Over 100 European stores hit as Danfoss and Copeland refrigeration controllers are hijacked in a second attack wave
More than 100 stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden had refrigerators and freezers forced to heat up overnight from Sunday to Monday. Problems were also reported in Finland, Italy and Portugal. The incidents resemble the attacks of 11-12 October that hit about 700 French supermarkets, but investigators have not established whether the two waves are linked, and no one has claimed responsibility. The affected devices are reportedly Danfoss and Copeland refrigeration controllers with internet-reachable management interfaces. Officials have not publicly explained how the attackers got in. The EU agriculture commissioner called the attacks a deliberate attempt to disrupt the food supply chain.
Entenda a falha
A vulnerabilidade
No CVE has been published, and the articles do not describe a specific software bug. The affected products are Danfoss AK-SM and AK-SC controllers and StoreView, Copeland controllers and Dixell XWEB systems. Kevin Beaumont says every freezer hit on 2-3 November had a management interface reachable from the internet, and many of the devices are end-of-life with no patch. Attackers forced evaporators into defrost mode, with some units set as high as 50°C. Officials have not said how the attackers got in. Danfoss says most compromised units in France were legacy products it no longer updates. Censys estimates that some exposed StoreView instances run a patched firmware, but the articles do not name fixed versions.
Como funciona
The attackers reach the controller's management interface over the internet. They then command the refrigeration units, forcing the evaporators into defrost mode and raising temperatures, so chilled and frozen food spoils. The articles do not say how access to the interface was obtained. Lupovis saw login attempts using publicly documented factory-default credentials, and other probes that looked like fingerprinting of controller components, against its Danfoss AK-SM sensors between 20 and 30 October. All of those attempts were rejected, and the articles do not tie them to the real incidents.
Por que é vulnerável
The public evidence points to exposure rather than a single coding error: management interfaces reachable from the internet, default credentials that were documented and apparently being tried, and end-of-life units that cannot be patched. Officials have not confirmed the root cause. Sabcobel's CEO says a software update alone does not fully resolve the weakness and the equipment also needs physical modification. The articles do not explain what that modification is.
Como foi descoberta
The flaw was not found by researchers before the fact. It came to light through attacks seen in the wild: about 700 French stores on 11-12 October, then more than 100 stores in other European countries on 2-3 November. CERT-FR tied the first wave to Danfoss AK-SM and AK-SC, then extended its alert to Copeland and Dixell XWEB. Danfoss told customers on 13 October to cut internet connections. Investigators have not established whether the two waves are linked, and no one has claimed responsibility. Lupovis and Censys added telemetry on scanning activity and exposure.
Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 05:16.
Detalhes técnicos
- In the first wave (France, 11-12 October), refrigeration units at about 700 stores were forced into defrost mode, including Intermarché, Carrefour, Coopérative U and Monoprix. Food was spoiled and fires were reportedly caused. CERT-FR tied the compromises to Danfoss AK-SM and AK-SC controllers, then extended its alert to Copeland and Dixell XWEB systems. Danfoss said most compromised units were legacy products it no longer updates.
- In the new wave, a Belgian refrigeration firm (Sabcobel) said attackers forced the evaporators into defrost mode, as in France. Some units were set as high as 50°C. Sabcobel said a software update is not enough and the equipment also needs physical modification.
- Researcher Kevin Beaumont said every freezer hit on Monday had an internet-reachable management interface. Many devices are end-of-life with no patch available.
- Lupovis saw suspicious activity against its Danfoss AK-SM sensors between 20 and 30 October, peaking on 26 October. Most login attempts used factory-default credentials documented publicly, and others appeared to fingerprint specific controller components. All attempts were rejected.
- Censys counts just over 1,000 Danfoss StoreView interfaces online. Exposed instances in France fell from 1,825 before the attacks to 220. About 41% of the French instances still online appear patched, against 68% in Belgium (138 exposed), 37% in the Netherlands (51) and 58% in Sweden (50). Censys did not say whether patched devices were among those compromised on Monday.
- Reported impact: Delhaize (several dozen stores in Belgium, four in Luxembourg), Carrefour Belgium (15 locations), Colruyt (five Spar shops), an IKEA store in Mons, SuperValu in Ireland (13 stores), ICA and Coop in Sweden, Kesko in Finland, Coop-branded stores in Sicily, seven Intermarché stores in Portugal, and at least 17 businesses in the Netherlands. The Belgian federal prosecutor has opened an investigation.
Remediação
- Danfoss told customers on 13 October to cut their systems' internet connections and reconnect only through a secure network. Some stores did not act.
- Remove management interfaces of refrigeration controllers from the internet, change default credentials, and apply available firmware updates. Replace or physically modify end-of-life units that cannot be patched.
Linha do tempo
-
Over 100 European stores hit as Danfoss and Copeland refrigeration controllers are hijacked in a second attack wave
ler a análise desta fonte ocultar
More than 100 stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden had refrigerators and freezers forced to heat up overnight from Sunday to Monday. Problems were also reported in Finland, Italy and Portugal. The incidents resemble the attacks of 11-12 October that hit about 700 French supermarkets, but investigators have not established whether the two waves are linked, and no one has claimed responsibility. The affected devices are reportedly Danfoss and Copeland refrigeration controllers with internet-reachable management interfaces. Officials have not publicly explained how the attackers got in. The EU agriculture commissioner called the attacks a deliberate attempt to disrupt the food supply chain.
Technical Details
- In the first wave (France, 11-12 October), refrigeration units at about 700 stores were forced into defrost mode, including Intermarché, Carrefour, Coopérative U and Monoprix. Food was spoiled and fires were reportedly caused. CERT-FR tied the compromises to Danfoss AK-SM and AK-SC controllers, then extended its alert to Copeland and Dixell XWEB systems. Danfoss said most compromised units were legacy products it no longer updates.
- In the new wave, a Belgian refrigeration firm (Sabcobel) said attackers forced the evaporators into defrost mode, as in France. Some units were set as high as 50°C. Sabcobel said a software update is not enough and the equipment also needs physical modification.
- Researcher Kevin Beaumont said every freezer hit on Monday had an internet-reachable management interface. Many devices are end-of-life with no patch available.
- Lupovis saw suspicious activity against its Danfoss AK-SM sensors between 20 and 30 October, peaking on 26 October. Most login attempts used factory-default credentials documented publicly, and others appeared to fingerprint specific controller components. All attempts were rejected.
- Censys counts just over 1,000 Danfoss StoreView interfaces online. Exposed instances in France fell from 1,825 before the attacks to 220. About 41% of the French instances still online appear patched, against 68% in Belgium (138 exposed), 37% in the Netherlands (51) and 58% in Sweden (50). Censys did not say whether patched devices were among those compromised on Monday.
- Reported impact: Delhaize (several dozen stores in Belgium, four in Luxembourg), Carrefour Belgium (15 locations), Colruyt (five Spar shops), an IKEA store in Mons, SuperValu in Ireland (13 stores), ICA and Coop in Sweden, Kesko in Finland, Coop-branded stores in Sicily, seven Intermarché stores in Portugal, and at least 17 businesses in the Netherlands. The Belgian federal prosecutor has opened an investigation.
Remediation
- Danfoss told customers on 13 October to cut their systems' internet connections and reconnect only through a secure network. Some stores did not act.
- Remove management interfaces of refrigeration controllers from the internet, change default credentials, and apply available firmware updates. Replace or physically modify end-of-life units that cannot be patched.