Europe's Supermarket Freezers Hacked Again: Danfoss Controllers Turned to 50°C Across Six Countries

In the early hours of 2 November, supermarket managers across Europe were woken by the same alarm: their freezers were heating up instead of cooling down. At about 2:30 in the morning, the manager of a Delhaize store in Eeklo, in Belgium, drove to her shop in the dark to reset a system set to 50°C. In Sjöbo, in southern Sweden, staff at an ICA Kvantum store arrived to find heat blowing into the freezers and no way to turn it down; the store stayed shut on Monday morning. By daylight, the same story had been reported in Belgium, Luxembourg, Sweden, Ireland, Estonia and the Netherlands, with Finland investigating similar faults. This was not a power cut or a faulty thermostat. It was the second wave of the same attack in three weeks, and the warning that should have stopped it had already been issued.

The first wave hit France on the night of 11 to 12 October, when attackers took remote control of refrigeration at as many as 700 supermarkets and independent shops, switching the equipment to continuous defrost for about six hours. Intermarché said 150 to 200 of its stores were hit, Coopérative U about 80, Carrefour about 80 and Monoprix about 30, and the Paris prosecutor's office said the damage included fires. Losses across France ran to tens of millions of euros in a single day. On 12 October, CERT-FR, the French government's computer emergency response team, told every operator of the affected controller families to disconnect them from the internet or filter access, and Danfoss, the Danish manufacturer whose controllers were compromised, sent its own warning on 13 October. Three weeks later, controllers still reachable from the internet were hit in at least six more countries, and a Danfoss spokesman in the Netherlands said the attacks could have been avoided if stores had followed that warning.

The mechanism is almost embarrassingly simple, which is why it keeps working. Each affected store runs its refrigeration from a single central controller: one panel holding the setpoints for every display case and cold room, scheduling defrost cycles and offering a web interface so contractors can adjust equipment remotely. Defrost normally heats the evaporator coils for a short scheduled period to clear ice. The intruders switched it on and left it running, with a setting of up to 50°C, so the heaters warmed the cabinets they were meant to protect. According to an analyst at the French security company Sekoia, the attackers appear to have used no malicious code on the controllers themselves, leaving investigators with fewer traces. The models named by Danfoss, the AK-SM 800 and the AK-SC 355, are the same two hit in France; Danfoss declared the AK-SM 800 end of life in May 2021 and phased out the AK-SC 355 in 2016, and neither has received a security update since. In the Netherlands, Danfoss said some attacked equipment was not on a protected network and still used default passwords.

What makes the second wave harder to dismiss than the first is who got hit. The large chains mostly held: Carrefour Belgium said 15 of its more than 700 stores were affected and all remained open, and Sweden's Coop said seven of its 800 stores were hit. The damage concentrated where the system is thinnest — franchised shops, stores outside a chain's central network, small butchers and neighbourhood stores. One Belgian installer said a software update alone would not close the vulnerability, because the installations need physical modifications that cost money. The simplest protection, managing the controllers over a secure connection, is exactly the step small operators, each with their own contractor and budget, are slowest to take.

No group has claimed responsibility for either wave, no ransom has been demanded, and no authority has attributed the attacks. That absence is itself telling: with no financial demand, researchers point toward sabotage rather than extortion. Christophe Hansen, the European Commissioner for Agriculture and Food, called the second wave a deliberate attempt to disrupt food supplies in the EU and undermine public confidence, while adding that Europe's food security is not currently at risk. Belgium's federal prosecutor has opened a criminal investigation. The reassurance is true at the continental scale and almost beside the point at the scale that matters: a store owner south of Antwerp found his fridges at 18°C and called the police, and one Delhaize operator put his damage at no less than 100,000 euros, excluding lost takings.

I read this as a story about infrastructure hiding in plain sight: the cold chain, which everyone depends on and nobody thinks about until it fails, turns out to be run in thousands of shops by retired hardware with a web interface facing the open internet. The fix is not exotic: disconnect the controllers, put them behind a firewall or a VPN, replace hardware the manufacturer stopped supporting years ago. But boring fixes need someone to pay for them and someone to own them, and in a franchised, fragmented retail sector, that someone is often nobody in particular. The first wave was a warning; the second, three weeks after a public warning from a government response team, shows how warnings fail to travel through a system with no single owner. My expectation is that this is not over: with thousands of exposed systems still visible from the internet and a method that has now worked twice, I would expect at least one further publicly reported wave before the end of March 2027, unless the second wave finally forces the disconnections the first one did not.