Supermarket refrigeration: suspected attacks set Danfoss/Copeland freezers to 50°C across Europe (no CVE)
Severity: medium · Patch status: unpatched · Since 2026-11-02
On Monday 2026-11-02, The Record reported a second wave of suspected cyberattacks on supermarket refrigeration in Europe, after an October attack on French supermarkets that the Paris prosecutor puts at around 700 victims. Retailers said their freezers had been remotely set to 50°C, which caused stock to spoil. The Record reports a limited number of smaller stores in Sweden, more than 50 stores identified in Belgium, and over a dozen across Ireland, Estonia, the Netherlands and Luxembourg; no combined total is published. The reporting names Danfoss (an older system, per a contractor in Estonia) and Copeland equipment (in Belgium, per Dutch broadcaster NOS). After the French attack, Danfoss and Copeland both said the affected devices were mainly discontinued products that no longer receive security updates; Danfoss had announced a hard end-of-service policy for legacy products in an October 2025 newsletter. No group has claimed the attack, and the Belgian Centre for Cybersecurity says the perpetrators may never be identified. The Record does not establish whether this wave and the French attack share perpetrators, and it does not describe how the controllers were reached in this wave.
What to do
- Audit refrigeration and building-controller interfaces for internet exposure now; restrict remote management to a VPN or allow-listed firewall paths
- Inventory Danfoss and Copeland controllers, including older Danfoss systems; flag discontinued models, which both vendors say no longer receive security updates, for physical inspection and replacement
- Change default or weak credentials on remote management interfaces and disable remote access that is not needed
- Alert on remote setpoint or defrost changes, especially any setpoint far outside normal range; the reported attack pattern is 50°C
- Plan lifecycle replacement of legacy OT controllers ahead of the EU Cyber Resilience Act's stricter requirements from December 2027
Sources
All live incidents on Threat Watch
