---
id: "CMP-202611-nn5phj"
kind: "campaign"
aliases: []
title: "Internet-exposed Danfoss supermarket refrigeration controllers hijacked to heat fridges and freezers to 50\u00b0C overnight; new wave in Sweden, Belgium, Luxembourg and Ireland"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Danfoss AK-SM 800A", "fixed": ["R4.3.1"], "affected": "< R4.3.1", "ecosystem": "firmware"}, {"name": "Danfoss refrigeration controllers (legacy, end-of-life)", "fixed": [], "affected": "all", "ecosystem": "firmware"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-02T12:21:57+00:00"
updated_at: "2026-11-02T12:21:57+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-02T12:21:57+00:00"}]
---

# Internet-exposed Danfoss supermarket refrigeration controllers hijacked to heat fridges and freezers to 50°C overnight; new wave in Sweden, Belgium, Luxembourg and Ireland

Attackers are remotely taking over Danfoss refrigeration management controllers that can be reached from the internet and setting fridge and freezer target temperatures to about 50°C overnight. In mid-October 2026 the first wave hit hundreds of supermarkets, mostly in France (Carrefour, Intermarché, Monoprix, Auchan, E.Leclerc, Cooperative U), plus stores in Belgium, Germany, the Netherlands, Poland, Portugal and Spain. A second wave on the night of 1-2 Nov 2026 hit ICA and Coop in Sweden, Delhaize and Carrefour in Belgium and Luxembourg, and SuperValu in Ireland, and there was a blocked attempt in Estonia. Sweden's national cyber-security centre is handling several incidents. ANSSI reportedly found a vulnerability in Danfoss software. Danfoss says the affected units ran outdated firmware. Kevin Beaumont reports that many Swedish units are connected directly to the internet over 4G modems, are unpatched and expose their management interface. Similar fridge failures hit about a dozen US military commissaries in late August. It is unknown whether the attackers use the AK-SM 800A flaws Claroty disclosed (auth bypass, RCE). Attribution is unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- firmware:Danfoss AK-SM 800A affected < R4.3.1 fixed R4.3.1
- firmware:Danfoss refrigeration controllers (legacy, end-of-life) affected all fixed ?

## How to check

Find any Danfoss refrigeration or building-management controller (AK-SM 800/800A system managers and older legacy models) whose web management interface can be reached from the internet, including through 4G/cellular modems installed by refrigeration maintenance contractors. Check the firmware version: on AK-SM 800A, anything older than R4.3.1. Look for setpoint changes made at night or logins from unknown IPs in the controller logs. There are no published IP or file indicators.

## Fix

Take Danfoss controller management interfaces off the internet now: unplug or firewall the 4G modems and allow remote access only through a VPN the contractor controls. Change default or weak passwords. Upgrade AK-SM 800A to firmware R4.3.1 or later, and replace legacy models that no longer get updates. Set up out-of-band temperature alarms so a night-time setpoint change is caught within minutes.

## Timeline

- 2026-11-02T12:21:57+00:00 analyst

## Documents

- [describes] Kevin Beaumont: Danfoss are back in the news today over freezers defrosting in Europe again, e.g https://cyberplace.social/@GossiTheDog/117546664460119094
- [describes] Refrigeration Controller Hack Spoils Food Across European Supermarkets https://www.securityweek.com/refrigeration-controller-hack-spoils-food-across-european-supermarkets/
- [describes] Cyber hackers defrost supermarket freezers in Ireland, Sweden and Belgium https://www.dailymail.com/news/article-16258241/Cyber-attackers-defrost-freezers-Swedish-Belgian-supermarkets.html
- [discussion] @raphae.li: New: European supermarkets hit by ANOTHER fridge cyberattack 

www.reuters.com/b https://bsky.app/profile/raphae.li/post/3mzde2u3lo22n

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_