Second wave of attacks on Danfoss refrigeration controls hits supermarkets in Belgium, Sweden, Estonia and the Netherlands
Attackers remotely changed settings on internet-connected refrigeration controls at supermarkets in Belgium, Sweden, Estonia and the Netherlands overnight into 2 November 2026, warming fridges and freezers. The incident comes about three weeks after attacks on hundreds of French supermarkets. Danfoss confirmed its products were involved, and Copeland equipment was reportedly hit in Belgium. No chain reported more than several dozen affected stores, and some discarded or pulled chilled and frozen food. No group has claimed the attacks, and attribution and any link to the French campaign are unknown. Belgium's federal prosecutor has opened a criminal investigation.
Entenda a falha
A vulnerabilidade
No CVE has been assigned. The weakness is exposure and weak configuration of refrigeration controllers, not one named bug. CERT-FR covers Danfoss AK-SM and AK-SC controllers plus Copeland xweb and Dixell xweb. Attackers need network reach to internet-connected units. In the Dutch cases Danfoss says the systems were off a secure network and still used default passwords, and it blames mainly outdated software. Attackers could change settings, such as forcing defrost or raising the setpoint to 50°C, which warmed food. In France most hit units were end-of-life AK-SM 800 and AK-SC 355 models. The articles give no fixed versions, and Danfoss listed no advisory as of 3 November.
Como funciona
Refrigeration controllers run a store's fridges and freezers and can be connected to the internet so contractors can monitor them and fix faults remotely. In these attacks, attackers reached controllers that were exposed or on an unprotected network. They then changed settings on the device. In Belgium they switched cooling units into defrost mode, which heated them instead of keeping food cold. Elsewhere they raised the temperature setpoint, for example to 50°C. The controller simply carries out the new settings. The articles do not say how attackers got in in Sweden, and they do not detail the exact access technique elsewhere.
Por que é vulnerável
According to Danfoss, the cause is mainly outdated software combined with devices left reachable from the internet with default passwords. Old end-of-life models no longer receive security fixes, so CERT-FR says they are very likely to be compromised if left online, and a factory reset alone does not protect them. Sabcobel's CEO adds that a software update is not enough, because some installations need costly physical changes. The articles do not identify a specific code defect. Remediation is to remove internet exposure, use a secure VPN or protected network, update firmware, set the Danfoss security level to Strict and change default passwords.
Como foi descoberta
The problem came to light through exploitation in the wild: first hundreds of French supermarkets, then this second wave on the night into 2 November 2026 in Belgium, Sweden, Estonia and the Netherlands. CERT-FR published an alert, last updated 16 October, saying campaigns are probably still underway. Danfoss advised Dutch customers on 13 October to disconnect from the internet. Nobody has claimed the attacks. Danfoss, Sabcobel and Kitman say the method matches or resembles the French one, but that does not prove the same actors. Belgium's federal prosecutor opened a criminal investigation, and Belgium's Centre for Cybersecurity says the culprits may never be identified.
Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 05:16.
Detalhes técnicos
- In Belgium, attackers switched cooling units into defrost mode (Sabcobel, which manages systems for Delhaize, knows of about 20 affected units). Elsewhere the temperature setpoint was raised, for example to 50°C at an ICA store in Sjöbo (Sweden) and at a Selver store in Estonia.
- Belgian attackers got into individual supermarkets' systems, not those of refrigeration contractors, according to Sabcobel.
- Danfoss told NOS that the affected Dutch systems were not on a secure network and still used default passwords. It also said the weakness lies mainly in outdated software.
- In Estonia, an older Danfoss controller that had not been updated was reached. The article does not say how attackers got in in Sweden.
- CERT-FR's alert (last updated 16 October) covers Danfoss AK-SM and AK-SC series controllers, plus Copeland xweb and Dixell xweb. It says the campaigns are probably still underway. In October, Danfoss said most units hit in France were end-of-life AK-SM 800 and AK-SC 355 models.
- Danfoss, Sabcobel and Kitman said the method matched or resembled the French attack. A shared method does not show the same actors are behind both.
- Danfoss's advisories page listed no advisory on these attacks as of 3 November.
Remediação
- Make sure devices cannot be reached from the internet, including any device on a public IP. Restore remote access only through a secure VPN or protected network. Filtering contractor IPs at a firewall is an emergency measure only.
- Check the whole configuration, especially defrost schedules.
- Update firmware. On Danfoss devices, set the security level to Strict and change default passwords.
- For compromised devices, restart or factory-reset the Danfoss device and reconfigure it before returning it to service.
- End-of-life devices that no longer get fixes are very likely to be compromised if left online, and a factory reset alone does not protect them.
- Sweden's National Cybersecurity Centre advises inventorying internet-connected devices, deciding whether each needs a connection, and layering protections on those that stay connected.
Linha do tempo
-
Second wave of attacks on Danfoss refrigeration controls hits supermarkets in Belgium, Sweden, Estonia and the Netherlands
ler a análise desta fonte ocultar
Attackers remotely changed settings on internet-connected refrigeration controls at supermarkets in Belgium, Sweden, Estonia and the Netherlands overnight into 2 November 2026, warming fridges and freezers. The incident comes about three weeks after attacks on hundreds of French supermarkets. Danfoss confirmed its products were involved, and Copeland equipment was reportedly hit in Belgium. No chain reported more than several dozen affected stores, and some discarded or pulled chilled and frozen food. No group has claimed the attacks, and attribution and any link to the French campaign are unknown. Belgium's federal prosecutor has opened a criminal investigation.
Technical Details
- In Belgium, attackers switched cooling units into defrost mode (Sabcobel, which manages systems for Delhaize, knows of about 20 affected units). Elsewhere the temperature setpoint was raised, for example to 50°C at an ICA store in Sjöbo (Sweden) and at a Selver store in Estonia.
- Belgian attackers got into individual supermarkets' systems, not those of refrigeration contractors, according to Sabcobel.
- Danfoss told NOS that the affected Dutch systems were not on a secure network and still used default passwords. It also said the weakness lies mainly in outdated software.
- In Estonia, an older Danfoss controller that had not been updated was reached. The article does not say how attackers got in in Sweden.
- CERT-FR's alert (last updated 16 October) covers Danfoss AK-SM and AK-SC series controllers, plus Copeland xweb and Dixell xweb. It says the campaigns are probably still underway. In October, Danfoss said most units hit in France were end-of-life AK-SM 800 and AK-SC 355 models.
- Danfoss, Sabcobel and Kitman said the method matched or resembled the French attack. A shared method does not show the same actors are behind both.
- Danfoss's advisories page listed no advisory on these attacks as of 3 November.
Remediation
- Make sure devices cannot be reached from the internet, including any device on a public IP. Restore remote access only through a secure VPN or protected network. Filtering contractor IPs at a firewall is an emergency measure only.
- Check the whole configuration, especially defrost schedules.
- Update firmware. On Danfoss devices, set the security level to Strict and change default passwords.
- For compromised devices, restart or factory-reset the Danfoss device and reconfigure it before returning it to service.
- End-of-life devices that no longer get fixes are very likely to be compromised if left online, and a factory reset alone does not protect them.
- Sweden's National Cybersecurity Centre advises inventorying internet-connected devices, deciding whether each needs a connection, and layering protections on those that stay connected.