Somebody Turned Off Europe's Freezers. Twice.

OT security third-party risk vulnerability management critical infrastructure

November 2, 2026 · 6 min read

AI Summary

Generating summary…

A store manager on Öland, Sweden, showed up for work Monday morning and walked into a puddle. His freezers were sitting at 55°C.

Not broken. Hacked.

Same night, same trick, across four countries. Roughly 40 Delhaize stores in Belgium. About 15 Carrefours, plus Intermarché, Spar and the Shop & Go sites at Q8 stations. At least 13 SuperValu stores in Ireland. A handful of ICA and Coop locations in Sweden. Somebody flipped the refrigeration into defrost mode overnight and let physics do the rest. The Register has the rundown.

One Belgian manager said the result was catastrophic, and he had to throw out every fresh and frozen product in the building. For a grocer that's not a bad day. That's the store.

And this is the second time in three weeks.

We already ran this drill

In mid-October it was France. Hundreds of supermarkets got hit in one night: around 150 Intermarché stores, about 80 Carrefours, 80 Coopérative U locations, a slice of Monoprix. Temperatures pushed to 50°C. Food spoiled. A few fires. CERT-FR put out an alert on compromised Danfoss AK-SM and AK-SC controllers, then added Copeland and its Dixell brand a day later.

The flaw everybody pointed at is almost insulting. Claroty's Team82 found a hidden login path in the Danfoss AK-SM 800A that accepted a code generated from the device's date. Work out the algorithm once and you've got the admin password for every unpatched box, every day, forever. Kevin Beaumont called it a zero-skill attack. He's right.

None of this was a surprise. CISA had a Danfoss advisory out in May 2025. Researchers published the details months before France burned. The patch existed. And per cyber insurer Coalition, 2,624 refrigeration controllers from the named brands still had a login page facing the internet between September and early October. After the French attacks, after the headlines, after the government alert, 618 Danfoss units were still online.

So Monday's round two shouldn't shock anyone. The door was propped open and labelled.

To be fair, nobody has confirmed the European attacks used the same hole as France. Coopérative U says it isn't even a Danfoss customer. That doesn't help. It means there's more than one way in.

Why is a fridge on the internet?

Two reasons, and both are about money.

First, remote support. A refrigeration contractor can log in from head office and fix a setpoint instead of rolling a truck. Cheaper for them, faster for you. Nobody priced in the risk because nobody thought of a freezer controller as a computer.

Second, compliance. Food safety rules want temperature logs. The easiest way to prove your freezer held -18°C for 72 days is to have it phone home. A former DHS cyber official made exactly this point to The Register about a week before France got hit. The checkbox created the attack surface.

Notice who owns these devices. Not IT. Facilities, or the refrigeration contractor, or a franchisee. ICA said the affected stores were operating outside its central network. That's the whole story in one sentence. The stuff that got hit lives at the edge, in somebody else's contract, and doesn't show up in anybody's asset inventory.

That's not an OT problem. That's a third-party problem wearing an OT costume.

It's only going to get worse

Here's why I don't think this burns out.

Nobody asked for money. No ransom note has been reported in France or in this round. That should bother you more than a demand would. Either someone's doing it for fun, or someone's rehearsing, or someone wanted the world to know it's possible. Every option ends the same way: the playbook is now public and the next crew doesn't need to invent anything.

AI killed obscurity. OT used to be protected by the fact that nobody understood it. Weird protocols, ancient operating systems, vendor docs you couldn't find. That's over. Last week an autonomous AI agent found four serious bugs in EPICS, the control software behind particle accelerators and fusion experiments, in three hours and 49 minutes. Threat researchers are watching attackers use AI to figure out building automation systems running VxWorks and old Unix. You don't need to be an OT expert anymore. You need a subscription.

Ransomware crews already figured out physical leverage pays. Dragos counted 1,020 ransomware incidents against industrial organizations in Q1 2026 and 1,140 in Q2. Armis found 73% of organizations own building automation systems that have been used in ransomware attacks. Locking people out of the building, killing the HVAC, cooking the inventory. Pain gets paid faster than data theft does.

Patching is a fantasy at the edge. Copeland told The Register the vulnerable gear is a discontinued, end-of-life generation. Translation: some of these boxes will never get fixed. They'll sit in the back room of a franchise store until the compressor dies.

The target list writes itself. If a supermarket freezer is worth hitting, so is a pharmacy vaccine fridge, a hospital blood bank, a cold-storage warehouse, a fish plant. Same controllers, same contractors, same "we'll just open a port for remote support." That's my read, not a reported incident. But I've done this for 26 years, and attackers have never once looked at a working technique and decided not to scale it.

The honest caveat: this isn't the collapse of the food supply. Delhaize says its distribution centres were fine and deliveries kept moving. The damage was store-level. Ugly, expensive, recoverable.

Right now. Round three won't be a fridge.

Canada, you're not special

Coalition's count had 50 exposed Danfoss units in the US. I haven't seen anyone publish a Canadian number. That isn't comfort. It means nobody's looking.

And we've already had our warning. In August, a ransomware attack disrupted building systems at a Manitoba hospital: door access, HVAC monitoring, staff access cards. Here in Atlantic Canada, think about who runs cold chain. Independent grocers. Co-ops. Franchisees. Seafood processors with cold storage worth more than the building. Small IT teams, if any, and a refrigeration vendor who set it up years ago and remembers the password.

What to do this week

None of this is hard. It's just unowned.

Ask your refrigeration and HVAC contractors for a list. Every controller, every remote access method, every account. If they can't produce it in a day, that's your answer.

Look at yourself from the outside. Scan your own public IP space for controller login pages before somebody else does.

Get it off the open internet. VPN or a vendor access broker with MFA. A login page on a public IP is not remote access. It's an invitation.

Patch it or replace it. If the vendor says end-of-life, budget the replacement now. It's cheaper than one Monday morning.

Alert on the weird stuff. A defrost command at 2 a.m. Sunday, or a setpoint jumping to 50°C, should page a human who answers the phone.

Put it in the contract. Remote access terms, patch timelines and breach notification belong in your vendor agreements, not in a handshake.

Run the tabletop. "It's 6 a.m. Monday and every freezer in three stores reads 50°C." Who gets the call? Who decides what gets thrown out? Who talks to the public health inspector?

Bottom line

The freezer isn't the story. The story is that anything with a thermostat and an IP address is now a target, and somebody just proved it twice in three weeks, in public, without even asking to get paid.

The researchers warned. The government warned. The patch shipped. And the doors stayed open.