Overnight, refrigeration systems at supermarket chains in Belgium, Luxembourg, Sweden, Estonia, Ireland, the Netherlands and Finland began failing. BBC puts it at around 40 Delhaize stores in Belgium/Luxembourg; Danfoss itself confirms 17+ companies hit in the Netherlands; Finland's K Group and others report the same pattern. Unusually, companies are confirming the breach outright rather than guessing.
The context: this is a sequel, not a new event.
On Oct 11 the same trick already hit up to ~700 French stores (Intermarché, Netto, Carrefour, Monoprix), with losses in the tens of millions of euros. Temperatures inside cases climbed to 50–80°C, food was destroyed en masse, and in some stores equipment even caught fire.
How it works — and why it's so cheap to pull off:
The target is not the supermarket's IT, but the Danfoss AK-SM800 / AK-SC355 controllers — the boxes that manage the cooling equipment, often installed by third-party maintenance firms the stores don't even control.
These controllers run a web server exposed directly to the public internet. Researchers at Claroty (Team82) documented in August 2026 that thousands were reachable, with many using default-style credentials (username `admin`, password = current date).
The attackers didn't need zero-days. They simply forced a continuous defrost cycle — a legitimate built-in function run out of control. No alarms, no data theft, just heat and spoiled goods.
CERT-FR issued an alert (CERTFR-2026-ALE-012) after the first wave. Danfoss had a security advisory on file (DSA-2025-03-01).
The warning was public; the exposure stayed.
What this actually means:
First real OT attack on a national food supply chain. Until October, "critical infrastructure" cyber incidents were about grids, water, banks. Now a €300 controller decides whether a city's groceries survive the night.
The weakest link is a vendor nobody thought about. Supermarkets can't secure devices they don't own, installed by firms they outsource to. That's the real structural lesson here — same pattern as the Colonial Pipeline fuel-delivery failure.
Legacy hardware is the problem, not the actor. Older Danfoss units aren't even patchable. You can't fix by updating; you isolate or replace.
Attribution stays open, deliberately or not. No one has claimed it. That's honest to say: the modus operandi — low-cost, high-noise, economic damage rather than data theft — could fit many hands, from opportunistic groups to a signaling exercise. But the technical picture is unambiguous: known exposure, known workaround, still unaddressed at scale.
The uncomfortable takeaway: a second wave three weeks later, in more countries, means most operators still haven't pulled these boxes offline. If you run cold-chain equipment: check your Danfoss controllers tonight. Disconnect them from the internet. That's the whole playbook — and it's the reason this keeps repeating.