Cyberattackers targeted supermarket refrigeration systems across at least nine European countries, manipulating industrial controllers to trigger defrost cycles and destroy food supplies. The coordinated operation, which included incidents in France, Belgium, and Portugal, exploited known vulnerabilities in Danfoss AK-SM 800A controllers to raise temperatures to as high as 50 degrees Celsius, causing massive inventory loss.
This series of incidents represents a shift from traditional data theft toward physical sabotage of critical supply chain infrastructure. While most cyber threats focus on exfiltrating sensitive information, these attacks specifically targeted the operational technology (OT) governing temperature control, turning essential cooling equipment into heating elements. According to reports from Jornal de Notícias and Sábado, the attackers did not necessarily use sophisticated malware, but rather exploited legitimate system functions and weak authentication protocols to execute remote commands.
Strategic Implications of the European Cold Chain Sabotage
- Operational Vulnerability: Attackers utilized the “defrost” function of industrial controllers to spike temperatures, rendering specialized malware unnecessary.
- Geographic Scope: The impact spanned at least nine nations, including Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, Finland, Italy, and Portugal.
- Systemic Risk: The exploitation of the Danfoss AK-SM 800A highlights how interconnected IoT devices in retail environments create massive, unmonitored attack surfaces.
Scanners Targeted Danfoss Component Configurations Across Europe
The attacks were preceded by a highly organized period of scanning and reconnaissance. Euronews reported that the cybersecurity firm Lupovis detected a significant surge in probing activity between October 20 and October 30, peaking on October 26. During this 10-day window, the firm recorded over 276 attempts from 91 different threat actors specifically targeting Danfoss component configurations. Notably, this activity was localized to Europe, with no similar patterns detected by sensors in Asia, Africa, or the Americas.
The technical execution relied on specific flaws in the AK-SM 800A controller. Investigation by Claroty identified a hidden authentication mechanism (CVE-2025-41450) that allowed attackers to bypass administrator passwords by generating a code based on the device’s current date. Furthermore, CVE-2025-41451 enabled command injection via the controller’s email configuration settings. Sábado noted that many systems remained vulnerable simply because they were still operating with factory-default passwords or were directly accessible via the public internet without a VPN.
Inventory Loss and Retailer Exposure Across the EU
The financial impact on retailers was immediate and physical. In France, during the early hours of October 11-12, hundreds of supermarkets experienced temperature rises that turned cooling units into “ovens.” Sábado detailed the scale of the disruption, noting that at least 300 Intermarché and Netto stores, fewer than 100 Coopérative U locations, 80 Carrefour stores, and approximately 30 Monoprix outlets were affected. In these instances, temperatures reached nearly 50 degrees Celsius for approximately six hours.
The disruption extended across borders, affecting the operational continuity of major chains. In Belgium, at least 76 food stores were hit, with the Belgian company Sabcobel confirming that attackers had placed the evaporators in defrost mode, raising the temperature. In Portugal, the Mosqueteiros Group (Intermarché) confirmed temperature manipulations in seven stores that raised levels above 30 degrees Celsius, making food loss inevitable.
| Affected Region/Chain | Reported Impact/Scale | Primary Mechanism |
|---|---|---|
| France (Intermarché, Carrefour, etc.) | 300+ Intermarché; 80 Carrefour stores | Defrost cycle activation |
| Belgium (Various retailers) | At least 76 food stores | Remote parameter alteration |
| Ireland (SuperValu) | 13 supermarkets | Controller manipulation |
| Portugal (Intermarché) | 7 stores | Temperature elevation >30°C |
Regulatory Pressure and the Shift Toward OT Security
The Digital Operational Resilience Act (DORA) requires covered financial entities to have the capacity to withstand, respond to, and recover from technological incidents. While DORA primarily targets the financial sector, the effects on critical infrastructure—such as water management, air traffic control, and medical supply chains—are becoming increasingly clear.
Security experts warn that the “connectivity” of modern retail is a double-edged sword. As Acre Security CEO Kumar Sokka noted to Euronews, security for connected devices in the retail sector is often deprioritized in favor of protecting payment systems and customer data. This oversight allows attackers to move from the digital realm into the physical world, causing tangible economic damage through spoiled inventory and broken supply chains. The recent incidents suggest that the next wave of attacks may target even more vital sectors, such as pharmaceutical storage or municipal water systems.
To mitigate these risks, French authorities and industry experts recommend an immediate withdrawal of all affected equipment from the public internet. Access must be restricted to protected networks or VPNs. Danfoss has released firmware version R4.3.1 to address the identified vulnerabilities, and version 4.0 introduces "Strict Session Control" as a default setting to mandate HTTPS. However, for models reaching end-of-life, experts suggest that replacement is a more viable strategy than attempting to patch obsolete hardware.
As cyber threats evolve, the distinction between a digital breach and physical sabotage continues to blur. In a discussion on the NOW channel, lawyer Pedro Proença warned that these actions, which target critical infrastructure like supermarkets and hospitals, could potentially be classified as terrorism or large-scale testing for power grid failures, stating, “definitely, we are not safe.”
