Overnight on November 2 and 3, supermarket chains in Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia reported that store fridges and freezers had stopped holding temperature. The wave landed three weeks after roughly 700 French supermarkets were hit the same way, and it has set off a rush to blame someone. A new assessment from Tom Hegel of SentinelLABS argues that the public evidence does not yet support naming a culprit.
Hegel's chronology lists further reports from Germany, Italy and Portugal over the same two days, and Finnish retailer Kesko said it was investigating temperature anomalies at a few smaller stores without ruling out network interference.
The attackers used the fridges' own controls
Reporting and official statements suggest the attackers did not need exotic malware. They changed temperature and defrost settings through the supervisory platforms that let operators manage a store's refrigeration remotely. Early coverage of the French wave focused on published flaws in Danfoss controllers, but ANSSI director Vincent Strubel told the French Senate on October 21 that the agency's assessment at the time pointed instead to internet-exposed administration interfaces and weak passwords. CERT-FR's October alert, which we covered when it landed, named Danfoss AK-SM and AK-SC equipment alongside Copeland and Dixell XWEB systems.
Whether the same access path explains the November incidents is not yet known. Two operators have pointed at contractors: Portugal's Mosqueteiros group said attacks on seven Intermarché stores appeared to target an external refrigeration-management provider, and a German operator described an attack involving the company that remotely maintains its store's cooling. SentinelLABS treats shared maintenance access as an important lead, not a proven common thread.
Russia is a hypothesis, not a finding
Refrigeration attacks are not new. Danfoss documented attacks on 16 Russian supermarkets and 40 Israeli stores in 2022, and the US Justice Department attributed a November 2024 attack on a Los Angeles meat processor, which spoiled product and caused an ammonia leak, to Cyber Army of Russia Reborn (CARR). In December 2025 the DOJ alleged Russian government backing for CARR and NoName057(16), and Z-Pentest has since claimed a refrigeration intrusion at a Spanish supermarket in an archived Telegram repost that confirms neither access nor damage.
That record makes Russian-aligned groups a credible line of investigation. But Hegel notes that copycats, financially motivated intruders and other state-linked actors fit the public facts too, and that a shared controller model or a similar temperature change would not be enough to link incidents, because there are only so many obvious ways to disrupt the same equipment. Separately, US officials reportedly suspect Iran-linked actors in freezer failures at US military commissaries in August, a provisional view that concerns the US cases, not Europe.
Take controllers off the internet, then check defrost settings
- Preserve logs and configuration records before restarting or resetting equipment where it is safe to do so, and coordinate recovery with refrigeration staff.
- Remove Danfoss, Copeland, Dixell and any other refrigeration management units from public IP addresses, and restore remote access only through a VPN or protected network, as CERT-FR advises.
- Review the full controller configuration, defrost ranges in particular, replace default and weak passwords, and apply firmware updates.
- Scan owned address ranges for exposed systems, including connections set up by contractors, and treat exposed units with weak or default credentials as compromised.
SentinelLABS expects further incidents wherever the same access conditions persist. The harder problem may be the one that follows: as copycats and opportunistic claims pile up, unrelated break-ins can start to look like a single campaign long before anyone has shown that one exists.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.