Epidemic of Hacked Freezers Spreads Across Europe

What it is

A wave of attacks on supermarket refrigeration controllers across Europe, starting in France in October 2026. France's CERT-FR links the compromises to remote control modules made by Danfoss and Copeland. No group has claimed responsibility. The page does not say whether the later wave in nine other countries is linked to the French attack.

How it works

CERT-FR says attackers forced a continuous defrost cycle. That spoiled food and caused fires at some stores. In Belgium, contractor Sabcobel said evaporators had been switched into defrost mode. In Sicily, Radenza Group said the attack began at 4 a.m. local time and targeted the remote-control system for frozen food sections. The page does not say which vulnerability was used.

Preconditions / Affected

• Controllers that are reachable from the public internet. Claroty found 2,765 Danfoss AK-SM 800A controllers exposed online.
• End-of-life devices without security patches. CERT-FR calls an exposed unit of this kind a very high risk of compromise.
• Estonian firm Kitman Coldtech said the affected Estonian units were older Danfoss models similar to those attacked in France.
• Swedish chain Coop said its six affected stores ran on 4G connections, which it called "more exposed." Ica said its affected shops used an external Danfoss control system. Neither has confirmed a cyberattack.

Reported impact: about 700 of France's 10,000 supermarkets, including 300 Groupement Mousquetaires stores and 80 of Cooperative U's 2,000. Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden reported problems, and Estonian units reached 50°C.

What to do

• Take the controllers off the public internet. This is CERT-FR's current advice.
• For AK-SM 800A units, Danfoss fixed the flaws Claroty published in August 2026, including an authentication bypass, in firmware R4.3.1. The page does not confirm that these flaws are the ones being exploited.
• For older units, Sabcobel's CEO says many need physical modifications that require investment. The page says there is no real fix for the oldest units until those arrive.

Caveats

CERT-FR says the campaigns are probably still ongoing. The exploited weakness is unknown. Finland's Kesko says network interference has not been ruled out, which is weaker than a confirmed attack. EU Agriculture Commissioner Christophe Hansen called the incidents a "deliberate attempt" to disrupt the food supply chain. The page gives no indicators of compromise, detection steps or Copeland-specific patch information.