On the night of Monday, November 2, supermarket freezers in at least ten European countries quietly stopped being freezers. Remote refrigeration controllers were pushed into maximum-temperature defrost cycles - up to +50C - and by morning, retailers from Belgium to Estonia were throwing away entire chilled and frozen inventories. Nobody has claimed responsibility. Nobody sent a ransom demand. That second fact is the story.
What actually happened
The primary source here is Belgium's Centre for Cybersecurity (CCB), whose advisory is unusually concrete for a national-CERT bulletin. Attackers targeted remote management controllers from three vendors - Danfoss AK-SC/AK-SM series, Dixell xweb, and Copeland xweb - that were reachable from the public internet. The CCB's own list of exploited conditions reads like a checklist of things we have all been told for twenty years: unpatched firmware, internet-exposed web interfaces, and unchanged default vendor credentials. There was no exotic zero-day. The attackers logged into equipment that was, in effect, already logged in for them.
The blast radius, per the BBC's reporting: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany, and Sweden. Ireland's Musgrave Group confirmed 13 SuperValu stores hit; Portugal's Mosqueteiros group linked seven Intermarché incidents to an attack on "an external service provider"; Belgium's federal prosecutors opened an investigation; Italian authorities, briefing after an emergency meeting with intelligence chiefs, noted the affected businesses were "mostly still equipped with obsolete security systems, with interfaces directly exposed to the internet." Three weeks earlier, a first wave had disrupted as many as 700 French grocery stores, with losses estimated in the tens of millions of euros. And this week French blood banks detected and reversed a temperature spike in their cold rooms after their refrigeration provider was targeted - the same playbook, aimed at plasma instead of pizza.
This was not a hack of a vulnerability. It was a hack of a feature.
The detail worth sitting with: the attackers did not make the controllers do anything the controllers are not designed to do. Defrost cycles, temperature setpoints, remote override - these are legitimate functions, sold as features, operated daily by refrigeration service providers. The entire attack surface was a management interface on the open internet with the vendor's factory password. You do not need an exploit chain when the product ships with remote root and a manual that tells you where to look.
This is the mature form of OT risk. For years the canonical fear was Stuxnet-style bespoke engineering against air-gapped industrial controllers. The freezer campaign demonstrates the opposite end of the spectrum: mass, low-skill, high-impact sabotage against equipment that nobody in the organization thinks of as a computer. A Danfoss AK-SC does not get a patch cadence, an EDR agent, or a line in the asset inventory. It gets installed by a contractor, plugged into "the internet" so the service provider can monitor it, and forgotten for a decade - which is roughly the support lifetime of this equipment, and why the CCB warns that end-of-life units will simply be re-compromised after a factory reset if they stay exposed.
The second wave is the point
Three weeks separated the French wave from the European one. That gap is the most instructive number in the whole affair. The first attack proved the technique works, proved the losses are large, and proved - via every news outlet on the continent - exactly which device families and which retailers are exposed. A second wave arriving on schedule is what a proof-of-concept looks like when the concept is reproducible by anyone with a search engine. Shodan-style discovery of exposed refrigeration controllers is not advanced tradecraft; it is a query.
The absence of a ransom note matters too. Encryption-for-money has a business model you can interdict: payments, negotiators, exchanges. Pure destruction has no monetization layer to attack, no decryptor to wait for, and no reason to stop. Whether this turns out to be state-aligned hybrid harassment (EU officials are careful to say they cannot attribute it) or copycat vandalism, the defender's problem is identical: the food supply chain just acquired a denial-of-service threat model measured in tons of spoiled stock, not in downtime hours.
What the CCB says to do, and why it generalizes
The Belgian advisory's recommendations are worth quoting almost verbatim because they are the correct template for every business-critical OT device, not just freezers: remove public IP exposure and require VPN or protected-network access only; update firmware and change default passwords; verify the full configuration, including the defrost ranges the attackers abused; review insurance and service contracts before cutting the provider's telemetry link; use source-IP filtering only as a temporary stopgap; and if compromise is confirmed, factory-reset and reconfigure - knowing the reset is worthless if the device goes back on the open internet, especially on end-of-life hardware.
Note the one item that does not look like IT advice: "check contractual insurance conditions before cutting off the reporting of data to the refrigeration service provider." That line is doing quiet work. The remote link exists because someone pays for monitoring, and ripping it out without reading the contract can void your coverage or your service agreement. OT remediation is as much procurement as it is networking.
Your organization probably does not run supermarket freezers. It almost certainly runs something equally forgotten: an HVAC controller, a smart UPS, a building access panel, a camera DVR, a badge reader with a web interface from 2014. The freezer attackers just published, at continental scale, the going rate for leaving those on the internet with the factory password. The audit is boring: find every management interface, ask why it is reachable, and fix the answer. The alternative is finding out what your equivalent of +50C is - on someone else's schedule.
Sources: CCB Belgium advisory "Security Incidents Across Europe Targeting Remote Controllers of Refrigeration Installations" (published 03/11/2026); BBC News, "Europe on alert after supermarket freezers hit by cyber-attacks in 10 countries" (03/11/2026); Help Net Security week in review (08/11/2026) for the second-wave framing and the French blood-bank incident.
Top comments (0)