Table of Contents
Between mid-October and early November 2026, a two-wave campaign of cyber-physical sabotage swept across at least 11 European countries, targeting commercial and medical refrigeration systems.
Against a backdrop of heightened geopolitical tensions across Europe, these incidents served as a stark reminder that cyberattacks no longer require a financial motive or a ransom demand to inflict damage. When threat actors seek to disrupt essential services rather than extort cash, traditional threat models break down. If your organization operates in a critical sector (such as food supply chains, cold storage, retail distribution, or healthcare) you are a potential target for politically or strategically motivated disruption.
Rather than locking up corporate servers for ransom, attackers logged directly into the remote control panels that manage cooling units in over 800 retail supermarkets, butcher shops, and healthcare facilities. Once inside, they silenced temperature alarms, forced freezers into continuous six-hour heating cycles, and cranked temperature targets to 50°C (122°F). In France, the national blood service (Établissement Français du Sang, or EFS) confirmed that hackers accessed three off-site cold-storage facilities through a contractor’s system, shifting blood plasma freezer targets from -30°C to 110°C (230°F), an incident that only avoided catastrophe because independent backup alarms alerted staff in time.
For security and operations leaders, these attacks highlight an uncomfortable reality: our critical supply chains rely on thousands of specialized, internet-connected “mini-computers” that traditional security tools simply cannot see.
Quick Facts: The 2026 EU Cold-Chain Cyberattacks
|
Timeline: From Forgotten Hardware to Pan-European Sabotage
While the autumn 2026 attacks felt sudden to store managers arriving to puddles of melted stock, the groundwork was laid years earlier through aging hardware and unheeded security warnings.
Hardware Reaches End-of-Life (EOL)
2016 – May 2021
Danish manufacturer Danfoss phases out its popular AK-SC 355 controller (2016) and declares the widely deployed AK-SM 800 End-of-Life (May 2021). Security updates permanently cease for both models, though thousands remain in active use across European grocery stores.
The ‘Code of the Day’ Flaw Disclosed
Feb – Oct 2023
Security researchers at Synacktiv reveal that legacy Danfoss controllers contain a built-in “daily password” feature for phone support. Because the 5-digit override code is calculated directly from the current date, anyone who can reach the device online can calculate the admin password in seconds. Because the older models are EOL, no patch is issued; operators are told to take them off the public internet.
Newer Controllers Patched, But Rarely Updated
Mar – Aug 2025
Claroty Team82 discovers that newer Danfoss AK-SM 800A units still share a similar date-based password flaw (CVE-2025-41450) alongside remote code execution bugs. Danfoss releases firmware patches, and rival manufacturer Copeland patches its XWEB controllers in early 2026, but nearly 80% of internet-exposed systems fail to apply the updates.
Early Warnings & Dark Web Credential Leaks
August 2026
The U.S. Pentagon investigates mysterious refrigeration malfunctions at six military commissaries. Days later, researchers publish technical details showing over 2,700 unpatched controllers exposed online. Meanwhile, threat intelligence tracks infostealer malware logs on the dark web selling stolen login credentials belonging to third-party refrigeration technicians.
Wave 1: 700 French Supermarkets Hit Overnight
Oct 11–12, 2026
Attackers strike roughly 700 French grocery stores (Intermarché, Netto, Super U, Leclerc, Carrefour). Alarms are disabled and defrost heaters are locked on at 50°C (122°F) for six hours, spoiling millions in food and sparking equipment fires (including at a store near Nantes). France’s cyber agency issues emergency alert CERTFR-2026-ALE-012.
Wave 2: 11 Countries & French Blood Service Targeted
Nov 1–3, 2026
Three weeks later, a second wave strikes 100+ stores across Belgium, Sweden, the Netherlands, Ireland, Luxembourg, Estonia, Finland, Portugal, Italy, Germany, and the UK. Simultaneously, three cold-storage sites for France’s national blood service (EFS) are breached via contractor Coolworld, pushing plasma freezers from -30°C to a 110°C target setpoint before backup alarms save the supply.
Anatomy of the Breach: How Do You Hack a Freezer?
To understand how a remote hacker can turn a walk-in freezer into an oven, it helps to look at how commercial refrigeration actually works.
Supermarkets don’t use standalone kitchen fridges. They use centralized Operational Technology (OT) controllers: essentially rugged, wall-mounted mini-computers like the Danfoss AK-SM series or Copeland/Dixell XWEB panels. These controllers connect to dozens of display cases and walk-in coolers, letting maintenance contractors monitor temperatures and fix faults from miles away without rolling a repair truck.
And how does a cooling unit heat up to 50°C (122°F)? Commercial freezers have built-in electric heating coils designed to switch on briefly for automatic defrost cycles so ice doesn’t build up on the evaporators.
When attackers logged into these web consoles, they didn’t need to upload custom malware. As one security researcher put it, it was the digital equivalent of “wearing rubber gloves and messing with the switches.” They executed a simple, three-step sabotage play:
- Cut the alarms: They disabled the digital alerts that would normally ping the store manager’s phone when temperatures rise.
- Lock on the defrost heaters: They reprogrammed the schedule to force the electric defrost coils to run non-stop for six hours or more.
- Max out the thermostat: By setting the target temperature to 50°C—or 110°C in the French blood bank incident—they ensured the thermostat would never tell the heating coils to shut off, cooking the food inside and, in several French stores, overheating the wiring until it caught fire
Where the Attacks Hit Hardest
| Country / Sector | Affected Entities | What Happened on the Ground |
| France (Retail) | ~700 supermarkets (Intermarché, Netto, Super U, E.Leclerc, Carrefour) | Wave 1 (Oct 11–12): Continuous 6-hour defrost forced at 50°C; millions of euros in spoiled produce and meat; electrical equipment fires reported. |
| France (Healthcare) | French National Blood Service (EFS) via contractor Coolworld | Wave 2 (Nov 1–2): Three plasma storage sites had setpoints altered from -30°C to 110°C. Independent secondary alarms alerted staff; zero blood lost. |
| Belgium & Luxembourg | Delhaize (~40 stores), Carrefour (15), Intermarché (15), Spar (5), IKEA (1), local butchers | Wave 2 (Nov 2): Widespread overnight defrost tampering; one Antwerp butcher (De Laet & Van Haver) lost €15,000 in premium meat after fridges hit 18°C. |
| Sweden & Finland | ICA, Coop Sweden (6–7 stores), Kesko (Finland) | Wave 2 (Nov 2): Freezers set to 50°C at 2:00 AM via controllers connected to standalone 4G mobile networks outside corporate IT firewalls. |
| Netherlands, Ireland & Rest of EU | 17+ Dutch businesses, SuperValu (13 Irish stores), Selver (Estonia), Coop (Italy), Intermarché (Portugal) | Wave 2 (Nov 2–3): Stores forced to pull chilled inventory; UK meat processors also reported emergency overnight probing of exposed cooling controls. |
The Supply Chain and Infostealer Connection
How did the attackers get inside so many systems at once? Investigations point to three overlapping doors left wide open across the cold-chain ecosystem.
- The “Front Door” (Default Passwords & Direct Internet): In the Netherlands and parts of France, investigators found controllers plugged directly into the public internet—often still using factory-default passwords like admin or 1234.
- The “Skeleton Key” (The Code-of-the-Day Bug): Even if a store changed its password, older unpatched controllers still contained the mathematical “daily password” support feature. By asking the controller for the current date, automated scripts could calculate the day’s master override code in milliseconds.
- The “Side Door” (Contractor Credentials & Infostealers): Refrigeration systems are rarely managed by a supermarket’s internal IT team. Instead, they are installed and maintained by specialized third-party contractors—firms like Coolworld (implicated in the French blood bank breach) or regional maintenance providers like Sabcobel in Belgium and Kitman Coldtech in Estonia.
Between August and November 2026, threat intelligence researchers tracking dark web markets uncovered a steady stream of infostealer malware logs containing stolen login credentials for Danfoss customer/partner portals and building-automation dashboards. These credentials belonged to third-party HVAC and refrigeration technicians whose work laptops or home PCs had been infected by infostealers.
When a technician’s laptop is compromised, attackers don’t need to hack the corporate firewall. They can simply use those harvested credentials (or leaked customer directories) to log straight into remote management portals. Proactively auditing supply-chain domains (such as hardware OEMs like danfoss.com and copeland.com, or regional maintenance partners like sabcobel.be and coolworld-rentals.com) using compromised-credential intelligence like Lumu Discover helps security teams spot when a contractor’s keys have been leaked on the dark web before those keys are used on their equipment.
The Blind Spot: Why EDR Can’t Protect Smart Infrastructure
For the past decade, enterprise cybersecurity has leaned heavily on Endpoint Detection and Response (EDR)—installing smart security agents on every employee laptop and server to watch for malicious files.
The European refrigeration crisis exposes two fatal flaws with relying on endpoint agents in an IoT and Operational Technology (OT) world:
- You can’t install an agent on a freezer: Industrial controllers run stripped-down, proprietary embedded software. There is no way to install a traditional EDR agent on a supermarket cooling unit, a hospital HVAC controller, or a warehouse barcode scanner.
- You can’t patch what is “End-of-Life”: In corporate IT, laptops are replaced every three to four years. In supermarkets and hospitals, industrial refrigeration systems are built to run for 15 to 20 years. Danfoss confirmed that the majority of controllers hit in France (AK-SM 800 and AK-SC 355) reached End-of-Life between 2016 and 2021. Because no firmware patch will ever exist for those units and the attacks used built-in defrost commands rather than malware, traditional endpoint and patch management strategies are completely blind.
Closing the Gap: Continuous Network Visibility
If you cannot install an agent on the device, and you cannot patch the device’s software, how do you defend it? You have to secure (and monitor) the network around it.
As French cyber authorities emphasized in emergency alert CERTFR-2026-ALE-012, securing critical IoT and OT infrastructure requires a two-step shift in architecture:
- Eliminate “Shadow OT” and Rogue 4G Connections
One of the biggest surprises for affected retailers in Sweden (Coop, ICA) and Finland (Kesko) was discovering that their store freezers weren’t even on the corporate network. To make remote maintenance easy, third-party contractors had plugged the controllers into standalone DSL lines or 4G cellular routers, bypassing the supermarket’s central IT firewalls entirely. Security teams must audit their physical facilities, remove direct public internet and rogue 4G connections, and route all third-party vendor access through encrypted, authenticated corporate VPNs.
- Monitor the Traffic with Network Detection and Response (NDR)
Once refrigeration controllers and industrial assets are segmented away from public exposure, security teams must gain continuous visibility into the traffic flowing between the production environment, the Supervision Network / SCADA layer, and the Corporate IT infrastructure.
As illustrated in the network architecture below, monitoring metadata across the supervisory boundary is essential for catching attackers who pivot from corporate environments into industrial control systems:
Because compromised OT devices or contractor laptops eventually have to communicate over the network to receive commands or reach external infrastructure, network-level monitoring doesn’t care whether a device runs Windows or embedded firmware. By analyzing network metadata and traffic patterns in real time across the supervision network, security teams can immediately spot an unauthorized external IP probing a cooling unit, detect anomalous after-hours connections from a compromised contractor account, and isolate the threat before essential public services are disrupted.
Share this post