In mid-October, and then again at the beginning of November 2026, a series of cyberattacks hit various commercial refrigeration systems, operated by supermarkets and food retailers all over Europe. These attacks involved unauthorised access to remotely managed refrigeration controllers that as it turns out were accessible from the wider Internet – and in some cases, had some glaring vulnerabilities.
The combination of the above issues allowed attackers to remotely manipulate temperature settings on the freezers’ control panels, which reportedly allowed unauthorised changes to settings across the full spectrum of available temperature ranges between -27°C and 50°C.
As per multiple reports, the main targets were controllers supplied by Danfoss, apparently widely used across the EU in commercial refrigeration installations. Contrary to some early & erroneous publications, Danfoss does not manufacture the actual fridge / freezer equipment – only some specific controller related hardware and the remote management software for these devices.
Danfoss was involved in the wider response from the early stages and it transpires that this situation was entirely avoidable. How so? Well, apparently the equipment that was affected was badly outdated and no longer receiving relevant security updates. Here’s what Danfoss had to say when contacted by Cooling Post, one of the media outlets from within the refrigeration industry:
“Danfoss revealed that the majority of units affected were legacy products or current products running outdated firmware. Specifically, those affected were its AK-SM800, which was officially declared end-of-life in 2021 and the AK-SC355 systems, which were phased out in 2016. These no longer receive software or security updates.”
Furthermore, a Danfoss publication from 2025 pointed to two previous, very similar attacks from 2022 – and literally recommended a migration to newer, more secure solutions:
Based on the previous Danfoss security advisories DSA-2025-03-01, DSA-2025-08-01 and DSA-2023-08-01, here we have a detailed list of identified vulnerabilities, starting with the most severe reported in 2025:
CVE-2025-41450 – Authentication bypass
This vulnerability affects Danfoss AK-SM 8xxA controllers running software versions earlier than 4.2. It involves improper authentication controls that permit unauthorised access to information through the web management interface.
CVE-2025-41451 – Command injection
This vulnerability affects versions earlier than 4.3.1. Improper sanitisation of alarm-to-email configuration fields permits an authenticated attacker to inject operating-system commands. Successful exploitation can potentially provide remote code execution on the controller.
CVE-2025-41452 – Configuration manipulation
This vulnerability also affects versions earlier than 4.3.1. It permits an authenticated attacker to manipulate web-interface configuration settings, potentially causing a denial of service.
Obviously, the worst case scenario is the kind of a CVE triple-jackpot, where you have a combination of all of the above. A broken authentication weakness can facilitate unauthorised access, while command injection can potentially provide control over the environment.
At the same time, it should be noted that public reporting has not conclusively established that the October and November attacks exploited these specific CVEs. It is likely, but no publicly available information confirms this, at least at the time of this writing.
Other possible attack vectors – the usual ones – include weak passwords, exposed admin panels and unsupported / obsolete equipment.
The remaining three CVEs listed above that possibly also relate to this attack date back to 2023 – so they are even more well known.
If you were to map the supposed trajectory of this attack to the cyber kill chain methodology that I covered here some years ago, it would probably look something like this:
Reconnaissance: Internet-connected refrigeration control interfaces were identified using network scanning and other discovery techniques (Shodan, Censys, manual or AI-enabled mapping, etc).
Initial access: attackers obtained unauthorised access through exposed management interfaces, weak or default credentials, or one or more known authentication vulnerabilities listed above.
Privilege and configuration access: self-explanatory: once authenticated, attackers accessed refrigeration configuration panels.
Exploitation: unlawful tampering with the temperature settings took place.
Operational impact: everything that followed and what was reported on – frozen products going to waste, store closures, the media bandwagon and so on.
The impact in Ireland
As reported by the RTE, 13 SuperValu stores in Ireland were directly impacted by the cyberattack. Subsequent reporting stated that the incidents had been remediated.
So I had a quick look in Shodan to see was this really the case.
Below are three distinct examples (a couple of more similar ones are still available online, at the time of writing) of currently exposed Danfoss control panels, still externally accessible from the Internet, as seen through Shodan on the 3rd & 4th November 2026 (so two days after the reported cyber attack).
Sensitive details were redacted from the screenshots.
One would imagine that the incident remediation plan should include disabling external access and placing these control panels behind a corporate VPN – but apparently not, at least not in every case.
You would only hope that the least that was done (and what really should have been done during the initial setup and installation) was resetting default login credentials and enabling some kind of 2 Factor Authentication. Any lack of those two cybersecurity hardening steps is a common and a rather unsophisticated exploitation angle when it comes to various IoT devices.
And the lessons are nearly always learned the hard way. Any subsequent attacks (if successful) on the exposed admin panels below are unlikely to come to the media attention, especially since this story has now passed the 24h news cycle and the attention has moved elsewhere.
What next - practical steps & ideas
Some of the recommended measures applicable in this case include basic common sense solutions that you will hear ad nauseam from any half-decent cybersecurity professional. Especially when it comes to the Internet Of Things devices. Yes, these points are boring, repetitive, tedious but also effective – especially if applied together.
Firmware and software updates: the ABP mantra, which stands for Always Be Patching. Always stay on top of applying software updates and security fixes to protect your systems from known vulnerabilities.
Network isolation: Remove your IoT management interfaces from the Internet! A random person on another continent has no business poking around your admin console for whatever IoT device you are running. If for some reason you can’t, the very least you can do is offer some security by obscurity by making the admin panel harder to find.
Secure remote access: Implement and enforce VPN connectivity, multi-factor authentication and appropriately restrict administrator access. Corporate IoT devices should not be accessible without prior authentication to the corporate network.
Credentials management: Replace default passwords with strong, unique credentials. Do not allow password sharing or account sharing, because that deprives you of proper visibility into your event history. Each user account needs to have a proper audit trail. Finally, separate your admin accounts from your regular user accounts and assign privileges accordingly – the least privilege principle applies.
Asset discovery: Identify all connected IoT controllers, including those that are contractor-managed. Identify any legacy equipment and earmark it for actioning, either through hardening, segmentation or removal offline. Know your possible attack surface and know what your assets are that you are trying to protect.
- Monitoring: Introduce independent monitoring and alerting systems, ideally operating outside the potentially compromise-prone controller layer.
- Incident response: Review configuration changes, maintenance schedules, authentication logs and network activity for evidence of unauthorised access.
- Proactively minimise the attack surface: there’s a reason why IoT devices in general are often referred to as “online asbestos”. You don’t want any of your devices that you perhaps forgot about to become enslaved as part of a botnet and used for nefarious purposes.
