Freezers and chillers warmed up overnight from Sunday to Monday at more than 100 stores across Europe, and several retailers are calling it an attack. The affected businesses, from large chains to individual butcher shops, are spread across Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden. Some units were set to 50C.
Three weeks after a similar wave hit French supermarket groups, the same class of equipment is being reached again.
The controllers were never meant to face the internet
The earlier incident centred on refrigeration gear built by the Danish manufacturer Danfoss, including cold-storage units that hold stock before it reaches the shop floor. Researchers at Claroty disclosed authentication flaws in the AK-SM 800A management interface in August 2025, and the vendor shipped firmware fixes.
One of those bugs hid a mechanism that accepted a password derived from the device’s own date, so anyone who recreated the algorithm could log in as an administrator. Danfoss said the shops affected were running outdated firmware.
What store operators can control
Take refrigeration controllers off routable addresses. Where remote monitoring is genuinely needed, terminate access through a broker on a segmented network instead of publishing the management interface. Inventory the firmware version on every controller and treat the manufacturer’s fix as mandatory, not advisory.
Then plan for the food. Backup cooling, manual temperature logging and a documented loss threshold turn a remote tampering incident into a bad day rather than a regional recall of perishable stock.
