Europe's Freezers Were on the Internet. The Attack Was a Login Away.

A second wave of freezer attacks hit eleven countries in one night. No malware, no ransom note — just exposed controllers, old firmware and default passwords. The EU calls it sabotage; Romania's cyber chief calls it semi-amateurish.

Shortly after 2am on Monday, the freezers in an ICA supermarket in Sjöbo, in southern Sweden, were set to 50°C. Staff found out when they came in. By then the food was gone — not stolen, not eaten, just ruined, and headed for the skip.

The same thing happened that night in dozens of shops in Belgium, in four German stores, in Sicily, in Ireland, Estonia, Finland, Luxembourg, the Netherlands, Portugal and Sweden. By Tuesday, Euronews counted at least eleven countries, with the UK affected too. In Belgium, around 40 Delhaize supermarkets, 15 Carrefour stores and five Spar shops reported problems; one chain estimated €100,000 of food thrown away. Belgian media reported temperatures reaching 70°C in at least one store.

None of it required a piece of malicious software.

The attack was a settings change

Refrigeration in a modern supermarket is not a compressor and a dial. It is a small computer — a controller — that runs the temperature, the defrost cycle and the alarms for every cabinet in the store. Those controllers are routinely connected to the internet so a refrigeration contractor can see a fault and fix it remotely instead of sending a van.

Once an attacker is inside that controller, the attack is not really an attack at all. It is a configuration change. In Belgium, the units were switched into defrost mode, which is meant to melt ice off the coils but, run at the wrong moment, heats the cabinet instead of cooling it. In Sweden and Estonia, the setpoint was simply raised to 50°C. The alarms can be turned off the same way.

There is no exploit chain to find afterwards, no malware sample to hand to a forensics team. As Rafe Pilling of Sophos put it to the Guardian, the technique is closer to "wearing rubber gloves and messing with the switches."

The argument about who did it

No group has claimed the attacks. No ransomware gang has demanded money — and a ransom demand would be strange here, because the damage is done the moment the temperature rises.

The EU's food and agriculture commissioner, Christophe Hansen, called the campaign "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it." Italy convened its intelligence services and national cybersecurity agency on Tuesday. Belgium's federal prosecutors opened an investigation.

Romania's cyber chief looked at the same evidence and shrugged. Six Romanian outlets were affected, and Dan Cimpean, director of the National Cyber Security Directorate, said: "It seems semi-amateurish. We do not suspect, under any circumstances, that it is a state actor."

Both readings fit the facts, which is the uncomfortable part. The operation is cheap enough for a lone actor with a search engine. It is also strategically meaningful enough for a state that wants to show it can reach into a continent's cold chain. Pilling's own shortlist was "state-based signalling and demonstration of capability" or "some kind of lone-wolf hacker." The absence of a claim cuts both ways: it denies investigators a signature, and it denies the attacker the propaganda.

The install base nobody owned

The more useful question is not who turned the freezers up, but why they could be turned up at all.

In October, the security firm Forescout went looking for refrigeration controllers on the open internet using Shodan, a search engine for connected devices. It found 12,976 exposed refrigeration management services on 6,017 public IP addresses in 99 countries and territories. Most belonged to two product families: Copeland and Dixell's XWEB systems, with 7,075 services, and Danfoss's StoreView, with 4,697.

Of the Danfoss services it could identify, 80 percent were running firmware older than the version that fixes known security flaws. The AK-SM 800, the model at the centre of the French attack, has been end-of-life since May 2021. It cannot be patched, because nobody is writing patches for it any more.

The same systems sit in food processing plants, wineries, fruit storage, farms and hospital cooling equipment. They are online for good reasons. Danfoss says remote monitoring typically cuts unnecessary engineer callouts by 15 to 30 percent, and it lets a supermarket keep the temperature records that food-safety law requires without a member of staff walking the aisles with a clipboard four times a day.

What nobody arranged was ownership. A contractor may manage the software, the store may own the equipment, and the store's IT department may run the connection. Forescout's researchers noted that unless the roles are assigned explicitly, "no single party may have complete visibility into the exposed service."

This is not a new discovery, either. Danfoss's own customer bulletin, published in October 2025, describes attacks on AK-SM 800 controllers in 2022: sixteen supermarkets in Russia at the start of the war, and forty stores in Israel, all of the affected stores lacking proper firewall or VPN protection. The French wave three weeks ago was the largest demonstration since. The second wave hit, among others, the shops that had not acted on it.

The rehearsal in France

On 12 October, attackers took over cooling units in as many as 700 French supermarkets, pushing temperatures from as low as -27°C to well over 50°C. There were fires. Losses ran into tens of millions of euros; individual stores reported damage from tens of thousands to more than €130,000. The Paris prosecutor's office opened a formal investigation, and the prime minister asked the national cybersecurity agency, ANSSI, to look into it.

CERT-FR, the agency's response team, issued an alert covering the Danfoss AK-SM and AK-SC series and the Copeland and Dixell XWEB systems. Its warning is blunt: attack campaigns against those devices are probably still under way, and leaving an end-of-life device reachable from the internet carries "a very high probability of compromise." Even a factory reset is not enough. It removes the intruder's persistence, the agency notes, but the device stays vulnerable and is very likely to be compromised again. The alert was last updated on 16 October. It described the situation accurately then, and it describes it accurately now.

That is the shape of the problem in one detail: the technical guidance existed, was public, and was three weeks old. It still did not reach a butcher in Hove, a Spar franchise in Flanders, or the last Selver store in Estonia that had not yet been migrated off an old Danfoss system. In the Netherlands, Danfoss told broadcaster NOS that the systems hit were not on a secure network and still used default passwords; most shops had taken measures after France, and the few that had not were the ones attacked.

The AI question, answered carefully

It would be easy to file this under artificial intelligence, and the UK's cybersecurity leadership spent Tuesday explicitly not doing that.

Paul Chichester, operations director at the National Cyber Security Centre, said the fridge attacks were not AI-enabled and had used vulnerabilities that had been "out there for a long period of time." His chief executive, Richard Horne, described them as the "foothills" of a larger threat — the point being that AI's contribution is still ahead, in finding flaws at scale that owners have neglected.

The experts Euronews spoke to made the same distinction from the other direction. Pavlina Pavlova of Critical Cyber: "AI-driven vulnerability detection makes finding and exploiting weak points easier and faster than ever, including in vital functions on which people depend — while patching at this speed remains a bottleneck for defenders." Marta Rybczynska of Ygreky said the method is easy enough that instructions are available online, and asked the question that matters more than attribution: why shops hit in France did not harden their installations in the three weeks they had.

The honest version is this. This wave was not AI. It was a decade of default settings meeting a search engine. AI matters because it collapses the time between finding an exposed controller and using it, while the patch cycle for end-of-life industrial hardware is measured in years, if it exists at all.

What this actually exposes

For twenty years, critical infrastructure meant power stations, water treatment and ports. The label is now doing less work than the reality. A continent's food supply depends on a layer of small computers in back rooms, owned by franchisees, maintained by contractors, reachable from the public internet, and often running software that its manufacturer stopped supporting before the pandemic.

The damage this week was measured in spoiled stock and empty shelves — bad, expensive, and recoverable. The lesson is about margin. Nobody died because a freezer went to 50°C. But the same access, pointed at hospital cooling, a food-processing line, or a distribution centre's cold store, is a different order of event, and the population of exposed devices is global: 99 countries, not eleven.

What to watch

Whether anyone claims the attacks, and whether Belgium's investigation and Italy's intelligence review converge on an attribution. Whether CERT-FR or Danfoss publishes a new advisory, and whether the exposed-device count on Shodan falls or simply gets re-skinned. Whether the EU moves from "collective resilience" language to something with deadlines. And whether the next wave goes after retail again, or steps one link up the chain into processing and logistics, where the same controllers run colder, larger volumes.

The fix is unglamorous and already written down: take the controllers off the open internet, put contractor access behind a VPN, replace what cannot be patched, kill shared passwords. It is the kind of work that produces no headlines until the night it is missing.

The internet of things was always the internet of things that could be reached. This week Europe found out which of them were holding the food.

Sources: The Guardian — Shop fridges and freezers across Europe hit by fresh suspected cyber-attack, The Guardian — Who is hacking Europe's supermarket fridges and freezers, and why?, The Guardian — Food suppliers in UK hit by cyber-attacks after freezers targeted in Europe, Euronews — Which countries in Europe have been hit by supermarket fridge cyber incidents?, Euronews — Italy holds emergency talks as supermarket fridge attacks spread across Europe, Euronews — Supermarket hacks: why are fridges connected to the internet?, Danfoss — Cool Update, October 2025: AK-SM 800 phase-out and cyberattack history (PDF), CERT-FR — Alerte CERTFR-2026-ALE-012