Supermarket Freezers Set to 50°C: What Europe's Refrigeration Attacks Teach Retail About OT Risk

Twice in three weeks, attackers reached into supermarket refrigeration controllers over the internet and told the freezers to heat up. The first wave hit hundreds of stores in France overnight on 11 to 12 October 2026. The second came overnight into Monday 2 November and touched stores in Belgium, Luxembourg, the Netherlands, Sweden, Ireland, Estonia, Finland and beyond. Ahold Delhaize reported an IT incident affecting refrigeration in several dozen stores in Belgium and Luxembourg, about 40 by BleepingComputer's count. Colruyt Group said about five Spar stores were hit, and an Estonian Selver store had a freezer set to 50°C. Reporting describes sabotage rather than ransomware. The attackers mainly used the controllers' own functions, chiefly forced defrost, to warm the cases until stock had to be thrown away.

The controllers named in the advisories are Danfoss AK-SM and AK-SC supervisory systems and Copeland and Dixell XWEB units. Many of the devices involved were end of life or running old firmware, and many were reachable straight from the internet. If you run refrigeration in retail, food service, cold storage or anything else with a supervisory controller, do three things today. Take every refrigeration management interface off the public internet. Replace shared contractor logins with named accounts that use multifactor authentication. And check every controller's firmware and support status against the vendor's advisories. The rest of this post explains how the attacks worked, what is and is not confirmed, why so many controllers are online, why vendor-managed devices belong in your third-party risk programme, and how to build the safety limits that stop a freezer from ever accepting 50°C.

This reflects public reporting up to 14 November 2026. Investigations are still open, and anything from a single secondary source is marked as reported.

The short version

Timeline: two waves in three weeks

11 to 12 October: France

The first wave landed on the night of Sunday 11 October into Monday 12 October. BFMTV reported that attackers appear to have triggered the forced defrost function in continuous mode with a 50°C setpoint, so cases heated for hours. A sector source told the broadcaster that staff felt "a wave of heat" when they opened units in the morning. According to the same reporting, summarised by Security Affairs, about 300 Intermarché and Netto stores of the Mousquetaires group were affected, fewer than 100 Coopérative U outlets were affected, and several E.Leclerc stores were hit. Coopérative U's chief executive, Dominique Schelcher, confirmed on X that a cyberattack had affected cooling installations at several stores in the network.

The losses were concrete. One Intermarché in Haguenau reportedly lost its whole frozen stock, estimated at €50,000, and a Leclerc in Wasselonne reportedly discarded about €220,000 of fresh and frozen goods. A sector source told BFM that national losses could reach several million euros. The Paris prosecutor said the attack also caused fires, according to Security Affairs. Forescout later put the total above 700 supermarkets.

CERT-FR, France's national computer emergency response team, published alert CERTFR-2026-ALE-012 on 12 October. It covered the Danfoss AK-SC and AK-SM series, added Copeland xweb and Dixell xweb on 13 October, and updated its recommendations on 16 October. The alert said it was aware of numerous compromises, that campaigns were probably still under way, and that a factory reset clears a compromised device's persistence but leaves the vulnerability in place.

Danfoss said most affected units were end-of-life AK-SM 800 and AK-SC 355 models that no longer receive updates, and that the AK-SM 800A units involved were running outdated firmware, as Security Affairs reported. Copeland, asked about its equipment, told The Register it acknowledged a vulnerability "identified in a discontinued, end-of-life generation of controllers" and was working with affected customers.

2 November: Belgium, Luxembourg and beyond

Three weeks later it happened again, across more countries at once. CNBC reported the attack started around 2 a.m. and, in one Stockholm store, was only noticed hours later. In Belgium, refrigeration contractor Sabcobel said its technicians began disconnecting affected installations from about 1 a.m., and Ahold Delhaize warned store managers by text message around 4 a.m., according to RTL as cited by BleepingComputer.

BleepingComputer put the total at more than 115 stores across six countries on the first day. Euronews later counted at least 11 European countries with fridge incidents, including about 20 stores in Italy, four in Germany and six in Romania. The companies' own statements, as reported:

Sources: BleepingComputer, Cybersecurity Dive, The Hacker News, Paperjam, The Irish Times, ERR News and NOS; counts show the latest figure each gave.

Sabcobel, a Belgian refrigeration contractor that RTL identified as the supplier for several affected stores, gave the most specific account of the mechanism. Its chief executive, Stephan Moelans, attributed the disruption to remotely activated defrost functions and told RTL that the attacker used the same vulnerability as in the French attacks the month before, according to BleepingComputer. The Hacker News reported that Sabcobel knew of about 20 affected units among the hundreds it manages in Belgium, that the attackers entered individual supermarkets' systems rather than the contractor's own, and that Moelans said a software update alone is not enough because installations also need physical changes that cost money. "The simplest solution is to manage the refrigerators via a secure internet connection," he said, adding that most clients had moved to that setup since France. Belgian daily DH reported, citing AFP, that about 10% of Sabcobel's installations had still not been reviewed, some of them in stores hit on Monday.

Delhaize said its distribution centres were operating normally and deliveries were not disrupted, according to Paperjam, and Cybersecurity Dive reported the next day that operations had returned to normal. Delhaize is still investigating any link to the separate Ahold Delhaize US cybersecurity incident (NOS).

Estonia gave the best-handled example of the week. ERR reported that attackers reached the control computer of an older Danfoss system at one Selver store and set a freezer to 50°C. Kitman Coldtech, the refrigeration company involved, said the attack was detected and answered within about ten minutes, the freezer warmed by only two to three degrees, and normal temperature returned within 10 to 15 minutes. Selver said no products were damaged. Kitman's head, Jann Mutso, said of the earlier attacks: "The signature is the same, but I can't comment further yet."

No group has claimed either wave. Belgium's Centre for Cybersecurity said: "It is not known who is behind this attack, and it may never be determined." Several responders, including Danfoss, Sabcobel and Kitman, said the methods resembled each other, but a shared method does not by itself show that the same people were responsible.

How a freezer ends up at 50°C

A large store does not run each display case on its own thermostat. Cases, cold rooms, compressor racks and condensers report to a supervisory controller, sometimes called a system manager or front end. That box holds the setpoints for each circuit, the defrost schedules, the alarm thresholds and the user accounts. It also keeps the temperature log that food safety rules ask stores to maintain. Danfoss's AK-SM family, Copeland's E2, E3 and Site Supervisor, the XWEB line sold under the Copeland and Dixell names, and Carel's pCOWeb all sit in this layer.

Evaporator coils collect frost as they run, and frost blocks airflow. So every case defrosts on a schedule, usually by switching on electric heaters or sending hot refrigerant gas through the coil, then switching back once a time limit or a coil temperature is reached. Defrost is a normal, legitimate command, which is exactly what made it useful to an attacker. Forcing defrost to run continuously, or with a termination point set far above normal, turns the case into a slow oven. French reporting described a 50°C setpoint. Facebook posts from ICA stores in Sweden said their freezers and fridges had been set to 50 degrees, NOS reported, and Euronews cited reports of fridge temperatures reaching 70°C.

The Euronews explainer sets out why the supervisory layer is online at all. Contractors diagnose faults and change settings remotely instead of sending an engineer to every store, and Danfoss says remote connection typically cuts unnecessary call-outs by 15 to 30%. Remote monitoring also keeps the temperature records that food safety rules require. Manufacturer installation guides describe "setting up the store's router to forward internet traffic to the refrigeration controller." Forescout notes that Danfoss AK-SM 800 documentation describes HTTP on port 80 as the default for WAN access, and that Copeland XWEB Pro documentation lists HTTPS on 443 and SSH on 22.

So the attack path in many stores was short. A public IP, a port forward, a web login page, and behind it a controller that would accept a defrost command from anyone who got past the login. The Euronews piece makes the key point plainly: attackers do not need sophisticated malware when they can use normal system functions to change temperatures, trigger defrosts or disable alarms, and those changes can look like routine activity.

The vulnerabilities on the record

Authorities have not said which vulnerability, if any, was used in each store. Danfoss has pointed to outdated firmware, default passwords and controllers exposed without a secure network, which would be enough on their own. Still, the published research shows how little protection some of these devices offered even with a password set.

Danfoss AK-SM 800A

On 9 August 2026, Claroty Team82 published research titled "Freeze the Controller, Defrost the Food" on the Danfoss AK-SM 800A. Researchers had notified Danfoss in 2025 and held publication under a coordinated disclosure agreement, according to Cybersecurity Dive.

Danfoss's own advisory scores the second and third flaws at 8.7 and 6.8, and describes CVE-2025-41450 more narrowly, as a bypass that lets an attacker generate a web report disclosing internal IP addresses, usernames and store names. Claroty credits the same flaw with the full admin session.

Chained, the first two give an unauthenticated attacker an admin session and then code execution on the controller, in Claroty's account. An administrator on these systems can configure temperature thresholds, review alarms, adjust operating schedules, configure notifications and manage users. Claroty found 2,765 AK-SM 800A devices publicly reachable through Censys. Its advice is to upgrade to R4.3.1 or later, keep management interfaces off the internet, and limit administrative access to trusted management networks, VPNs and segmented networks. Authorities have not confirmed that these flaws were used in the French attacks.

The older AK-SM 800 has been end of life since May 2021, per Forescout, and Danfoss described the AK-SC 355 as end of life too. For those units no firmware is coming, so the only controls left are the network around them and the physical safeguards inside the case.

Copeland E2, E3 and XWEB

In September 2025, The Register reported on Armis research it called Frostbyte10: ten vulnerabilities in Copeland E2 and E3 controllers, which run compressor groups, condensers, walk-in units, HVAC and lighting. Copeland's vice president of software, Josh Weaver, told the publication that about two-thirds of North American grocery stores use its products. Three of the ten were rated critical. Highlights:

E3 firmware 2.31F01 fixed the issues, and the E2 reached end of life in October 2025. The Register reported no sign that the flaws were exploited before fixes shipped. A predictable daily password is a convenience for service technicians, and Copeland said customers had asked for repeatable passwords to simplify remote access for refrigeration contractors. Danfoss's "code of the day" is the same idea: a field-service shortcut that becomes a remote access path once the device is online.

For the XWEB line, Forescout lists 23 known vulnerabilities affecting XWEB Pro firmware below 1.13. In the November wave, Copeland confirmed that some of its xweb controllers were targeted, and Cybersecurity Dive reported this was in relation to the previously disclosed vulnerabilities. CERT-FR's alert links to a Dixell guide, "Recommandations pour une utilisation sécurisée des superviseurs XWEB," for hardening these units.

13,000 controllers on the open internet

On 22 October 2026, between the two waves, Forescout's Vedere Labs published an exposure count across ten refrigeration product families using Shodan. They counted service observations separately from IP addresses, because one address can expose the same interface on several ports and one interface can front many downstream systems.

Two more details from the same research matter for prioritising. Of the Danfoss StoreView observations, 3,762, or 80%, ran AK-SM 800A firmware older than 4.3.1, the version that fixes CVE-2025-41451 and CVE-2025-41452. And only 287 of the 513 exposed pCOWeb services returned an HTTP 401 response, which suggests the rest answered without asking for credentials at all. Forescout is careful to say that exposure is not compromise, and that firmware versions are not always visible from outside.

Forescout has also tracked more than 20 claimed hacktivist attacks on refrigeration systems since January 2026. The paths it describes are plain: missing or weak authentication, known vulnerabilities, and stolen or shared maintainer credentials. None of them is exotic, and all of them are cheap to automate across thousands of addresses.

These systems are not only in supermarkets. Euronews, which reported Forescout's count of about 13,000, notes that "the same systems are used in food processing, wineries, fruit stores, farms and hospital cooling equipment." Anyone with a cold room should read this as their incident too.

Vendor-managed devices are third-party risk

Look at who said what during the second wave. Colruyt said its affected Spar stores belong to independent operators with their own refrigeration systems. ICA said the affected stores operated outside its central network. Kesko's store equipment sits outside its central protections, The Hacker News reported. Sabcobel said attackers went into individual store systems, not the contractor's. Musgrave did not name the maker. Danfoss said affected Dutch systems were not on a secure network and still had default passwords.

Each statement is reasonable on its own. Together they describe a gap. The refrigeration controller is installed by one firm, maintained by another, connected to the internet through a router the store or franchisee owns, and sits outside the network that the retailer's security team watches. Forescout puts it directly: when a contractor, a facilities team and an IT team each own a piece, "no single party may have complete visibility into the exposed service," including the network path, the contractor identities and the controller's lifecycle.

That is a third-party risk problem, and it should be handled like one.

Treat the refrigeration contractor as a supplier with privileged remote access. In most retail estates the contractor has more standing access to store infrastructure than any software vendor. Their onboarding should ask the same questions you would ask a managed service provider: how they authenticate (named accounts or a shared login), whether MFA is enforced, which remote access tools they use, how they log sessions, how quickly they apply firmware updates, and what they do when a controller reaches end of life.

Make lifecycle part of the contract. Sabcobel said fixing some installations needs physical changes that cost money. That cost will land somewhere. Contracts should say who pays to replace end-of-life controllers, by when, and what interim controls apply until then. A controller out of support since 2021 should not still be on a public IP in 2026 because nobody owned the replacement budget.

Ask for a software bill of materials. These controllers are small Linux computers running web servers, mail clients and firmware updaters. CVE-2025-41452 is an Nginx configuration injection. CVE-2025-52550 is unsigned firmware. A component list for each firmware version lets you tell, the day a new CVE is published, whether your installed base is affected.

Map the regulations you already answer to. In the EU, the NIS2 Directive's Article 21(2)(d) requires covered entities to address "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers." Article 21(3) asks them to take into account the vulnerabilities specific to each direct supplier and service provider. Annex II lists food businesses engaged in wholesale distribution and industrial production and processing, which takes in the distribution arms of many large grocers. On the manufacturer side, the EU Cyber Resilience Act has required manufacturers of products with digital elements, since 11 September 2026, to report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform, with an early warning within 24 hours of becoming aware, according to the European Commission. Retailers can ask their controller vendors how they meet that duty and how they will tell customers.

Do not stop at the franchise line. Franchisees often own their equipment, but the brand carries the cost when food leaves the shelves. Put a minimum standard for connected equipment in the franchise agreement and offer a managed secure remote access option.

Safety interlocks: a freezer should never accept 50°C

Patrick Lamplmair, chief technology officer at Tributech, put the engineering lesson in one line to Supermarket News: "A freezer should never accept an instruction to heat to 50°C, no matter who sends it." He advised operators to ask suppliers how commands are verified, and said each setpoint should be checked against physical limits before it runs.

That sentence describes a property the device should have whoever is logged in. Network controls reduce the chance an attacker reaches the controller. Interlocks limit what happens if one does, or if a legitimate engineer makes a mistake. Here is what to ask installers and vendors for, ordered roughly from cheapest to hardest.

1. Setpoint bounds per circuit. A low-temperature case has a sensible range for its setpoint. Configure upper and lower limits where the controller supports them, and treat any setpoint outside the range as an alarm, not a setting.
2. Defrost termination that cannot be removed remotely. A defrost cycle should end on a maximum time and on a coil temperature, and those limits should be fixed on the case controller or in a hardware thermostat, not only in a value the supervisory system can overwrite.
3. An independent high-temperature cutout. A thermostat or limit switch wired to cut defrost heaters above a safe temperature, separate from the controller's software, stops a "continuous defrost" command from becoming a fire risk. The Paris prosecutor said the French attack caused fires, which makes this a life-safety item as well as a stock item.
4. Independent temperature monitoring. A second sensor network, reporting to a different system, sees what the controller is actually doing to the food. Musgrave's statement that its monitoring systems alerted it shows the value. If the only temperature record lives on the controller the attacker controls, you cannot trust it.
5. Alarm settings that cannot be silenced from the same login. Changes to alarm thresholds or notification targets should need a second approval or a local action in the store.
6. Rate limits and change windows. A real engineer does not change defrost settings on 40 stores between 1 and 2 a.m. Controllers or the remote access layer in front of them can refuse bulk changes outside an agreed window, or hold them for confirmation.
7. Signed firmware and configuration. Frostbyte10 included unsigned firmware packages. Ask whether firmware is signed and whether configuration changes are logged with the user who made them.

None of this replaces patching. It changes the worst case from lost stock and a fire risk to an alarm and a reverted setting, which is roughly what happened at Selver.

What it cost

The direct costs are the stock itself, and the numbers add up fast. Two French stores reportedly lost €50,000 and about €220,000. In Belgium, Euronews reported stores discarding about €100,000 of food. Some Delhaize stores used refrigerated trucks to save stock, RTL reported.

The indirect costs are harder to see: empty shelves, staff moving product overnight, and food safety teams deciding what was still safe from temperature logs the same attacker may have touched. Musgrave took the cautious route and removed chilled and frozen products from the 13 affected stores as a precaution, telling customers that "products on sale in our stores have been stored at safe temperatures." EU rules for quick-frozen food set a product temperature of minus 18°C with only small, brief tolerances in retail display cabinets, under Council Directive 89/108/EEC, so a case that spent hours in defrost mode leaves little room for judgement.

There is also an insurance angle. CERT-FR's first recommendation tells operators to check their insurance terms before cutting the data link to the refrigeration contractor, because some policies depend on remote monitoring. Talk to your broker before an incident, not during one.

What retailers and facilities teams should do

The steps below follow CERT-FR's alert and Forescout's recommendations, adjusted for teams that run many sites.

This week

1. Find every controller. List each supervisory controller by site, maker, model, firmware and support status. Include franchise stores, distribution centres, cold rooms, kitchens and pharmacies. Ask your contractors for their list too, and reconcile the two. The gaps are the risk.
2. Check what the internet can see. For every store's public IP, review port-forwarding and NAT rules and look for HTTP, HTTPS, SSH or Modbus exposed to a controller. Search your own address ranges on public scanners. CERT-FR says to remove internet exposure from affected units and any unit on a public IP address. Contractors often set up stores the same way, so one exposed store means checking every store that contractor installed.
3. Cut direct exposure. Restore contractor access only through a secure VPN or a protected network. CERT-FR calls firewall filtering by contractor source IP an emergency measure, not a permanent fix.
4. Review configuration, especially defrost. Compare defrost schedules, termination settings, setpoints and alarm thresholds against the commissioning baseline. CERT-FR singles out defrost schedules.
5. Change every password and kill shared accounts. Default passwords were present in the Dutch cases, according to Danfoss. Set the Danfoss security level to Strict, as CERT-FR recommends.

This month

6. Patch what can be patched. Danfoss AK-SM 800A to R4.3.1 or later. Copeland E3 to 2.31F01 or later. XWEB Pro to 1.13 or later. Follow each vendor's current advisory for exact versions.
7. Plan to replace what cannot. AK-SM 800, AK-SC 355 and Copeland E2 are end of life. Until they are replaced, keep them on an isolated network with no internet path and add independent temperature monitoring.
8. If a device was compromised, rebuild it. CERT-FR's sequence is to isolate, restart or factory reset, reconfigure, and only then reconnect through a protected path. A reset alone leaves the device open to the same attack.
9. Put named identities and MFA on remote access. Forescout recommends replacing shared contractor passwords with individual logins and multifactor authentication, and documenting which roles can change setpoints, start defrost, suppress alarms or modify users.

This quarter

10. Correlate remote sessions with changes. Forescout's seventh recommendation is to match remote access sessions with changes to defrost schedules, alarms and setpoints. A change with no session behind it, or a session at 2 a.m. with no work order, is your alert.
11. Add the interlocks above. Start with setpoint bounds, defrost termination limits and independent monitoring on low-temperature circuits.
12. Write the incident runbook. Who disconnects what, who calls the contractor, who decides on stock, who tells customers, who preserves logs for the investigation. Practise it on one store.

Detection that works in a store

You do not need a full OT security stack in every store for this threat. Send the store router's flow logs and the controllers' login and parameter-change logs to central logging, so a connection from an unknown address or a change with no work order behind it can be found. Page someone when a low-temperature case rises several degrees outside a defrost window, using the independent monitoring system. And correlate across sites: one warm case is a fault, ten stores warming in the same hour is an attack.

Where Safeguard fits

The controller flaws came from independent research teams, the fixes come from Danfoss and Copeland, and containment happens in store networks and with refrigeration contractors. Safeguard helps the security, procurement and compliance teams around that work keep track of suppliers, software and evidence.

Third-party risk for refrigeration contractors and controller vendors. Safeguard TPRM lets you onboard suppliers such as a refrigeration contractor or a controller maker, request SBOMs, projects or products from them, score and continuously monitor their risk, and see mitigations others have applied. The questions in the third-party section above (named accounts, MFA, session logging, firmware cadence, end-of-life plans) become a tracked assessment with an owner and a date, not an email thread.

SBOM analysis for the firmware you depend on. When a vendor provides an SBOM in SPDX or CycloneDX, Safeguard analyses it and matches components against vulnerability data enriched with EPSS and KEV status. When a new CVE lands in a web server, mail library or other component that ships inside controller firmware, you can see which supplier products carry it.

Asset discovery for the software side of the store. Store monitoring dashboards, temperature logging services and integration code that reads from supervisory systems are software too. Safeguard discovers repositories, images, packages, SBOMs, vendors and workloads and applies guardrails and enforcement to what it finds, so the software that talks to your cold chain is inventoried along with everything else.

SCA, policies and gates for code your team builds. If your engineers write services that read from or write to refrigeration systems, Safeguard SCA builds a full transitive inventory of their dependencies and generates SBOMs. Policies and gates apply at build, CI and release, so a rule such as "no release ships with a component on the KEV list" is enforced rather than hoped for. Safeguard Package Firewall sits at install time for npm and pip and can block malicious, typosquat and dependency-confusion packages before they reach those build pipelines.

Compliance evidence in one place. Supplier oversight is a control in most frameworks. ISO/IEC 27001:2022 Annex A covers supplier relationships in controls 5.19 to 5.22 and technical vulnerability management in 8.8. SOC 2 CC9.2 covers vendor and business partner risk. NIS2 Article 21 covers supply chain security. Safeguard's compliance automation maps controls, evidence, tests and vendors across frameworks including SOC 2, ISO 27001 and GDPR, so the contractor assessment, the firmware review and the remediation record land as evidence against the controls they satisfy. Safeguard itself is SOC 2 Type I and Type II audited.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Griffin, Safeguard's security model, opens a policy gated pull request that moves the affected dependency to the safe version, and your own CI runs your tests on it before anyone merges. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation categories include dependencies, licenses, security posture and findings, and each one is set separately. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Auto-merge is a separate switch and stays off by default, so your team decides what merges on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds.

3. Gold Registry: start from components that are already fixed

Safeguard Gold rebuilds patched versions of open-source packages and images from source, signs each build, attaches an SBOM, SLSA provenance and VEX, and serves them from registry.safeguard.sh to your organization. Every Gold artifact is held continuously to zero exploitable critical or high CVEs and a completed license check, with signed build provenance (signed with Safeguard's key and verifiable with cosign, SLSA Build Level 3 as the design target) and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened build of a specific package your teams depend on.

The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure. For vendor appliances such as refrigeration controllers, pair them with the vendor's own firmware fixes and the network steps below.

For refrigeration controllers, today

The block above covers the software you build. For the controllers, none of these steps waits on a vendor release.

1. Inventory every controller by site, model, firmware and support status, reconciled with each contractor's list.
2. Remove public exposure and reconnect contractors only through a VPN or protected network, with named accounts and MFA.
3. Reset credentials and check settings: default and shared passwords, Danfoss security level Strict, defrost, setpoints and alarms against the baseline.
4. Patch the supported (AK-SM 800A R4.3.1, Copeland E3 2.31F01, XWEB Pro 1.13 or later) and isolate the end-of-life AK-SM 800, AK-SC 355 and E2 with a funded replacement date.
5. Add independent monitoring and interlocks, then rehearse the runbook on one store.

See Safeguard in action

The first demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude may use. A security or procurement lead can then ask which suppliers have open assessments, or which of your services carry a KEV-listed dependency this week, from the chat they already use.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard local runner, approves it with a device code, and scans from the terminal. It suits internal tools close to store equipment, such as a temperature logging service, when you want to scan a repository on a machine you trust.

Click through it at your own pace, or open it full screen.

FAQ

What happened to the supermarket freezers in Europe?

Attackers reached internet-connected refrigeration controllers and changed their settings, mostly by forcing or extending defrost cycles, so cases heated up and food was lost. It happened in hundreds of French stores overnight on 11 to 12 October 2026 and in stores across Belgium, Luxembourg, the Netherlands, Sweden, Ireland, Estonia, Finland and other countries overnight into 2 November 2026.

How many Ahold Delhaize stores were affected?

About 40 stores in Belgium and Luxembourg, according to BleepingComputer, including four in Luxembourg according to Paperjam. Delhaize described it as an IT incident affecting refrigeration systems in several dozen stores, and operations had returned to normal by the next day, Cybersecurity Dive reported.

Is the refrigeration incident linked to the Ahold Delhaize cybersecurity incident from October?

Delhaize is still investigating any link to the separate Ahold Delhaize cybersecurity incident.

Which refrigeration controllers were involved?

CERT-FR's alert names the Danfoss AK-SM and AK-SC series and Copeland and Dixell XWEB controllers. Danfoss said most affected French units were end-of-life AK-SM 800 and AK-SC 355 models, with some AK-SM 800A units on outdated firmware. Copeland confirmed some of its xweb controllers were targeted in November.

Which vulnerabilities were exploited?

That has not been confirmed. Published flaws include CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452 in the Danfoss AK-SM 800A, fixed in R4.3.1, and the Frostbyte10 flaws in Copeland E2 and E3, fixed in E3 firmware 2.31F01. Danfoss and Sabcobel also pointed to outdated firmware, default passwords and controllers exposed without a secure network.

What should a retailer do first?

Take refrigeration management interfaces off the public internet, give contractors access only through a VPN or protected network with named accounts and MFA, change default and shared passwords, check defrost and alarm settings, patch supported controllers and isolate end-of-life ones until they are replaced.

Can a freezer be designed so that it never heats to 50°C?

Yes, to a large extent. Setpoint bounds, defrost termination on time and coil temperature, a hardware high-temperature cutout on defrost heaters, independent temperature monitoring and approval for alarm changes all limit what a remote command can do, whoever sends it.

Sources

• CERT-FR alert CERTFR-2026-ALE-012
• Claroty Team82 on Danfoss AK-SM 800A
• Danfoss DSA-2025-03-01 and DSA-2025-08-01
• Forescout Vedere Labs exposure research
• The Register on Frostbyte10
• The Register on the French attacks
• BFMTV
• Security Affairs on France
• Security Affairs on the second wave
• BleepingComputer
• CNBC
• The Hacker News
• Cybersecurity Dive
• Supermarket News
• Euronews explainer
• ERR News on Selver
• NOS on Belgium, Luxembourg and Sweden
• NOS on the Netherlands
• Paperjam on Luxembourg
• DH
• The Irish Times on SuperValu
• NIS2 Directive (EU) 2022/2555, Article 21 and Annex II
• European Commission on CRA reporting
• Council Directive 89/108/EEC