Threat Level Description

IthacaLabs has maintained the Threat Level (High) adding a new observation:

An attack is highly likely. Addressing the broad nature of the threat in order to reach an acceptable risk level, requires additional and sustainable protective security measures combined with specific business and geographical vulnerabilities and judgments.

Description

We have observed a new wave of cyberattacks targeting the internet-connected refrigeration systems of supermarkets and food businesses across Europe.

Attackers remotely take over the management controllers of commercial fridges and freezers, switch them to defrost and raise temperatures as high as 50°C, spoiling stock overnight. Supermarkets and food shops in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland were hit this week, following a similar attack on around 700 supermarkets in France in October. Food suppliers in the United Kingdom have since reported similar incidents.

The attacks target refrigeration management interfaces exposed to the internet, including end-of-life models that no longer receive security fixes. Researchers had previously disclosed vulnerabilities in widely used Danfoss controllers and found thousands of interfaces publicly accessible, although it is not confirmed whether these flaws were used. No group has claimed responsibility.

Retailers, food producers, cold-storage operators and any organization using remotely managed refrigeration systems may be at elevated risk of exposure to this threat. Immediate action is recommended to identify internet-facing controllers and remove them from direct internet access.

Our Advisory and Managed Services, including our Security Operations and Technology Resilience lines, can help safeguard your organization against such threats.

Through proactive monitoring, threat detection, and incident response, our services are designed to keep your systems secure, resilient, and prepared for evolving cyber risks. We advise all organizations to remain vigilant and regularly review their cybersecurity postures.

Affected Products:

• Danfoss AK-SM series controllers
• Danfoss AK-SC series controllers
• Copeland XWEB supervisors
• Dixell XWEB supervisors

Recommendation(s):

• Remove internet exposure from these controllers and from any other refrigeration units on a public IP address, including links through 4G or cellular modems.
• Check insurance terms before cutting the data link to your refrigeration provider.
• Review the full controller configuration, in particular defrost schedules.
• Restore remote access only through a secure VPN or protected network, with firewall filtering of provider IP addresses only as a stopgap.
• On supported units, update firmware (R4.3.1 or later for Danfoss AK-SM 8xxA), set the Danfoss security level to Strict and change default passwords.
• Keep end-of-life units off the internet, as they receive no security fixes and a factory reset alone will not stop them being compromised again.
• If a Danfoss controller is compromised, remove its internet exposure, restart it or restore factory settings, and reconfigure it.
• Ensure incident response teams are prepared to disconnect affected controllers from the internet and restore correct settings.

You should understand the importance of applying security updates with urgency, regardless of organizational size. Implementing an effective patch management strategy, enabling comprehensive event logging, and actively monitoring security events are critical to protecting business-critical assets. A comprehensive risk management approach should include regular penetration testing, at least annually and after significant system changes, to ensure continued compliance with security best practices and industry regulations.

Threat Level Description:

Threat Level: High – An attack is highly likely. Addressing the broad nature of the threat in order to reach an acceptable risk level, requires additional and sustainable protective security measures combined with specific business and geographical vulnerabilities and judgments.

References:

CERTFR-2026-ALE-012 – Security incident targeting remote controllers of refrigeration installations (CERT-FR)

Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers (Claroty Team82)

Shop freezers in seven European countries hit by cyber-attack (BBC News)

IthacaLabs Incident Response and Threat Intelligence Services