature-controlled logistics.

The equipment and safety requirements differ, but the principle is the same: a remotely accessible management interface can change physical conditions. Leave that interface unsecured, and an information-security weakness becomes a physical operational risk.

This also raises governance questions under European cyber-resilience frameworks, including NIS2 where it applies. Supply-chain security, incident handling, access control, asset management and operational resilience have to be treated as connected responsibilities, not separate IT and facilities functions.

9. The strategic lesson for CISOs and OT leaders

Cyber risk can’t be measured only in data loss. Spoiled food, damaged equipment, lost capacity and safety consequences may be the main impact.
Security ownership must extend beyond the IT estate. If a contractor maintains a network-connected controller, you still need to understand its exposure, access arrangements and dependencies.
Process integrity is becoming a core security objective. Preventing unauthorised configuration changes can matter as much as preventing access to sensitive data.

A mature security programme combines IT security, OT engineering, physical safety and business continuity. The real question is not only whether an attacker can reach an industrial system, but what they can make it do once they have.

Final thoughts

The European refrigeration attacks show how a small weakness in an operational management system can have serious real-world consequences. A supermarket can have strong protection around its corporate network, customer data and payments, and still be disrupted through one poorly protected refrigeration controller.

For CISOs, OT engineers, infrastructure architects and industrial operators, the priority is clear: identify exposed cyber-physical assets, secure remote management, monitor process integrity, design independent protections, and build recovery capability before an incident.

The next cyberattack may not lock your systems. It may simply change how they behave.

Are organisations paying enough attention to non-traditional OT assets such as refrigeration controllers, HVAC and building management systems? Can SOCs detect attacks through physical-process anomalies, not just IT security events? We’d like to hear how others are approaching OT asset visibility, third-party remote access and cyber-physical detection.

If you’d like a second pair of eyes on what your organisation exposes to the internet, book 30 minutes with VJ: aiopensec.com/contact