{"id":"CMP-202611-nn5phj","kind":"campaign","aliases":[],"related":[],"title":"Internet-exposed Danfoss supermarket refrigeration controllers hijacked to heat fridges and freezers to 50°C overnight; new wave in Sweden, Belgium, Luxembourg and Ireland","description":null,"summary":"Attackers are remotely taking over Danfoss refrigeration management controllers that can be reached from the internet and setting fridge and freezer target temperatures to about 50°C overnight. In mid-October 2026 the first wave hit hundreds of supermarkets, mostly in France (Carrefour, Intermarché, Monoprix, Auchan, E.Leclerc, Cooperative U), plus stores in Belgium, Germany, the Netherlands, Poland, Portugal and Spain. A second wave on the night of 1-2 Nov 2026 hit ICA and Coop in Sweden, Delhaize and Carrefour in Belgium and Luxembourg, and SuperValu in Ireland, and there was a blocked attempt in Estonia. Sweden's national cyber-security centre is handling several incidents. ANSSI reportedly found a vulnerability in Danfoss software. Danfoss says the affected units ran outdated firmware. Kevin Beaumont reports that many Swedish units are connected directly to the internet over 4G modems, are unpatched and expose their management interface. Similar fridge failures hit about a dozen US military commissaries in late August. It is unknown whether the attackers use the AK-SM 800A flaws Claroty disclosed (auth bypass, RCE). Attribution is unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-02T12:21:57+00:00","products":[{"name":"Danfoss AK-SM 800A","fixed":["R4.3.1"],"affected":"< R4.3.1","ecosystem":"firmware"},{"name":"Danfoss refrigeration controllers (legacy, end-of-life)","fixed":[],"affected":"all","ecosystem":"firmware"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Find any Danfoss refrigeration or building-management controller (AK-SM 800/800A system managers and older legacy models) whose web management interface can be reached from the internet, including through 4G/cellular modems installed by refrigeration maintenance contractors. Check the firmware version: on AK-SM 800A, anything older than R4.3.1. Look for setpoint changes made at night or logins from unknown IPs in the controller logs. There are no published IP or file indicators.","fix":"Take Danfoss controller management interfaces off the internet now: unplug or firewall the 4G modems and allow remote access only through a VPN the contractor controls. Change default or weak passwords. Upgrade AK-SM 800A to firmware R4.3.1 or later, and replace legacy models that no longer get updates. Set up out-of-band temperature alarms so a night-time setpoint change is caught within minutes.","status":"open","published_at":null,"first_seen_at":"2026-11-02T12:21:57+00:00","triaged_at":"2026-11-02T12:21:57+00:00","updated_at":"2026-11-02T12:21:57+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-2':118B '-202611':27A '1':117B '2026':81B,120B '4g':187B '50':15A,74B '800a':36A,220B 'affect':168B 'ak':34A,218B 'ak-sm':33A,217B 'anssi':157B 'attack':49B,214B 'attacks':31A 'attempt':143B 'attribut':227B 'auchan':95B 'august':208B 'auth':224B 'beaumont':174B 'belgium':22A,102B,131B 'block':142B 'bypass':225B 'c':16A,75B 'campaign':45B 'carrefour':92B,129B 'centr':152B 'claroti':222B 'cmp':26A 'commissari':205B 'connect':181B 'control':7A,57B 'controllers':39A 'coop':124B 'cooper':97B 'cyber':150B 'cyber-secur':149B 'danfoss':4A,29A,32A,37A,54B,163B,165B 'delhaiz':127B 'direct':182B 'disclos':223B 'dozen':202B 'e.leclerc':96B 'earli':47B 'early-warn':46B 'end':42A 'end-of-life':41A 'estonia':145B 'expos':3A,192B 'failur':198B 'firmwar':172B 'first':83B 'flaw':221B 'found':159B 'franc':91B 'freezer':13A,30A,69B 'fridg':11A,67B,197B 'germani':103B 'handl':154B 'heat':10A 'hijack':8A 'hit':85B,121B,199B 'hundr':86B 'ica':122B 'incid':156B 'interfac':195B 'intermarché':93B 'internet':2A,64B,185B 'internet-expos':1A 'ireland':25A,137B 'kevin':173B 'late':207B 'legacy':40A 'life':44A 'luxembourg':23A,133B 'manag':56B,194B 'mani':177B 'mid':79B 'mid-octob':78B 'militari':204B 'modem':188B 'monoprix':94B 'most':89B 'nation':148B 'netherland':105B 'new':18A 'night':115B 'nn5phj':28A 'nov':119B 'octob':80B 'of':43A 'outdat':171B 'overnight':17A,76B 'plus':99B 'poland':106B 'portug':107B 'ran':170B 'rce':226B 'reach':61B 'refriger':6A,55B 'refrigeration':38A 'remot':51B 'report':158B,175B 'say':166B 'second':111B 'secur':151B 'set':66B 'sever':155B 'similar':196B 'sm':35A,219B 'softwar':164B 'spain':109B 'store':100B 'supermarket':5A,88B 'supervalu':135B 'sweden':21A,126B,146B 'swedish':178B 'take':52B 'target':70B 'temperatur':71B 'u':98B 'unit':169B,179B 'unknown':211B,229B 'unpatch':190B 'us':203B 'use':215B 'vulner':161B 'warn':48B 'wave':19A,84B,112B 'whether':212B","nicknames":["Danfoss freezer attacks"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["aksm800a","danfossaksm800a","danfossfreezerattacks","danfossrefrigerationcontrollerslegacyendoflife","refrigerationcontrollerslegacyendoflife"],"ptokens":["800a","ak","controllers","danfoss","end","legacy","life","of","refrigeration","sm"],"labels":["campaign","earlywarning","high","infrastructure"],"first_public_at":"2026-10-13T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-nn5phj","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-02T12:21:57+00:00","fetched_at":"2026-11-02T12:21:57+00:00","note":null}],"documents":[{"id":51702,"url":"https://cyberplace.social/@GossiTheDog/117546664460119094","title":"Kevin Beaumont: Danfoss are back in the news today over freezers defrosting in Europe again, e.g","kind":"post","source":"mastodon","publisher":null,"text":"Danfoss are back in the news today over freezers defrosting in Europe again, e.g. in Sweden. In Sweden, loads of the devices are directly internet attached using 4G modems. I've confirmed the devices aren't patched and exposing management interface.","published_at":"2026-11-02T11:42:37+00:00","relation":"describes","confidence":null,"note":null},{"id":51778,"url":"https://www.securityweek.com/refrigeration-controller-hack-spoils-food-across-european-supermarkets/","title":"Refrigeration Controller Hack Spoils Food Across European Supermarkets","kind":"blog","source":"analyst","publisher":null,"text":"Hundreds of supermarkets (mostly France: Auchan, Carrefour, E.Leclerc, Intermarche, Monoprix, Cooperative U; also BE, DE, NL, PL, PT, ES) had Danfoss refrigeration controllers remotely set to 50C overnight. Claroty earlier disclosed auth bypass/RCE/config injection in Danfoss AK-SM 800A, thousands exposed online, fixed in firmware R4.3.1. Unclear if those flaws were used.","published_at":"2026-10-13T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":51779,"url":"https://www.dailymail.com/news/article-16258241/Cyber-attackers-defrost-freezers-Swedish-Belgian-supermarkets.html","title":"Cyber hackers defrost supermarket freezers in Ireland, Sweden and Belgium","kind":"other","source":"analyst","publisher":null,"text":"2 Nov 2026: overnight attacks on refrigeration systems at ICA and Coop (Sweden), Delhaize and Carrefour Belgium (15 stores), Luxembourg, SuperValu (Ireland), attempt in Estonia. Swedish NCSC handling several incidents. ANSSI identified vulnerability in Danfoss software in the October French wave; Danfoss says affected units ran outdated firmware. Similar incidents at about a dozen US military commissaries late August.","published_at":"2026-11-02T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":51963,"url":"https://bsky.app/profile/raphae.li/post/3mzde2u3lo22n","title":"@raphae.li: New: European supermarkets hit by ANOTHER fridge cyberattack \n\nwww.reuters.com/b","kind":"post","source":"bluesky","publisher":null,"text":"New: European supermarkets hit by ANOTHER fridge cyberattack \n\nwww.reuters.com/business/ret...\nhttps://www.reuters.com/business/retail-consumer/temperature-soars-swedish-grocery-store-freezers-one-store-blames-hackers-2026-11-02/\n\nlikes 1 reposts 3","published_at":"2026-11-02T12:44:27+00:00","relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}