Hackers heated supermarket freezers to 50°C. It has now happ

In brief

Twice in three weeks, attackers have reached into the computers that run supermarket fridges and freezers in Europe and switched them to heat. In October it was around 700 supermarkets in France. On the night of November 1 to 2 it was more than 100 stores across several European countries, with some units set as high as 50°C. Nobody has said who is doing it or how they get in. The fix for store owners is old, boring advice that many hadn't followed: take these controllers off the open internet.

What happened?

Big supermarkets don't have a thermostat on each fridge. A single controller runs all of a store's cooling, and refrigeration contractors log in to it remotely to watch for faults. The attackers took over the controller that runs all of a store's fridges and freezers.

Once in, they used the units' own defrost setting. A contractor in Belgium said the attackers switched cooling units into defrost mode. Defrost is meant to melt ice off the coils for a few minutes. Left on, it made the units heat up instead. Elsewhere the attackers raised the temperature setting outright.

The first wave, October 11 to 12, France. Fridges and freezers at hundreds of French supermarkets warmed overnight. Les Mousquetaires, which owns Intermarché, said its units were put into defrost and heated to as much as 50°C. SecurityWeek counts around 700 supermarkets, including Intermarché, Carrefour, Coopérative U and Monoprix stores. The head of Les Mousquetaires expects losses of tens of millions of euros across France, and the damage stores reported includes equipment that began to catch fire.

The second wave, November 1 to 2, across Europe. This time the stores were in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden, with problems also reported in Finland, Italy and Portugal. Belgium appears to have taken the biggest hit, with dozens of Delhaize stores, 15 Carrefour stores and five Spar shops affected. In Ireland, SuperValu's owner Musgrave had 13 of 223 stores hit. At least 17 businesses, including butchers and small local shops were hit in the Netherlands. An ICA store in Sweden and a Selver supermarket in Estonia both found units set to 50°C. One Belgian butcher estimated about €15,000 worth of meat was ruined.

Which equipment?

France's national cyber emergency team, CERT-FR, says it knows of numerous compromises of Danfoss AK-SM and AK-SC controllers, and of Copeland xweb and Dixell xweb. Danfoss said its products were involved in the November wave too, though Danfoss is not named in every case. A Belgian butcher said Copeland equipment was also attacked.

In France, Danfoss said most of the units hit were older products that no longer get software or security updates: the AK-SM 800, end-of-life since May 2021, and the AK-SC 355, phased out in 2016. Some units of the current model, the AK-SM 800A, were also hit, and those were running outdated firmware.

What is confirmed?

Two waves, October 11 to 12 in France and overnight into November 2 across Europe.
Units were forced into defrost mode or had their temperature raised, some to 50°C.
CERT-FR knows of numerous compromises of Danfoss, Copeland and Dixell controllers, and says attack campaigns are probably still under way.
The Dutch systems hit were not on a secure network and still used default passwords, according to Danfoss.
Prosecutors in Paris and Belgium have opened investigations.

What remains unknown?

Who is behind it. Nobody has taken responsibility.
How they got in. Officials have not publicly explained how the attackers got in. Claroty found thousands of AK-SM 800A management interfaces reachable from the internet and described three flaws in that model in August, but neither French authorities nor Danfoss has linked them to this attack.
Whether the two waves are one campaign. The method matches, but a shared method does not show that the same people carried out both attacks.
The full toll. Store counts come from retailers' own statements, and they don't all count the same way.

Why it matters

This isn't a data breach. Nobody's password or card was taken. It is an attack on physical equipment that keeps food safe, done remotely and at scale, overnight when no one is in the store to notice. Our reading: the targets were chosen because they were easy. CERT-FR already warns that leaving an unpatched device on the internet means a very high likelihood of compromise. Thousands of shops left a control panel open on the internet so contractors could reach it, many still with default passwords. Any building system run that way, from heating and ventilation to cold storage, has the same weakness.

What readers should do

If you run a store, or a refrigeration contractor's network:

Take the controllers off the public internet today. This is CERT-FR's first instruction: remove internet exposure for every unit on a public IP address. Danfoss gave customers the same advice on October 13. Check your insurance contract before you cut your contractor's data feed, as CERT-FR advises.
Let contractors back in only through a VPN or protected network. Filtering by your contractor's IP addresses at a firewall is an emergency stopgap, not a lasting fix.
Check the whole configuration, especially the defrost schedules. That is where the attackers worked.
Change default passwords, update firmware, and set Danfoss units to Strict security mode. CERT-FR names all three.
Replace end-of-life units. A factory reset on an AK-SM 800 or AK-SC 355 clears the intruder but leaves the device just as vulnerable, and it will likely be hit again.
Alarm on temperature, not just faults. Both waves ran overnight. An alert that reaches a person's phone at 3 a.m. is what limits the damage.

If you're a shopper: stores that were hit have generally pulled affected chilled and frozen food. If chilled food from a store that was hit is warm to the touch, or its packaging looks swollen, don't buy it, and tell the staff.

Hackers heated supermarket freezers to 50°C. It has now happened twice