On the night of November 1 to 2, freezers and refrigeration units across at least 11 European countries sent their temperatures soaring — in some cases up to 50 °C. The attack was not isolated: three weeks earlier, roughly 700 French supermarkets had already been hit. This time, the blast radius stretched to Belgium, Sweden, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany, Estonia and even the United Kingdom. In at least one point of the British supply chain, temperatures reached 100 °C. The scale is enormous, but the technique is strikingly simple: web administration interfaces exposed on the internet, factory-default credentials and outdated firmware.
What made the case particularly alarming was not the sophistication of the attack — it can be summarized in one line of technical jargon as "exploitation of default credentials on IoT/OT web management interfaces" — but the massive exposure of equipment that nobody imagines is vulnerable. Internet-connected refrigeration controllers are not just "smart fridges"; they are industrial control devices that, when compromised, have direct physical impact: spoiled food, losses running into tens of millions of euros, and in one instance, alarms triggered at French blood banks.
Two waves, one pattern
The first wave struck in the early hours of October 11–12, hitting approximately 700 supermarkets in France. CERT-FR issued alert CERTFR-2026-ALE-012 on October 12, identifying four product families: Danfoss AK-SM series, Danfoss AK-SC series, Copeland XWEB and Dixell XWEB. Danfoss confirmed that the most affected devices were older AK-SM 800 and AK-SC 355 models — both at end of life, with no firmware support since 2016 and 2021, respectively.
The second wave arrived on November 2 and spread across at least 10 additional countries. This time, in addition to supermarkets, three EFS (Établissement français du sang) facilities had their refrigeration controllers compromised through an equipment vendor. Temperature setpoints in chambers operating at −30 °C were raised to 110 °C. Fortunately, alarm systems responded in time: no blood products or samples were compromised. But the incident illustrated how the same attack vector can scale from grocery stores to plasma banks.
Pre-attack reconnaissance
Calling the attack "simple" would be reductive. The security firm Lupovis observed, through honeypots replicating client systems, a reconnaissance wave between October 20 and 30: more than 276 authentication attempts from 91 distinct threat actors, trying default credentials on Danfoss controllers. Activity peaked on October 26 and then stopped abruptly — a pattern that threat intelligence specialists associate with coordinated operations, possibly involving state actors, that test the attack surface before the main strike.
George Nott, technology editor at The Grocer, told Euronews that many affected systems were accessible with factory credentials like "Username: Supervisor" and "Password: 12345". Kumar Sokka, CEO of Acre Security, added: "The freezer is not special. It is just the most visible example of a much bigger category." The same controller that warms freezers also drives doors, access cameras, alarms, lighting and heating in any establishment.
What is missing
To date, no group has officially claimed responsibility for the attacks. Two pro-Russian hacktivist groups — NoName057(16) and Z-Pentest — claimed authorship in Telegram posts on November 3, but their allegations remain unverified. The CISA issued an alert on November 5, describing the vectors as "authentication bypass, arbitrary code injection and weak configurations". No CVE has been officially tied to the November attacks, despite CVEs already existing for related vulnerabilities: CVE-2025-41450 (authentication bypass on the Danfoss AK-SM 8xxA, fixed in R4.2) and CVE-2025-41451 (post-authentication command injection, fixed in R4.3.1).
The absence of an official CVE for the November attacks is a symptom of a broader problem: many affected controllers are end of life and receive no patches. A factory reset on a device still exposed to the internet does not help — it will remain vulnerable. The recommendation from Belgium's CCB is clear: update firmware, change default credentials, set security level to "Strict" and, on equipment without available patches, isolate the management interface from the network.
What comes next?
The UK's NCSC has warned that the country will suffer an AI-powered cyberattack on critical national infrastructure within two years. But you do not need AI to warm freezers: default credentials, exposed interfaces and outdated firmware do the job. The problem is not a lack of regulation — the EU's NIS2 Directive requires organizations to manage risks to their network and information systems, including security measures and asset management. The problem is that organizations often treat maintenance as maintenance, ignoring that internet-connected refrigeration controllers are, in effect, industrial technology (OT) operational systems accessible remotely.
When the next wave comes — and the CCB recommends keeping active monitoring — it will likely not be against freezers. It will be against any IoT/OT controller that someone, at some point, left exposed to the internet with factory passwords. And the question is whether the European cold chain, already under pressure from food inflation and climate change, has the logistical capacity to sustain a cyber campaign this visible and physically devastating.
Sources: Palo Alto Networks Unit 42, Euronews, BBC News
✓ Independent sources cross-checked and verified before publishing
