Internet-exposed Danfoss supermarket refrigeration controllers hijacked to heat fridges and freezers to 50°C overnight; new wave in Sweden, Belgium, Luxembourg and Ireland

Attackers are remotely taking over Danfoss refrigeration management controllers that can be reached from the internet and setting fridge and freezer target temperatures to about 50°C overnight. In mid-October 2026 the first wave hit hundreds of supermarkets, mostly in France (Carrefour, Intermarché, Monoprix, Auchan, E.Leclerc, Cooperative U), plus stores in Belgium, Germany, the Netherlands, Poland, Portugal and Spain. A second wave on the night of 1-2 Nov 2026 hit ICA and Coop in Sweden, Delhaize and Carrefour in Belgium and Luxembourg, and SuperValu in Ireland, and there was a blocked attempt in Estonia. Sweden's national cyber-security centre is handling several incidents. ANSSI reportedly found a vulnerability in Danfoss software. Danfoss says the affected units ran outdated firmware. Kevin Beaumont reports that many Swedish units are connected directly to the internet over 4G modems, are unpatched and expose their management interface. Similar fridge failures hit about a dozen US military commissaries in late August. It is unknown whether the attackers use the AK-SM 800A flaws Claroty disclosed (auth bypass, RCE). Attribution is unknown.

Summary written from the sources below. Check the originals before acting.