Freezers in more than 115 supermarkets across six European countries were defrosted overnight by someone who never entered the building.
What happened
Stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia reported that refrigeration and freezer setpoints had been changed remotely. In some cases units were shut down or forced into a defrost cycle, so temperatures climbed for hours before staff arrived in the morning. Chains that confirmed impact include Ahold Delhaize with around 40 sites, Carrefour Belgium with 15, Intermarche Belgium with around 15, SuperValu Ireland with 13, Coop Sweden with 7, Spar Colruyt with 5, ICA Sweden with 4 and Selver in Estonia with 1, plus about 17 Dutch butcher and neighbourhood stores.
The wave follows attacks in France in October that hit more than 300 locations, where reporting described target temperatures being pushed as high as 50C. A director at Sabcobel, a Belgian refrigeration service company, told BleepingComputer the attacker used the same vulnerability in both waves.
Reporting on the French wave identified Danfoss refrigeration controllers as the equipment that was taken over. Claroty's Team82 published research in August 2026 on the Danfoss AK-SM 800A central manager, including a hidden code-of-the-day authentication bypass and an OS command injection tracked as CVE-2025-41451. Danfoss rates that flaw 8.7 under CVSS v4.0 and describes it as needing a valid login first; fixed firmware is 4.3.1. Claroty found thousands of management interfaces reachable from the internet. Neither Danfoss nor the retailers have confirmed the exact path used in this week's wave.
Who is affected
- Supermarkets, cold stores, food distributors, distribution centres and foodservice kitchens running Danfoss AK-SM 800A or AK-SM8xxA managers.
- Any site whose refrigeration manager or controller web interface is reachable from the internet, or sits on a flat shop network shared with POS and guest Wi-Fi.
- Facilities still below firmware 4.3.1, or where a refrigeration contractor holds the remote access and has not confirmed the version.
What to do now
Get every refrigeration manager off the public internet this week and confirm the firmware version in writing. Stock loss is the visible cost; a controller that accepts remote configuration is also a foothold on the shop network.
- Find AK-SM 800A interfaces answering on public IP addresses and close them. Management access belongs behind VPN or on a management VLAN.
- Upgrade to firmware 4.3.1 or later.
- Change controller and integrator credentials, remove shared logins, and check for accounts nobody recognises.
- Route temperature and alarm notifications to someone who reads them, so a setpoint change is noticed in minutes, not at opening time.
- Review logs for setpoint, defrost schedule and configuration changes outside business hours.
What this means for South African businesses
Cold chain here runs on the same class of controller, usually installed by a refrigeration contractor who left the remote access in place so the site could be supported from the road. My judgement is that a South African grocery, butcher or food distributor is more exposed than a European chain, not less: fewer sites are segmented, and almost none log setpoint changes. The loss is not data, it is stock and a cold-chain break you may have to declare.
Source
BleepingComputer reported the wave and named the affected chains: Hackers disrupt refrigeration systems at European supermarkets. The Danfoss advisory record is CVE-2025-41451.