When Fridges Fail Together: Correlated OT Risk in Supermarket Refrigeration

Key Takeaways

During October and early November 2026, attackers remotely changed the setpoints of commercial refrigeration controllers in supermarkets across Europe. They switched refrigerators and freezers into defrost or heating modes, mostly overnight. The largest wave hit French supermarkets on 11 October 2026, and a second wave on 2 November reached more than 115 stores in at least six countries [1][2][3]. In August, freezers failed at U.S. military commissaries. Those failures are being investigated as a suspected cyberattack and may be related, but no link has been confirmed [7]. Nobody has claimed the European attacks and no ransom has been demanded. Researchers have therefore assessed them as more likely sabotage than extortion, although other motives cannot be ruled out [4].

The first conclusion for security leaders is that this risk is correlated, not isolated. Many stores share the same few controller platforms, the same contractor remote-access patterns, and the same overnight staffing gap. As a result, one technique can cause physical losses at nearly the same time across competing retail chains and across countries. Known weaknesses also appear to have been enough. The affected Danfoss AK-SM and AK-SC devices had published vulnerabilities and internet-facing web interfaces, and in many cases they used default or easily derived credentials. Many were also end-of-life [5][6][1]. It has not been confirmed that the specific disclosed CVEs were exploited. Default credentials and internet exposure alone, however, would have allowed access, and nothing in the public record so far indicates that a zero-day was needed.

Outsourced operational technology (OT) is a major exposure path. Where victims described their setup, specialist contractors installed, monitored, and remotely managed the refrigeration. That arrangement puts the exposure outside the retailer’s IT security program and, in practice, outside its asset inventory [2]. Detection is a related weakness. Several stores did not notice the changes for hours [1][4]. One likely reason is that the compromised controller is normally the system that raises temperature alarms, so an attacker who holds it may be able to suppress them. Thin overnight staffing also contributed. Finally, remediation requires physical and architectural work, not only a patch. CERT-FR and refrigeration contractors warn that a firmware update or factory reset alone will not secure exposed or end-of-life units [6][2].

Background

The Incident Timeline

The earliest publicly reported events took place in late August 2026 at U.S. military commissaries. On 26 August, Fort Huachuca in Arizona posted that a freezer “went into defrost mode where it heated up all the food.” Reuters later counted at least six commissaries with similar failures that month [7]. On 29 October, four officials told Reuters that the Pentagon was treating the failures as a suspected cyberattack. U.S. Cyber Command and Army criminal investigators were involved and in contact with French counterparts. Reuters could not confirm which controller brand the affected bases used [7][8]. The U.S. events should therefore be read as possibly related to the European attacks, not as part of the same campaign.

The French attack on the night of 11 October 2026 is the best-documented event. Attackers reached refrigeration controllers and started defrost cycles or raised target temperatures, reportedly to 50°C. Some equipment ran hot for about six hours before staff noticed [5]. Estimates of the scale vary. BFM TV reported more than 300 affected locations, Reuters reported more than 350 establishments, and later compilations cite up to 700 [5][7][1]. Named victims include Auchan, Carrefour, E.Leclerc, Intermarché, Monoprix, and Coopérative U. Groupe Casino said about 5% of Monoprix stores were hit, and Monoprix operates more than 600 locations [5]. According to Reuters, some units caught fire, and one supermarket owner said costs could reach tens of millions of euros [7]. CERT-FR published alert CERTFR-2026-ALE-012 on 12 October and updated it on 13 and 16 October, adding targeted equipment and revising its guidance [6].

The second wave began overnight into 2 November 2026. BleepingComputer counted more than 115 affected stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. These included about 40 Ahold Delhaize stores, 15 of Carrefour Belgium’s 700, 7 of Coop Sweden’s more than 800, and 13 of Musgrave’s 223 SuperValu stores in Ireland [3][2]. The Hacker News reported smaller numbers of incidents in Portugal, Italy, and Finland [2]. ICA said one attack took place around 2 a.m. but was not noticed until hours later [4]. Danfoss said the Dutch attacks used the same method as the French ones, and contractors in Belgium and Estonia reported similar techniques. As The Hacker News points out, though, a shared method does not prove a shared actor [2].

The Affected Technology

The CERT-FR alert names Danfoss AK-SM and AK-SC series system managers, along with Copeland XWEB and Dixell XWEB supervisors [6]. These are store-level supervisory controllers. They coordinate compressor racks, display-case controllers, and defrost schedules. They usually expose a web management interface so that refrigeration technicians can monitor and adjust them remotely. That design concentrates risk. A single supervisory device can change setpoints and defrost behavior for every case in a store, so one compromise means losses across the whole store.

The vulnerability record for these products was public well before October. CISA advisory ICSA-25-140-03, first published in May 2025 and updated in August 2025, describes three flaws in the Danfoss AK-SM 8xxA series [9]. The first is an improper-authentication weakness caused by datetime-based password generation (CVE-2025-41450), fixed in R4.2. The second is command injection through the alarm-to-mail configuration fields (CVE-2025-41451). The third is external control of configuration settings (CVE-2025-41452). Both of the latter are fixed in R4.3.1. When the advisory was published, CISA reported no known public exploitation [9]. Claroty Team82, which found the flaws, published a detailed write-up in August 2026. It reported 2,765 internet-visible AK-SM 800A devices in Censys scan data [10].

It is not yet confirmed that the attackers used these specific CVEs, and SecurityWeek reported that their exploitation was unclear [5]. Danfoss has said that most affected French units were older AK-SM 800 and AK-SC 355 models that it no longer updates. It has also said that the affected Dutch systems were not on a secure network and still used default passwords [2]. Unverified reports compiled on Wikipedia state that many exposed controllers accepted the username “admin” with the current date as the password [1]. CSA has not found a primary or press source for that detail. It would fit the “code of the day” behavior Claroty described, but CSA has not independently verified the link.

Security Analysis

Why This Is a Correlated-Risk Event

Security programs usually treat a building-system compromise as a local incident, with one site, one device, and one remediation ticket. The refrigeration attacks show why that framing fails for widely deployed OT. In this case, several shared dependencies linked the stores’ risk, and each one made the others worse. Defenders and risk managers need to understand those links before they can judge how much damage a single technique can do at once.

The first link is platform monoculture. Commercial refrigeration supervisory controllers come from a relatively concentrated set of vendors, and Claroty alone identified 2,765 internet-visible AK-SM 800A units [10]. When one product family has an authentication weakness and a reachable web interface, every exposed installation is vulnerable in the same way, regardless of the retail brand on the storefront. SentinelOne researcher Tom Hegel observed that retail is an easy target “because retail chains run enormous estates of refrigeration controllers” [4]. The second link is shared remote-access practice. Contractors who service many stores tend to use one connectivity model for all their customers. When that model is direct internet exposure, which CERT-FR’s first recommendation targets [6], the contractor’s whole customer base shares the risk. The third link is shared timing. Supermarkets have few staff overnight, so an attacker who acts at 1 or 2 a.m. can go undetected for hours at every site at once [3][4].

Taken together, these links break the assumption behind most loss models, which is that failures at separate sites are statistically independent. A product recall plan, a spoiled-stock insurance policy, or a business-continuity plan sized for one store’s freezer failure will be far too small for hundreds of failures on the same night. CSA’s inference for insurers and risk officers is that refrigeration OT behaves more like a shared cloud dependency than like a collection of separate appliances. It should be modeled for accumulation risk in the same way.

The Third-Party Control Plane

Ownership and control of refrigeration systems are often split. The retailer owns the equipment and the stock. A refrigeration contractor installs, monitors, and services the equipment, often under a maintenance contract that requires remote telemetry. The retailer’s IT security team may not know the device exists. ICA’s statement shows the pattern. Its own systems were unaffected, and the affected stores were connected to an outside Danfoss-supplied control system on a network separate from ICA’s central network [2]. That separation kept the incident away from corporate IT, but it also left the controllers outside the corporate security program. The pattern is not universal, however. Sabcobel reported that in the Belgian cases the attackers got into individual supermarkets’ systems, not those of refrigeration contractors [2].

CERT-FR’s guidance points to a contractual pressure that defenders should expect. It advises operators to check their insurance conditions before cutting the data uploads their refrigeration contractor receives [6]. In other words, the commercial arrangement that justifies remote connectivity may itself carry obligations that discourage disconnection. That tension deserves explicit attention in governance discussions. The parties who benefit from remote access, meaning contractors and indirectly insurers who want monitoring, are often not the parties who carry the security risk. The retailer, which carries the risk, may not have the authority to change the access model on its own.

Detection Failure by Design

The most instructive operational detail is how long stores went without noticing. In France, some equipment ran hot for about six hours [5], and ICA reported a gap of several hours between the attack and its discovery [4]. In a typical store, the supervisory controller is also the system that generates temperature alarms. An attacker who controls it can change setpoints, start defrost cycles, and potentially suppress the alarms that would page a technician, or simply never trigger them. Thin overnight staffing likely added to the delay [1]. One Swedish store manager reported that settings had been changed to +50°C and could not be modified locally [3]. That suggests the attacker may also have been able to block on-site recovery through the normal interface.

Not every retailer was blind, however. Musgrave said its monitoring systems flagged the issue, which let it pull affected stock and restore operations [4]. Its incident was also limited to one refrigeration model [2]. In Estonia, the affected freezer’s temperature rose only 2–3°C and the problem was fixed in about ten minutes [2]. These differences show that early detection limited the damage. Public reporting does not say whether the monitoring that caught these events was independent of the attacked controllers. Even so, the contrast is consistent with a general OT security principle: safety-relevant monitoring should not share a trust boundary with the control system it watches.

Physical Consequence and Food Safety

The consequences went well beyond lost data or service downtime. Overheated units caught fire in some French stores [7]. Large volumes of chilled and frozen products were destroyed [4], and food safety obligations forced stores to pull stock whenever cold-chain integrity could not be guaranteed. Groupe Casino said that products whose storage conditions could not be guaranteed were being removed from sale [5]. A Belgian butcher estimated about €15,000 in ruined meat at a single small shop [4]. EU Agriculture Commissioner Christophe Hansen described the November attacks as “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it” [4].

The table below summarizes the documented waves. Counts come from early reporting and differ between outlets, so readers should treat them as provisional.

Motive and Attribution

No group has claimed responsibility, and Belgium’s Centre for Cybersecurity has said the perpetrators “may never be determined” [4]. Because no ransom was demanded, analysts have concluded that the campaign is more likely sabotage than extortion, although other motives cannot be ruled out [4]. Reporting has raised the possibility of amateur actors and of state actors with a record of sabotage, without evidence for either [1]. Moscow has denied involvement in sabotage or hybrid operations [4]. For defensive planning, attribution matters less than capability. The technique appears to need no special skills, works against a large exposed population, and produces visible physical effects. In CSA’s assessment, these features would make the technique attractive to a wide range of actors and raise the risk of copycat activity, whoever started the campaign.

Recommendations

Immediate Actions

Retailers, cold-storage operators, food-service businesses, and any other organization running commercial refrigeration should act now, without waiting for vendor advisories. For the next few days, the goal is to find and remove internet exposure and to confirm that control configurations have not been changed. The first task is to find every supervisory refrigeration controller in the estate, including those that contractors install and manage. Organizations should ask each refrigeration service provider, in writing, which devices it reaches remotely and how.

With that inventory in hand, organizations should remove direct internet exposure from Danfoss AK-SM/AK-SC, Copeland XWEB, Dixell XWEB, and similar devices, including any on public IP addresses. This is CERT-FR’s first recommendation [6]. Contractual and insurance telemetry obligations should be checked in parallel, but they should not delay disconnection. Configurations need an audit as well, with particular attention to defrost schedules, setpoints, alarm thresholds, and user accounts, compared against known-good baselines [6].

Organizations should then change default credentials and apply vendor hardening, which for Danfoss devices includes the Strict security level [6]. AK-SM 8xxA units should be upgraded to R4.3.1 or later [9][10]. That patch does not help the older AK-SM 800 and AK-SC 355 models that Danfoss no longer updates [2], so those units must be isolated or replaced. As a precaution, organizations should treat exposed end-of-life units as compromised. This is a conservative planning assumption, not a finding about any particular device, and it reflects CERT-FR’s warning that a factory reset removes persistence but leaves the device open to re-compromise [6].

Short-Term Mitigations

Over the next one to three months, organizations should move from emergency containment to a remote-access architecture that does not depend on device-level authentication. CERT-FR recommends restoring remote access only through a secure VPN or protected network. It treats firewall filtering of contractor source addresses as a temporary emergency measure, not a permanent solution [6]. CISA’s advisory likewise recommends VPN-based remote access and cautions that a VPN is only as secure as the devices connected through it [9]. Contractor access should therefore use individually named accounts with multi-factor authentication and logged sessions. Where possible, access windows should be tied to maintenance activity.

Organizations should also deploy temperature monitoring that is independent of the supervisory controller. Wireless or separately networked probes that report to a different platform can alert on-call staff even when the controller is compromised or silent. The contrast between Musgrave’s early detection and the hours-long gaps elsewhere illustrates the value of early detection [4][5]. Incident runbooks should cover local manual override of compressors and cases, so that store staff or technicians can stop a malicious defrost cycle without relying on the compromised interface. Contractors such as Sabcobel have noted that some installations need physical modification, not just software changes, to support a safer architecture [3]. Budgets and maintenance schedules should allow for that work.

Strategic Considerations

The deeper lesson concerns governance and risk modeling. Building and facility OT, including refrigeration, HVAC, access control, and energy management, belongs in the enterprise security program’s asset inventory and third-party risk process. That applies even where a contractor operates the equipment. Procurement and maintenance contracts should set out the remote-access method, credential management duties, firmware update obligations, end-of-life replacement timelines, and incident notification duties. Contracts that require telemetry should also specify how that telemetry is secured.

Risk officers and insurers should model refrigeration and similar building OT for correlated loss across sites. The working assumption should be that one technique can affect a whole contractor’s or vendor’s install base in a single night. Enterprises with large store estates should consider whether vendor diversity or architectural separation, such as splitting regions across different monitoring platforms, would limit the blast radius. Manufacturers face a parallel task. Hidden or derivable authentication mechanisms, insecure-by-default web interfaces, and long-lived end-of-life products still in the field contributed to this exposure. So did operator and contractor practices such as unchanged default credentials and devices left on public IP addresses. Secure-by-design defaults are the lasting fix on the manufacturer side. Finally, the events in the United States and Europe show the value of cross-border information sharing. The Swedish National Cybersecurity Centre, CERT-FR, and U.S. investigators have all reported cooperation with international counterparts [2][7].

CSA Resource Alignment

The most directly relevant CSA artifact is Zero Trust for Critical Infrastructure Security [11]. It applies Zero Trust principles to OT and industrial control system environments through a five-step process that begins by defining the protect surface and mapping operational flows. The refrigeration attacks show why that first step matters. Supervisory controllers that set temperature and defrost behavior for a whole store are an obvious protect surface. Yet many organizations had not identified them, let alone mapped the contractor transaction flows that reach them. The guidance covers secure remote access for OT, policy enforcement points in front of legacy assets that cannot be patched, and consequence-driven thinking about physical outcomes. Organizations can apply all three to the containment and architectural measures this note recommends.

CSA’s Zero Trust Guidance for IoT [12] and the IoT Security Controls Framework v3 [13] address the device-level weaknesses seen here. These include default and derivable credentials, internet-reachable management interfaces, firmware update processes, and lifecycle management. Organizations can use the IoT Security Controls Framework to set baseline requirements for refrigeration and other connected building systems, in procurement and in contractor agreements. Its controls on authentication, secure update, and decommissioning apply directly to the end-of-life exposure that CERT-FR highlighted.

On the third-party side, CSA’s Roles and Responsibilities of Third-Party Security Services [14] offers a model for deciding who is accountable for access control, monitoring, and incident response when an outside provider operates part of the control plane. It focuses on cloud security services, but its method of spelling out responsibilities between customer and provider can be applied to contractor-managed OT. Some organizations add AI-driven monitoring or analytics to facility telemetry, such as anomaly detection on temperature and setpoint data across a store estate. For those integrations, the AI Controls Matrix (AICM) v1.1 [15] provides supply chain and threat and vulnerability management controls.

References

[1] Wikipedia contributors. “2026 French supermarket refrigerator hack.” Wikipedia, accessed November 3, 2026.

[2] Khandelwal, Swati. “New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food.” The Hacker News, November 3, 2026.

[3] Toulas, Bill. “Hackers disrupt refrigeration systems at European supermarkets.” BleepingComputer, November 2, 2026.

[4] CNBC / Reuters. “New cyberattack on supermarket fridges sweeps across Europe.” CNBC, November 2, 2026.

[5] Arghire, Ionut. “Refrigeration Controller Hack Spoils Food Across European Supermarkets.” SecurityWeek, October 13, 2026.

[6] CERT-FR / ANSSI. “CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération.” CERT-FR, October 12, 2026 (updated October 16, 2026).

[7] Satter, Raphael, AJ Vicens, and Phil Stewart. “Exclusive: Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say.” Reuters (via WHTC), October 29, 2026.

[8] DiMolfetta, David. “Six military freezers went bad in August. Was it a cyber attack?” Defense One, October 29, 2026.

[9] CISA. “ICS Advisory ICSA-25-140-03: Danfoss AK-SM 8xxA Series (Update A).” Cybersecurity and Infrastructure Security Agency, May 20, 2025 (updated August 26, 2025).

[10] Zaltzman, Amir (Claroty Team82). “Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers.” Claroty, August 9, 2026.

[11] Cloud Security Alliance. “Zero Trust for Critical Infrastructure Security.” CSA Zero Trust Working Group, accessed November 3, 2026.

[12] Cloud Security Alliance. “Zero Trust Guidance for IoT.” CSA, accessed November 3, 2026.

[13] Cloud Security Alliance. “IoT Security Controls Framework v3.” CSA IoT Working Group, accessed November 3, 2026.

[14] Cloud Security Alliance. “Roles and Responsibilities of Third-Party Security Services.” CSA, 2021.

[15] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” CSA, June 2026.