Early on Monday, November 2, store managers in at least six European countries found their freezers doing something freezers are never supposed to do: heating up. According to The Record, retailers described freezers remotely set to 50 degrees Celsius (122 Fahrenheit). The Record reported that more than 50 stores were identified in Belgium, a limited number of smaller stores in Sweden, and more than a dozen others across Ireland, Estonia, the Netherlands and Luxembourg.

This is the second wave. The first hit France on the night of October 11 into October 12, when hundreds of stores had their refrigeration controllers hijacked overnight. The Paris prosecutor's office told The Record there were around 700 victims in that attack.

No group has claimed either wave, and no government agency has named a culprit. The vulnerabilities that might explain the attacks are a more answerable question, and that's where store operators can act.

Two waves, three weeks apart

Help Net Security, citing French broadcaster BFMTV, reported that the October attack hit many shops run by Groupement Mousquetaires (Intermarché, Netto), Coopérative U (Super U, Marché U) and Leclerc. Fridges and freezers warmed instead of cooling, and BFMTV put the damage at tens or even hundreds of thousands of euros per store. Workers arriving on Monday found defrosted and spoiled products.

France's national cybersecurity agency, ANSSI, said it was aware of attacks on refrigeration remote controllers made by different brands, according to The Record. That matters, because it suggests this isn't a flaw in a single product line. Someone appears to be going after a whole category of device: small, network-connected boxes that let a technician or a head office monitor and adjust a store's cold rooms and display cases without driving out to the site. The Record described the French attackers as having compromised internet-exposed remote controllers.

The November wave was more spread out geographically but, by the numbers reported so far, smaller than France's. Belgium had the most stores identified. Stephan Moelans, the chief executive of installation company Sabcobel, told the Belga news agency that Sabcobel knew of around 20 affected refrigeration units out of the hundreds it manages across Belgium, and that the affected units needed physical modifications, not just a software update. Those units can't simply be patched and rebooted.

Which equipment is involved

Two vendor names keep coming up in the reporting. In Estonia, a contractor said the attackers accessed an older Danfoss system. In Belgium, Dutch broadcaster NOS reported that Copeland equipment was also targeted. After the French attack, both Danfoss and Copeland said the affected devices were mainly discontinued products that no longer received security updates, according to The Record.

That detail explains a lot. A refrigeration controller installed during a store refit can keep running long after the vendor stops shipping firmware for it, and if it was exposed to the internet for remote access, it can remain reachable for as long as it stays in service.

The vulnerabilities on record

We have to be careful here. No source has confirmed which vulnerability, if any, was used in either wave. We filed this story under zero-days because it's the closest fit for attacks on vulnerable, internet-exposed industrial controllers. That is not a claim that a previously unknown flaw was used. The attackers may have exploited known bugs, used default or weak credentials, or done something else entirely.

Still, the public record shows that the controller families named in the reporting have had serious security flaws, and defenders should know about them:

  • CVE-2026-21718, published to the U.S. National Vulnerability Database on February 27, 2026, is an authentication bypass in Copeland XWEB Pro versions 1.12.1 and earlier. Authentication bypass means an attacker can skip the login step entirely. NVD says this one enables pre-authenticated code execution. It carries CVSS 3.1 scores of 10.0 and 9.8, both rated critical. A companion bug in the same product, CVE-2026-25085, is another authentication bypass, this one caused by an unexpected return value from the authentication routine being processed as legitimate, and is scored 9.8 (critical) and 8.6 (high).
  • CVE-2025-41451, published August 22, 2025, is a command injection flaw in Danfoss AK-SM8xxA Series controllers before version 4.3.1. Command injection means text typed into a settings field gets run by the device as an instruction. Here the vulnerable fields are in the alarm-to-mail configuration. Exploiting it requires being logged in first, but it can lead to remote code execution, and it is rated 8.7 (high) under CVSS 4.0. A related flaw, CVE-2025-41450, published May 8, 2025, is an improper authentication bug in AK-SM 8xxA versions before 4.2, scored 8.2 (high).

Help Net Security also reported that in early August 2026, Claroty's Team82 research group disclosed multiple vulnerabilities in the web-based management interfaces of the Danfoss AK-SM 800A and Copeland XWEB Pro, and that both vendors have since released updated firmware that fixed them. Whether any of those flaws were exploited in the freezer attacks is unknown.

Put those facts together and you get a plausible picture: vulnerable controller families, discontinued hardware that no longer receives security updates, and attackers who appear to know how to change setpoints on more than one brand. It is only a plausible picture, though. Investigators haven't published an explanation, and neither have we.

Who is behind it?

Nobody knows, and officials are saying so openly. "It is not known who is behind this attack, and it may never be possible to identify them," Katrien Eggers, a spokesperson for the Centre for Cybersecurity Belgium (CCB), told The Record. She said the CCB is concerned about the rising number of incidents, partly due to the targeted use of AI, but that the agency does not yet know whether AI was used as part of these attacks. The Record also reported that it is not known whether the two waves were carried out by the same perpetrators.

One thing worth heading off: around the time of the French wave there was a separate incident at Ahold Delhaize, the grocery group. Help Net Security reported there was no indication at the time that the two were connected, and nothing in the current reporting links it to the freezer attacks.

What It Means for Defenders

If you run, maintain or insure retail refrigeration, especially in grocery, convenience or food service, treat this as an active campaign against your equipment class. Here is what the sources support:

  • Inventory your controllers. Find every remote refrigeration and building-management controller across your sites, with make, model and firmware version. Danfoss AK-SM 800A/8xxA and Copeland XWEB Pro units deserve priority, since both are named in the reporting and the vulnerability records.
  • Check Copeland XWEB Pro firmware. NVD lists versions 1.12.1 and earlier as affected by the critical authentication bypass CVE-2026-21718. Move to the vendor's fixed firmware.
  • Check Danfoss AK-SM8xxA firmware. Versions before 4.2 are affected by CVE-2025-41450, and versions before 4.3.1 by CVE-2025-41451. Version 4.3.1 or later is outside the affected range of both records. Apply the newer firmware Danfoss released after the Claroty Team82 disclosures as well.
  • Plan to replace end-of-life units. Both vendors said the devices hit in France were mainly discontinued products without security updates. No patch is coming for those. Until you can replace them, a discontinued controller should not be reachable from the internet at all.
  • Take management interfaces off the open internet. The flaws Team82 disclosed sit in the devices' web management interfaces. Put remote access behind a VPN or a vendor-managed secure gateway, restrict it to known addresses, and change any default or shared passwords. Rotate credentials for service contractors too.
  • Get physical temperature alarms that don't depend on the controller. A compromised controller could report misleading temperatures or simply change them. An independent sensor that texts the store manager when a case passes a threshold can turn an overnight loss into a short scramble.
  • Budget for hardware work, not just a reflash. The Sabcobel CEO said affected Belgian units needed physical modifications. If you are hit, your refrigeration contractor's response time is the bottleneck, so know who to call before it happens.

Regulation will catch up eventually. According to The Record, the EU's Cyber Resilience Act will impose stricter requirements on such products from December 2027, when manufacturers will have to provide a support period reflecting a product's expected lifetime, while there are currently no legal obligations on manufacturers to fix products targeted by such attacks. That won't help the controllers already installed in stores today, so for now the work falls to the people who run those stores.

Sources