Frozen again: the supermarket fridge attacks have spread across Europe, exactly as the map said they would

We did, in fact, tell you

Three weeks ago, after attackers drove the refrigeration in several hundred French supermarkets into an endless defrost cycle, we turned the same question on the rest of Europe and on the United Kingdom. We published two conclusions that mattered, and we did not hedge them.

The first was that France had not been singled out. "France was not singled out because someone bore it a grudge," we wrote; "it was singled out because its refrigeration estate was, by a wide margin, the most reachable Danfoss population in the world. When that many identical devices share the same known flaw and the same open front door, an attacker does not need to be sophisticated, only systematic." The second was that none of this depended on the manufacturer. The exposure "has followed" whichever vendor a country's refrigeration estate happens to favour, we said, and "the lesson does not depend on the brand." We called our own headline figure — over eight hundred internet-exposed refrigeration and building-management controllers in the UK alone — "a floor rather than a ceiling."

A systematic attacker working down a list of the most reachable populations does not stop at one country, and a problem defined by open front doors does not respect a coastline. We said as much. This week it happened.

What happened this time

Overnight into Monday 2 November, the same pattern that emptied French chilled aisles in October reached across the continent at once. In Belgium, around forty Delhaize stores had their refrigeration and freezer units switched into defrost mode in the small hours; roughly fifteen Carrefour stores were reportedly affected, along with Intermarché and Spar sites and the Shop & Go outlets at Q8 service stations. Delhaize described "an IT incident affecting the refrigeration systems in several dozen of our stores," and the manager of its Overijse branch called the consequences "catastrophic." In Sweden, ICA confirmed attacks on a small number of stores outside its central network and Coop reported problems at six locations in the centre of the country, where a manager at an ICA store in Böda found the freezers set to 55°C. In Ireland, at least thirteen SuperValu stores run by Musgrave were hit by a suspected cyberattack. Luxembourg was named among the affected countries as well.

The signature is identical to France: overnight, remote, no one in the building, fridges and freezers commanded into defrost or simply up to temperature, chilled and frozen stock lost by the aisle, and — so far — no ransom demand, no claim of responsibility and no attribution. The one honest caveat, as The Register put it, is that it is "unclear if the latest attacks across Europe used the same methods" as the Danfoss compromises in France. We will come back to why that caveat is not the reassurance it sounds like.

The map always said this

When we measured France in October, the public internet-scan services showed roughly 2,967 internet-facing Danfoss controllers there — close to three in every five on the entire internet. This week, the same query returns 1,596.

That is a fall of about forty-six per cent in three weeks, and it is the signature of a belated but real clean-up: controllers patched, taken off the public internet, or both, after a national regulator's alert and a fortnight of ruined stock concentrated minds. It is exactly what should happen after an incident, and it is to France's credit that it did.

It also moved the problem. An attacker working down a league table of reachable populations, finding the top entry suddenly hardened, does not give up; they go to the next entries that have not moved. The countries hit this week sit precisely where that logic points. Belgium, Sweden and Ireland did not clean up in October, because in October the attack was someone else's problem, happening on the other side of a border. Their controllers were as reachable on Monday as they were three weeks ago, and now they are the story.

It was never about the brand

Look at where the exposed controllers actually are in the countries hit this week, and the single most important point from our October report is made flesh.

Belgium, the worst-hit country this week, carries the largest reachable refrigeration population of the group — and most of it is not Danfoss. Its exposed estate is dominated by Copeland XWEB controllers, 204 of them visible to the public scanners, against 108 Danfoss. Sweden's exposure, by contrast, is almost entirely Danfoss. Ireland's is a mix. The attacks did not follow a manufacturer; they followed the open front doors, whichever badge happened to be screwed to them.

This is not a coincidence of configuration. Each of these families has its own public, documented, already-fixed set of vulnerabilities. The Danfoss AK-SM and AK-SC controllers exploited in France were the subject of Claroty Team82's research and were patched well over a year ago. Copeland's E2 and E3 controllers — the estate that dominates Belgium's exposure — were the subject of Armis's "Frostbyte10" disclosure in 2025, ten flaws including one, CVE-2025-52545, that exposes password hashes, and all ten were fixed in a Copeland firmware update with a public advisory. The pattern that recurs across every brand is not a clever new exploit. It is a known flaw, a published fix that was never applied, and a management interface left answering to the open internet so that anyone can reach it to try.

Even France's first week hinted at this. One of the earliest chains to confirm an incident, Coopérative U, said it was not a Danfoss customer at all. The surface was never one vendor's problem. It was, and is, a whole industry's habit.

Why "unclear if the same method" is not reassuring

It is tempting to read the uncertainty about this week's method as a reason to wait. It is the opposite. Whether the Belgian attackers used the Copeland flaws, a weak or shared password, a contractor's remote-access account or something not yet disclosed, the precondition was the same in every case: a refrigeration controller reachable from the internet, running software whose weaknesses are already public and already fixed, watched by no one. The specific key used to open the door matters far less than the fact that the door was in a public street and had been left unlocked for a year.

That is why the honest version of "we don't yet know the method" is "it almost certainly did not need a sophisticated one." These are not zero-day attacks against hardened systems. They are the systematic harvesting of a population that chose, collectively and without meaning to, to leave its building controls on the open internet and its firmware out of date.

A note from our own sensors

Since we published the UK exposure report we have been running something of our own alongside the public data: seven deception sensors — honeypots — that present themselves to the internet as Danfoss refrigeration controllers, answering on the same ports and with the same web interface an attacker would expect to find. They hold no real plant behind them and control nothing. Their only job is to sit quietly and record who comes looking, and what they try.

They have not been quiet. Across the three weeks since we stood them up, all seven have drawn steady, deliberate interaction — not the background hum of indiscriminate scanning that every address on the internet receives, but repeated, targeted attention to the controller interface itself. And the great majority of that deliberate interaction has come from a small number of networks based in Serbia and Russia.

We are careful about what that does and does not mean. A source address is not an identity: the traffic can be routed through rented infrastructure, a virtual private network, a proxy or a machine someone else compromised first, and interacting with a honeypot is reconnaissance, not proof that the same hands turned up the defrost cycles in Belgium or France. So this points at no one in particular, and we are not naming a culprit. What it does do is narrow the field. It tells us where the deliberate interest in these specific controllers is concentrated, which is a more useful thing than a headline guess, and it is exactly the kind of signal that — set alongside the incident timing and the victim geography — helps the people who do attribution for a living draw their net tighter.

It is also a quiet vindication of the method. We said in October that these controllers were being hunted systematically rather than stumbled upon. Seven decoys in the right costume, drawing concentrated and repeated interest within days of going live, is what systematic hunting looks like from the other side of the glass.

Where that leaves the United Kingdom

In October we put a number on Britain's share of this: over eight hundred internet-exposed refrigeration and building-management controllers, across Danfoss, Carel, Copeland and others, and we were clear that eight hundred was a floor. The Grocer reported the finding to the trade under the headline "More than 800 UK supermarket fridges at heightened risk of hacking," and has since returned to the theme of the cybersecurity blind spot in UK retail. The warning was not obscure, and it was not ours alone to shout.

The refrigeration-specific slice of that exposure, measured the same way as the continental figures above, stands at around 210 controllers across the three main families today — 58 Danfoss, 78 Copeland and 74 Carel — and, as ever, that is what the public scanners can see, not the true total. It sits on consumer and rural broadband and on machine-to-machine cellular SIMs, the tell-tale of a controller a contractor put online for remote access without the retailer's IT team ever knowing it existed. The UK's estate is more Copeland and Carel than Danfoss, which changes the badge on the box and nothing else about the risk. The Channel and the North Sea are not firewalls, and the wave is now on both sides of them.

What to do this week

None of what follows needs fear to justify it, and none of it is expensive. The French controllers that stayed cold were simply the ones that had been patched and were not reachable from outside, and the French estate as a whole has just demonstrated that an operator who decides to close the door can do so in a fortnight. The five steps are the same ones we published in October. The only thing that has changed is that the wave is now moving, and the quiet countries are being visited in turn.

1. Find out what you have. Ask your refrigeration and building-services contractors for every controller on your estate, by make, model and firmware version. The common families are Danfoss AK-SM and AK-SC, Copeland E2, E3 and XWEB, Carel, and Trane Tracer. If the answer is "we will have to check," that is itself the finding.
2. Take the management interface off the public internet. A controller has no business answering the open internet, however convenient that is for an engineer on call. Remote access belongs behind a VPN or a managed gateway, limited to named engineers, with multi-factor authentication and a log of every session.
3. Patch to current firmware. The Danfoss flaws exploited in France and the Copeland "Frostbyte10" flaws were both fixed more than a year ago. Confirm with your contractor that every controller is on the current release, and make firmware a standing item in the maintenance contract rather than a one-off scramble after the next headline.
4. Put the contractor's access in your supplier due diligence. The quickest route into a refrigeration estate is the third party that manages it across many sites. Any provider holding remote access to your plant belongs on your supplier register, with the same questions you would ask of anyone else with a route into your operations: who can use it, how it is secured, and what they would notice if someone else did.
5. Watch the plant. A login from an unfamiliar address, a defrost command outside the scheduled window, or a temperature alarm with no recovery are all events a monitored environment raises within minutes. The French attack ran for roughly six hours before anyone noticed, because nobody was watching and the controllers were doing exactly as they were told.

How to check, and how we can help

If you want to know whether any of your own sites are among the exposed, we can tell you quickly and without touching a single device. Our IP Insights platform works entirely from data that is already public, so a check against your organisation's address ranges is passive, non-intrusive and produces a yes-or-no answer per site rather than a report you then have to act on blind. For clients of our managed SOC we already treat refrigeration and building controllers on the same footing as servers and laptops, because an attacker plainly does; for everyone else, a short conversation is enough to get started.

As in October, we are sharing the aggregate findings with the relevant national and sector bodies before pushing them widely, and we are publishing no addresses, device lists or anything else that would help an attacker. The purpose of this is to get controllers patched and taken off the open internet, not to map them for anyone else.

The cold chain runs on a quiet promise that the chilled aisle will be cold in the morning. Keeping that promise turns out to be a matter of knowing what you own, patching it, and not leaving its front door open to the street — and France has just shown the whole sector that it can be done in two weeks flat. That is a very ordinary kind of good morning. The only question left is whether the rest of us do it before the wave arrives, or after.

Sources and methodology

The UK and international exposure figures come from UK Cyber Defence's IP Insights platform alongside the public internet-scan service Shodan, which anyone can query. All figures are aggregate population counts from counting queries; at no point did we connect to, authenticate against or interact with any device, and nothing here identifies an individual site. Vendor counts use controller-specific signatures — the Danfoss AK-SM and AK-SC, Copeland XWEB and Carel pCOWeb web interfaces — rather than loose keyword matches, which is why they are conservative. Public-scanner counts are a lower bound and vary with each crawl; the France figures compare our October measurement with a 2 November query, and the direction of travel, a sharp fall, is clear even allowing for that variance.

The account of this week's attacks is drawn from The Register. The Danfoss vulnerabilities are from Claroty Team82's 2025 research; the Copeland "Frostbyte10" vulnerabilities, including CVE-2025-52545, are from Armis's 2025 disclosure and were fixed in a Copeland firmware update. UK trade coverage of our original exposure finding appeared in The Grocer, which has since examined the cybersecurity blind spot facing UK supermarkets.

UK Cyber Defence: Britain's exposed controllers — a UK exposure report · UK Cyber Defence: Cyberattack defrosts the fridges at hundreds of French supermarkets · Claroty Team82: Freeze the Controller, Defrost the Food · CVE-2025-41450 · CVE-2025-52545