// Contents
Overnight on November 2, 2026, the freezers at an ICA Kvantum supermarket in the small Swedish town of Sjöbo started to heat up. By morning the store was telling customers on Facebook that its fridges and freezers had been hacked and set to 50°C (122°F), and that staff were throwing out the affected products. The same night, similar failures hit dozens of stores in four more countries, the Associated Press reported.
This is the third wave. In August, refrigerators failed the same way in stores on US military bases, and the Pentagon is now treating it as a possible cyberattack. In October, about 700 supermarkets in France were hit. The strangest part: nobody broke the cooling. The attackers switched on something every display freezer already has: a built-in heater. And on most of the French refrigeration control panels reachable from the internet a month earlier, anyone with a calendar could work out the administrator password.
Why a freezer has a heater
Store air is humid. When it touches the cold coils inside a display case, the moisture settles on them as frost, and frost acts like a winter coat: the thicker it gets, the worse the coils shed cold. So a commercial freezer defrosts itself on a schedule. A heater comes on, the frost melts, the water drains away, and the case goes back to freezing. Normally that takes about two hours a day, according to the Swedish business site Dagens PS.
The attackers told the controllers to defrost nonstop and raised the heating setpoint to 50°C. In some French stores, Le Monde reported, they also stretched each defrost cycle from one hour to eight. That held off the alarms and gave the damage time to spread.
Where someone was watching, the attack was caught fast. In Estonia, the AP reported, the service firm Kitman Coldtech found attackers inside a computer running a client’s refrigeration. They had already pushed the temperature to the same 50°C. CEO Jann Mutso said it was over in minutes and caused no significant damage.
The 50°C figure made every headline, but it is the heater’s setting, not the temperature on the shelves. The display on one French ice cream freezer read 26°C (79°F), Dagens PS reported. For the ice cream, the difference hardly mattered. Frozen food is supposed to stay at −18°C (0°F) or colder; brief rises to −15°C are tolerated, and anything warmer can’t be sold. So stores binned everything. “We had to throw out all of our fresh products (butcher’s counter included),” wrote an Intermarché store in Mûr-de-Bretagne, in Brittany.
Three waves since August
The first similar cases turned up outside Europe. In late August 2026, refrigeration failed in at least six stores on US military bases, Reuters found. On August 26, Fort Huachuca in Arizona announced that a refrigerator had switched itself into defrost mode and warmed the food until it spoiled. Reuters could not establish whose equipment the bases used.
On the night of October 11 to 12, the same thing happened in France, in hundreds of stores at once. Finance Minister Roland Lescure told parliament that about 700 of the country’s 10,000 supermarkets were affected. “It’s unacceptable,” Coopérative U chief executive Dominique Schelcher wrote. Two supermarkets in Haguenau, in Alsace, lost €270,000 (about $300,000) of food between them, Dagens PS calculated. Intermarché warned that insurance doesn’t cover incidents like this at its stores. Paris prosecutors are investigating the attack, including the losses and reports of fires in some stores.
In an emergency alert, France’s cybersecurity agency named the Danish company Danfoss as the maker of the hardware. A day later it added two more manufacturers and warned that attacks were probably still underway. Three weeks later the agency was proved right: on November 2, several dozen Delhaize, Carrefour and SuperValu stores in Belgium, Luxembourg and Ireland were hit. The Irish stores were restocking their fridges by evening.
A password from the calendar
The Danfoss AK-SM 800A is, in effect, the master panel for a store’s refrigeration. Through a web page, staff watch every circuit, set temperature limits, change defrost schedules and fix settings remotely. Refrigeration units used to be cut off from the internet; now they are connected for sensors and remote monitoring, cybersecurity consultant Antoine Hautin told AFP. A service company can watch all its clients’ cases from its own office.
Researchers at Claroty, an industrial cybersecurity firm, found a hidden “code of the day” in this panel: a service password the device computes each day from nothing but the current date. Reproduce the routine and you can log in as administrator without knowing the real password. The researchers reported the hole, and in March 2025 Danfoss closed it with firmware 4.2. Claroty’s Amir Zaltzman published a detailed write-up on August 9, 2026.
Owners had a year and a half to update. Few did. On October 11, the eve of the attack, the device search engine Censys counted 1,825 of these panels in France reachable straight from the internet. Of those, 1,158 ran firmware older than 4.2, meaning the calendar password still worked. Nobody knows whether the attackers used that particular hole: neither Danfoss nor the French authorities have named the entry point.
The older models are worse off. Most of the affected units, Danfoss said, were AK-SM 800 and AK-SC 355 systems. It stopped supporting the first in May 2021 and discontinued the second in 2016. Neither gets updates at all, and stores are slow to replace them: the systems last for years and cost a lot.
Which flaws were found in the panels
The French agency listed Danfoss AK-SM and AK-SC controllers, along with Copeland XWEB and Dixell XWEB systems, as targeted. Claroty’s researchers described three flaws in the Danfoss AK-SM 800A. CVE-2025-41450 lets an attacker log in as administrator with a password derived from the date. CVE-2025-41451 lets an attacker slip system commands into the email alert settings and run them on the device. CVE-2025-41452 lets an attacker swap web server settings and crash the management interface again and again. Chained, the first two give full remote control of the panel. The last two were fixed in firmware 4.3.1. The same researchers found 23 flaws in Copeland’s XWEB Pro panels, 21 of them high severity; firmware 1.13 fixed them.
Nobody asked for a ransom
A typical hack pays: the attacker steals data or encrypts it and demands money. Here nothing was stolen, no ransom was demanded and nobody claimed responsibility. For an attack this large, that is unusual, noted Christopher Whyte of Virginia Commonwealth University. Pulling it off, he said, is “not too difficult.” Why anyone is doing it, nobody knows yet.
The trick isn’t entirely new. Danfoss told Reuters that back in 2022, attackers used its outdated controllers to hit supermarkets in Russia and Israel. What’s new is the scale: hundreds of stores in one night, and now several countries. John Hultquist, chief analyst at Google Threat Intelligence Group, put it this way: “The complex system that delivers our food is fragile but often doesn’t receive the attention it deserves.”
Unplugged, not patched
After the October attack, owners scrambled. In three days, the number of French controllers visible from the internet fell from 1,825 to 537, a drop of 71%. But patched and unpatched devices shrank at the same rate. In other words, most panels were simply pulled offline, firmware untouched. Censys says that was probably the best choice: there is no reason for these devices to face the internet directly. The French agency agrees and recommends restoring remote access only through a secure VPN.
One number shows how rarely these panels get updated at all. On October 11, Censys found Danfoss’s newest firmware, version 5.3.2, on 27 of the nearly 3,000 panels visible from the internet worldwide, under one percent. Nobody has named the entry point, nobody knows the motive, and November showed the attacks haven’t stopped. How big the next wave gets depends on how many of these panels are still facing the internet.
