Cyberattacks on refrigeration systems have compromised food storage and forced several Swedish supermarkets to close temporarily. According to Tgcom24, between the evening of November 1 and the morning of November 2, Ica and Coop stores were hit. Attackers remotely changed the temperatures set for fridges and freezers, raising them up to 70°C. Thousands of products were stored inside.
Citing local newspapers, the outlet reports damage in the hundreds of thousands of crowns and closures lasting several hours. Some cash registers reportedly also became unusable, but the link between this disruption and the attack has not been clarified.
From Sweden to Other European Supermarkets
Similar incidents were reported at the same time in Belgium and Luxembourg, while other reports concern Ireland and Estonia. For the Estonian case, Tgcom24 cites the public broadcaster ERR: intruders reportedly reached the control system of a large chain and set a freezer to 50°C.
In Belgium, dozens of Spar, Delhaize and Carrefour stores are reported to be involved. In France, investigations have reconstructed the compromise of about 700 refrigeration units at Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix. The figure refers to equipment, not supermarkets.
The common thread is remote control of refrigeration. Unauthorized access to temperature management can disrupt the cold chain, with consequences for goods and sales continuity. However, similarities between the incidents are not enough to attribute them to a single group.
Which Systems Are Involved and How Much Internet Exposure Matters
For the French attacks, Claroty reports Intermarché's statement that the attackers reached Danfoss systems and changed temperatures up to 50°C. The chain said 150 stores were affected.
In its October 13 update, Claroty also reports that a CERT-FR advisory widened the scope to Copeland XWEB and Dixell XWEB, in addition to the Danfoss AK-SM and AK-SC series, citing numerous compromises. These are platforms used to monitor and manage refrigeration and air-conditioning systems. For the Swedish incidents, the Tgcom24 report does not identify models or versions.
Exposure of administration consoles is a concrete risk. In its research on the Danfoss AK-SM 800A, Team82 had identified 2,765 publicly accessible devices via Censys. This measures the reachable attack surface, not the number of attack victims. It is not established how many of the systems counted were later updated or removed from direct exposure.
Known CVEs and Measures for Operators
Team82's research on Danfoss controllers describes web interface vulnerabilities, but it does not show that they were used in the supermarket attacks. Claroty notes that the access method used in the French incidents was not yet known when it published its report.
Two documented flaws affect the Danfoss AK-SM8xxA series in versions prior to 4.3.1:
- CVE-2025-41451 allows, after authentication, remote code execution through command injection in the email alert configuration fields.
- CVE-2025-41452 lets an authenticated user modify the web interface configuration, with possible service disruption. The CVSS v3 score is 5.4: it reflects technical severity, not evidence of exploitation.
According to Team82, Danfoss fixed both in release R4.3.1. The research also describes a hidden mechanism called "code-of-the-day" that could be used to bypass normal authentication. This finding does not identify the technique used in the reported cases.
For those who run these systems, the priority indicated by CERT-FR, as reported by Claroty, is to remove direct exposure to the Internet. Claroty also recommends inventorying devices, limiting administration to trusted networks or VPN-protected access, and segmenting operational networks. On the Danfoss AK-SM8xxA units affected by the two CVEs, the update to R4.3.1 fixes those specific vulnerabilities and should be combined with protection of remote access.
