Tech Infrastructure

Tech Infrastructure Alert: One Setpoint, Hundreds of Stores

By Nattapong Sukkasem · Published 2026-11-05 · Updated 2026-11-05.

TL;DR — Overnight into 2 November 2026, a second wave of attacks on internet-facing refrigeration controllers hit supermarkets in at least ten European countries, forcing stores from Belgium to Sweden to Ireland to throw out chilled and frozen stock. Three weeks earlier the same class of device was attacked across hundreds of French stores. No malware and no ransom demand: the attackers changed temperature settings. The part of this tech infrastructure story worth an hour of your week is not the flaw. It is what the exposure scans show operators actually did about it.

There is a kind of tech infrastructure failure that never reaches a security team because nobody on that team knows the asset exists. The refrigeration controller in a supermarket back room is the worked example: bought by a facilities budget, installed by a contractor, often owned by a franchisee rather than the chain above the door, and connected to the internet on purpose, so the contractor can diagnose a failing compressor at three in the morning without driving to the store.

Tech infrastructure at risk: a refrigerated supermarket frozen food display case of the kind controlled by the internet-facing Danfoss and Copeland refrigeration controllers attacked across Europe — A refrigerated retail display. The temperature in a cabinet like this is held by a controller that, in thousands of installations, answers a web request from anywhere on the internet.

What happened on 2 November

The second wave landed overnight into Monday 2 November and was far wider geographically than the first. Several dozen Delhaize stores were affected in Belgium, along with fifteen Carrefour sites and five Spar stores run by independent operators. Musgrave took chilled and frozen products off sale at thirteen SuperValu stores in Ireland, Sweden's ICA reported twenty-three affected stores, and smaller numbers surfaced from Luxembourg to Portugal.

The effects were physical and immediate. An ICA store in Sjöbo found its fridges and freezers set to 50°C. At a butcher in Hove, Belgium, cabinets went to 18°C and the owner estimated €15,000 of meat ruined. Elsewhere in Belgium, contractor Sabcobel says attackers switched cooling units into defrost mode. At Selver in Estonia a freezer was also set to 50°C, but staff corrected it within ten minutes. That is the whole argument in miniature: the compromise is trivially reversible, and the loss is not.

A password you can work out from the calendar

France's national CERT names four product lines in alert CERTFR-2026-ALE-012: Copeland xweb, Dixell xweb, and the Danfoss AK-SC and AK-SM series. Danfoss is the vendor retailers name most often, and the one with published research behind it.

Danfoss said most units affected in the first wave were either older models no longer receiving security updates or newer models running outdated firmware.

In August 2026, Claroty's Team82 published an analysis of the Danfoss AK-SM 800A by researcher Amir Zaltzman. It describes an undocumented authentication path, tracked as CVE-2025-41450 at CVSS 8.2, in which a request carrying a precomputed value reaches a routine the researchers call a code-of-the-day check. That value derives from the device's current date and nothing else, so anyone who reconstructs the derivation can compute a working administrator credential for any day, without knowing the configured password. Team82 reconstructed it and did not publish it.

Administrative access then exposes a second flaw, CVE-2025-41451 at CVSS 7.6, in which the email password on the SMTP settings page is formatted into a shell command unsanitised, giving code execution. Danfoss fixed both in firmware R4.3.1, in July 2025.

Two hedges belong here at full strength. Danfoss has not confirmed the initial access vector for either wave, and says most affected units in France were older AK-SM 800 and AK-SC 355 models it no longer updates, outside the series Claroty examined. Separately, a Danfoss spokesperson told Dutch broadcaster NOS that the affected Netherlands systems were not on a secure network and still used default passwords. A computable credential and an unchanged default end in the same place, and the published evidence does not say which did the work.

When	What happened
Jul 2025	Danfoss ships firmware R4.3.1, fixing both AK-SM 800A flaws
11–12 Oct 2026	First wave hits hundreds of French supermarkets; CERT-FR issues its alert
11–14 Oct 2026	Censys watches French exposure fall from 1,825 controllers to 537
13 Oct 2026	Danfoss tells Dutch customers to disconnect systems from the internet
2 Nov 2026	Second wave across at least ten countries; stores pull chilled and frozen stock

The fleet was withdrawn, not fixed

This is the uncomfortable centre of the tech infrastructure story. Censys tracked exposed Danfoss StoreView panels daily through the first wave, fingerprinting them on the login page title and deriving firmware versions from the HTTP Last-Modified header. In France the count fell from 1,825 on 11 October to 1,781, then 1,104, then 537 on 14 October — about seventy per cent in three days. Outside France it moved from 1,166 to 966.

Now look at which devices left. Hosts below version 4.2, the band where the date-derived credential applies, fell seventy-one per cent. Hosts already on 4.3.1 or later — the patched group, with nothing to fear from either CVE — fell seventy-two per cent. Every band shrank by roughly the same amount, and the patched share of the surviving fleet did not grow at all.

Had operators been patching, that patched band would have swelled as devices moved into it. It did not. They pulled the plug, on vulnerable and already-patched devices alike. Censys put it plainly: operators are not patching their controllers, they are simply taking them off the internet — and called that probably the right choice.

A Danfoss-branded hermetic refrigeration compressor, the server infrastructure end of the cold chain that the attacked controllers switch on and off — A Danfoss hermetic compressor. The controller at issue does not break hardware like this — it simply tells it when to run, and when to stop.

Disconnection is real remediation and it is instant, which patching is not. But it cannot be verified by a scanner, because the evidence of success is an absence. It terminates the monitoring service the device was bought to provide — which is why CERT-FR's first recommendation carries the remarkable caveat that you should check your insurance contract before cutting the contractor's data feed.

Why this is server infrastructure, not an appliance

There is no zero-day vulnerability anywhere in this story, which is what makes the census hard to read. The fix shipped in July 2025; a survey fifteen months later found most of the global fleet still behind it, on builds from 2022 and 2023.

An AK-SM system manager is not a thermostat. It is a Linux host running a web server with CGI endpoints, an nginx configuration and an SMTP client — server infrastructure wearing a refrigeration badge, bought on a facilities line item and patched, if at all, by whoever services the compressors. That mismatch is why the firmware distribution looks the way it does.

It is also why cloud security tooling never saw any of this. That discipline assumes the asset sits in a tenant you can enumerate, with an account behind it and an agent you can install. A controller on a public address in an independently operated store is in no tenant at all — ICA said its affected stores had equipment connected outside its centrally managed network. Nobody was negligent in the usual sense; the devices were outside every inventory that exists.

Note how little this resembles the shape defenders train on. A DDoS attack gives a graph that climbs, peaks and returns to baseline, and when the line comes down the service is whole again. Here the exposure graph also fell seventy per cent, and meant the opposite: not recovery but withdrawal, with the spoiled stock already in the skip. There was no network outage and no ransom note. The controllers stayed online and answered every request correctly.

What to check this week

Find what of yours answers from a public address. CERT-FR's first instruction is to remove internet exposure from every affected unit. Establish what your own public IP address is, then look for your building systems from outside the network rather than inside it.
Ask facilities, not IT, who can reach the plant. Whether a contractor holds a remote path into your stores is an IT security question that facilities can answer and IT was never asked.
Check configuration, not just connectivity. CERT-FR specifically calls out defrost schedules. A device that was reached and altered runs normally afterwards, so the setting is the only artefact.
Treat end-of-life units as already compromised. CERT-FR warns that an internet-exposed device with no security patches is very likely compromised, and that a factory reset restores the vulnerability too.
Mine resolver logs for devices you do not recognise. Building systems phone home to vendor hostnames, so a network diagnostic tool run against those names, plus a pass over what your store networks resolve, is the cheapest inventory of operational technology you will ever assemble.

A network latency comparison across public DNS resolvers, the kind of baseline measurement used to spot unexpected lookups from building systems and operational technology — A **network latency** comparison across resolvers. Knowing which names your estate asks for, and how fast each answer returns, is the start of an OT inventory you did not have to buy.

That last point carries a caveat. As store networks adopt DNS over HTTPS and traffic shifts to public resolvers, the passive inventory those logs hand you for free starts to disappear. An estate depending on it should know it depends on a default, not a control.

A DNS server performance benchmark measuring encrypted resolver response times from the browser, used to baseline which resolver answers for a site network — A **DNS server performance** benchmark against public resolvers. The same run that measures speed also records which resolver answered, the detail that matters on a site network.

What it means

Nobody has claimed these attacks, and Belgium's Centre for Cybersecurity has said it may never be determined who was behind them. Danfoss calls the Dutch incidents the same kind as the French ones, but a shared method does not establish a shared operator. Copeland has confirmed some of its xweb controllers were targeted, and CISA says it is monitoring activity against refrigeration and cold chain systems.

What is not in doubt is the shape, and it is the lasting lesson of this tech infrastructure episode. A population of small Linux servers was placed on the public internet to deliver a service that genuinely has value, left on firmware years behind the fix, and found by somebody who understood that the payload did not have to be code. It only had to be a number. When the alarm sounded the fleet was not repaired, it was withdrawn — a defensible emergency move and a poor steady state. The thing to watch is how many quietly come back.

Sources

Browse every DNS news article by month →

DNS angle

Review resolver logs for the systems discussed above and compare unexpected names with your approved services. A successful lookup does not establish that a destination is safe. Use the DNS lookup tool to inspect current answers, then compare them with your own resolver and incident records.

Source: The Hacker News — New wave of refrigeration cyberattacks hits supermarkets across Europe (2026-11-03).