In the autumn of 2026, attackers broke into the controllers behind supermarket fridges and freezers across Europe and raised their temperatures. One wave came in October, mostly in France, and a second came at the start of November and reached further. The second wave also hit French blood banks. The fridges themselves were not the interesting part. Both waves got in through web-based management interfaces that could be reached from the public internet, and some of those devices had run without security updates for years. This article compares the two waves using three published accounts, sets out what is known about who is responsible, and turns the incident into practices anyone running networked equipment can apply.
Two waves, one way in
October: supermarkets overnight
The Wikipedia article on the attack dates the first wave to the night of 11 October 2026. Attackers reached the refrigeration controllers of up to 700 French supermarkets, including stores of Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc, and switched the units into a continuous defrost cycle with the food still inside. The article reports that this set off no alarms and that few staff were on site at that hour. After six hours many units had reached 50°C, and one store in Normandy reported 80°C. At some stores equipment melted or caught fire, and sprinklers caused water damage.
The accounts give different scales. The Associated Press report carried by KLTV describes the October attack as hitting hundreds of supermarkets and independent stores in France, Belgium and the Netherlands. Wikipedia puts the damage at "tens of millions of euros" in its text, while its infobox gives an estimate of more than €10 million. The AP also reports that Ahold Delhaize, one of the chains hit in October, expects the attack to cut its fourth-quarter sales by up to €250 million and its operating income by up to €100 million.
November: further afield, and a blood bank that noticed
On 2 November, a similar attack hit supermarkets in more countries. Wikipedia's list includes Belgium, Luxembourg, the Netherlands, Sweden, Estonia, Ireland, Portugal and Germany. The same day, three cold-storage sites for plasma run by the French Blood Establishment (EFS) were targeted. According to the AP, the EFS said "temperature and defrosting thresholds were raised to extremely high levels". Le Canard Enchaîné, which broke the story, reported that the attackers tried to move freezers kept at −30°C to as high as 110°C. The result was different this time. The EFS monitoring systems spotted the change quickly, staff moved or secured the plasma, and "no blood products or samples were compromised."
The blood banks' refrigeration came from a supplier, Coolworld. Coolworld said the vulnerability "relates to a component from a third-party supplier and was outside Coolworld's direct control," and that only a limited number of units were affected. None of the three pages says which component that was.
| October wave | November wave | |
|---|---|---|
| Date | Night of 11 October 2026 | 2 November 2026 |
| Main targets | French supermarkets (AP adds Belgium and the Netherlands) | Supermarkets in many European countries, plus three EFS plasma sites |
| Method | Controllers forced into continuous defrost | Temperature and defrost thresholds raised |
| Detection | No alarms, few staff present | EFS monitoring caught it in time |
| Outcome | Spoiled stock, some fires and water damage | No blood products lost |
A weakness on record since 2025
The most useful question for administrators is how long this opening had been there. Going by Wikipedia's account, investigators named Danfoss AK‑SM800 and AK‑SC355 controllers as the main point of entry. Copeland XWEB and Dixell XWEB controllers were also affected. Each Danfoss unit ran a web server that could be reached from the internet. Many accepted the username "admin" with the current date as the password, through a hidden "code of the day" function that bypassed the real password.
The dates matter:
- 2016: the AK‑SC355 reached end of life and stopped getting updates.
- May 2021: the AK‑SM800 reached end of life as well. Danfoss had advised customers to replace both models.
- 2025: Claroty's Team82 found several vulnerabilities in Danfoss control systems, including the date-as-password bypass.
- 24 March 2025: Danfoss disclosed Claroty's findings.
- August 2025: Danfoss released software 4.3.1 for the newer AK‑SM800A series, fixing the flaws. AK‑SM800A units that had installed it were not affected.
- 11 October 2026: the first wave.
That means the flaw had been public for about nineteen months before the first wave, and a fix for the supported models had been out for about fourteen. Some of the exploited hardware had gone without updates for five to ten years. None of the pages says how long individual controllers had been reachable from the internet. Wikipedia does give part of the reason they stayed that way: French supermarkets commonly outsource refrigeration to third parties and cannot manage its security themselves. TechCrunch adds that security researchers have warned these web-based controllers can be hacked remotely, and that some affected Danfoss models no longer get security fixes.
What the waves share, and where they differ
Both waves used the same kind of entry point: a management interface open to the internet that controls physical equipment. Both used legitimate controller functions, defrost and temperature thresholds, to cause harm, so nothing needed to be physically broken. Both reached many sites at once, which is what happens when the same device and the same weak login are installed everywhere.
The differences are reach, timing and detection. The second wave covered more countries and moved from retail into healthcare. The bigger lesson is in the outcomes. In October the controllers were told to do something harmful and nothing raised the alarm. In November the EFS had monitoring that noticed the temperature change and people who acted on it. Nobody claims the EFS controllers were safer. The difference was a check that sat outside the device under attack.
There may also be an earlier episode. Wikipedia and TechCrunch both report that freezers at United States military base commissaries warmed up and spoiled food in August 2026, and that U.S. officials are investigating whether they were hacked. That case has not been confirmed as part of the same campaign.
Who is being blamed, and on what evidence
On 9 November, French foreign minister Jean-Noël Barrot publicly blamed Iran. TechCrunch quotes him: "I am able to confirm that responsibility for this act lies with the Islamic Revolutionary Guard Corps." He called the attack "the first large-scale act of sabotage on our national territory." France summoned Iran's ambassador, said it would seek European sanctions, and handed the matter to the French justice system. Iran's consulate in New York did not respond to TechCrunch's request for comment.
The evidence behind this has not been made public, at least not in these pages. They give no technical indicators, malware or infrastructure linking the attacks to the IRGC. TechCrunch adds two pieces of context. It places the attribution in a run of destructive attacks attributed to Iran in 2026, including attacks on U.S. water providers and disruption at medical device maker Stryker, which the U.S. government linked to pro-Iranian hacktivists working for Tehran. It also reports that U.S. officials have linked the freezer attacks to Iran, while the U.S. intelligence community has made no formal or public attribution.
The pages do not agree on this. When it was fetched, Wikipedia's article still listed the perpetrator as "Unknown" and was flagged as needing an update. It cites Ken Munro of Pen Test Partners saying the exploit was easy enough that the culprits could have been "kids messing around," while also noting that states such as Iran and Russia have the capability. For defenders, the more lasting point is the one Munro implies: when access is this easy, it doesn't take a state to get in.
How it could have been prevented
No single control would have stopped this. Several ordinary ones would each have broken the chain:
- Keep management interfaces off the public internet. A controller that can only be reached over a VPN or a private network cannot be reached by an internet-wide scan, whatever its login looks like.
- Retire or isolate end-of-life devices. A device that stopped getting updates in 2016 needs replacing. Until it is replaced, it should sit behind something that is still maintained.
- Apply fixes that already exist. According to Wikipedia, the AK‑SM800A units running release 4.3.1 were not affected.
- Remove default and predictable credentials. A login that accepts "admin" and the date is effectively no login.
- Monitor from outside the device. Independent temperature sensing with alerts to someone on call is what separated the EFS outcome from the supermarkets'.
- Make suppliers part of your security. If a contractor runs the equipment, the contract should spell out how remote access is provided, who patches, and who gets alerted.
The UK National Cyber Security Centre's Richard Horne, as cited by Wikipedia, warned that this was "the beginning," with AI now able to find and abuse flaws in old technology. Whether or not that comes true, old interfaces that can be reached from the internet are cheap targets.
Practices to adopt now
Start by finding what answers on your public addresses, scanning from a machine outside your own network:
# Run from an external host; replace with your own public range
nmap -Pn -sV --top-ports 1000 203.0.113.0/28
Any web login that belongs to a building system, a controller or an appliance should not appear in that output. Put such devices on their own network segment and allow management traffic only from a VPN. Here is a minimal nftables example for a Linux gateway, where wg0 is a WireGuard interface and 192.168.50.0/24 is the equipment segment:
table inet filter {
chain forward {
type filter hook forward priority 0; policy drop;
ct state established,related accept
iifname "wg0" ip saddr 10.8.0.0/24 ip daddr 192.168.50.0/24 tcp dport { 80, 443 } accept
}
}
Note
Default-drop forwarding means a device on the equipment segment can only be reached through the paths you allow. Add rules for the equipment's own outbound needs, such as time sync or vendor updates, deliberately rather than by default.
Then keep an inventory of every networked device with its model, firmware version and support end date, and review it on a schedule. Send alerts that matter, such as temperature, failed logins and configuration changes, to a person who will see them at night and on weekends. Watch the logs of the hosts that sit in front of equipment, and block addresses that repeatedly try to log in.
We make a tool for that last step. On the Linux servers you run, Strongthium Guard is a firewall that reads their logs and shuts out attackers it finds there. It cannot patch a fridge controller. It can harden the Linux gateway or jump host that should be the only way to reach one.
Warning
If you look after equipment that a supplier installed, ask them directly whether its management interface can be reached from the internet and when it last got an update. In these incidents the answers to those two questions were the whole story.Note
From Strongthium Labs. The freezer attacks came down to login pages that anyone on the internet could reach and keep trying, and on the Linux gateways and servers that should be the only way to reach such equipment, this firewall narrows that exposure and turns away the hosts that probe it. Strongthium Guard: a firewall that bans attackers by itself.
Sources
- France blames Iran for mass-hacks targeting freezers in grocery stores and blood banks - TechCrunch
- Cyberattack on blood bank freezers thwarted, follows supermarket fridge hacks - The Associated Press, via KLTV
- 2026 French supermarket refrigerator hack - Wikipedia
First published on Strongthium Lab Notes.
Top comments (0)