As reported by SecurityAffairs, a new wave of cyberattacks targeting supermarket refrigeration systems has struck stores across Belgium, Luxembourg, Sweden, and Estonia, following a similar campaign in France last month. Attackers remotely triggered forced defrost cycles on Danfoss controllers, pushing temperatures as high as 80°C and destroying fresh and frozen inventory. Some incidents reportedly sparked fires.

Security Impact: As reported by SecurityAffairs, a new wave of cyberattacks targeting supermarket refrigeration systems has struck stores across Belgium, Luxembourg, Sweden, and Estonia, following a similar campaign in France last month.

This Is a Physical Safety Problem, Not Just a Data Problem

What makes these attacks significant is not their sophistication — it's their simplicity. The attackers are not deploying zero-days or advanced malware. They are accessing building automation controllers that were never designed with adversarial security in mind and invoking a legitimate function — forced defrost — in a destructive configuration. This is the OT equivalent of finding an open SSH port with default credentials.

The pattern is now repeating across multiple countries and multiple supermarket chains, which strongly suggests one of three scenarios: a common vulnerability or misconfiguration across Danfoss deployments, a shared managed service provider with compromised access, or publicly available attack tooling targeting this specific equipment. Given the geographic spread and the consistency of the attack method, Shield53 assesses that a shared systemic exposure — likely default credentials, exposed management interfaces, or a compromised integrator — is the most probable root cause.

Who Is at Risk

This Is a Physical Safety Problem, Not Just a Data Problem
Retail food chains using networked refrigeration controllers, particularly Danfoss AK and EKC series devices exposed to the internet or accessible via shared management platforms
Managed service providers and HVAC/refrigeration integrators who maintain remote access to multiple customer environments through shared credentials or jump hosts
Any organization with building automation systems (BAS), industrial control systems (ICS), or IoT controllers that have internet-facing management interfaces
Cold chain logistics operators including warehouses, distribution centers, and pharmaceutical storage facilities
The attack surface here is not a web application or a database — it is a physical system that can destroy inventory, trigger fires, and potentially endanger human safety. This is the convergence of cybersecurity and physical security that most organizations are unprepared for.

Why This Matters Beyond Supermarkets

The food retail sector is the canary in the coal mine. The same class of networked controllers — often from the same handful of vendors — governs HVAC systems in hospitals, data centers, manufacturing plants, and commercial buildings. If attackers can remotely set a supermarket freezer to 50°C overnight, they can theoretically manipulate climate control in a data center or a pharmaceutical storage facility. The attack pattern is transferable.

These incidents also expose a governance gap. In most organizations, refrigeration and building automation systems are managed by facilities teams or third-party contractors, not IT or security teams. There is frequently no visibility into what controllers are deployed, whether they are internet-accessible, or what credentials protect them. The network segmentation between IT and OT/BAS environments is often nonexistent in retail settings.

Shield53 Recommendations

  • Inventory immediately: Identify all networked refrigeration, HVAC, and building automation controllers across your environment. Danfoss devices should be prioritized given confirmed targeting. Check Shodan and Censys for your IP ranges to identify exposed management interfaces.
  • Isolate OT networks: Refrigeration controllers should not be reachable from the public internet or from the corporate IT network. Implement VLAN segmentation and firewall rules restricting access to authorized management workstations only.
  • Audit credentials: Force credential resets on all refrigeration controllers and management platforms. Eliminate default passwords. Implement unique credentials per device. Where possible, require MFA on central management platforms.
  • Review third-party access: Audit all remote access paths used by refrigeration integrators and maintenance contractors. Replace persistent VPN or remote desktop access with just-in-time access models with session logging.
  • Deploy temperature anomaly monitoring: Configure alerts for temperature excursions outside expected operational ranges, particularly during overnight hours. Treat unexplained defrost cycle activations as potential security events, not just equipment malfunctions.
  • Engage facilities leadership: Ensure your facilities team and any contracted integrators are part of your incident response plan. Security teams need visibility into systems they have historically not managed.
  • Check for vendor advisories: Monitor for security advisories from Danfoss and other refrigeration controller vendors. If firmware updates or security guidance are issued, prioritize patching during the next maintenance window.

This campaign is almost certainly not over. The attackers have demonstrated a repeatable, low-complexity method that causes measurable economic damage. Until the underlying exposure — whether it is a product vulnerability, a widespread misconfiguration, or a compromised supply chain — is identified and remediated at scale, additional attacks should be expected. Organizations with networked refrigeration or building automation systems should treat this as an active threat requiring immediate defensive action, not a future risk to assess.