On the night of 1 November, supermarket refrigeration failed across 7 countries at once: Belgium, Sweden, the Netherlands, Ireland, Estonia, Finland and Luxembourg. It was the second such wave in three weeks. The first hit France around 11 October.

We have not written about this before, and three waves in that is a gap worth closing properly rather than quickly.

Start with what is contested

The secondary reporting does not agree with itself, and anyone quoting a single number is picking one.

Store counts for the French wave run from up to 700 down to 150 to 200 Intermarche outlets plus nearly 100 Cooperative U stores. Reported temperatures run from 50 degrees Celsius to 80. Those are not small discrepancies, they are different events arithmetically, and no operator has published a reconciled figure.

The Pentagon is reported to be investigating suspected attacks on refrigeration at 6 military commissaries, with Fort Irwin and Fort Huachuca named. Two US grocery chains are reported to have taken systems offline. All of that is secondary too.

What nobody has published is an attribution. No actor has been named by anyone.

Now the part that is solid

In August, Claroty's Team82 published research on the Danfoss AK-SM 800A, a controller that supermarkets use to manage refrigeration remotely. The equipment named in the attack reporting is Danfoss. Team82's researcher Amir Zaltzman found three flaws, and one of them is the kind of thing that does not need a sophisticated attacker.

CVE-2025-41450, CVSS 8.2, is an authentication bypass through what the device calls a code of the day. Send a request to the controller's web endpoint with two particular attributes set, supply a precomputed password, and the device stops checking the configured administrator password. Instead it checks the supplied value against a password it generates from its own current date.

Team82 reverse engineered the function and reconstructed the generation algorithm. It has not published it. Its own description of why the mechanism exists is careful: "likely intended for vendor support or maintenance".

The other two are post-authentication. CVE-2025-41451, CVSS 7.6, is command injection through unsanitised email configuration fields, which gives remote code execution. CVE-2025-41452, CVSS 5.4, lets an authenticated user plant arbitrary web server directives through a configuration upload and crash the service.

Chain the first into the second and an unauthenticated attacker on the network path gets code execution on a box that controls the temperature of a shop's food.

All three were fixed in firmware R4.3.1 through coordinated disclosure.

The number that matters

A Censys scan found 2,765 AK-SM 800A units reachable from the public internet.

Team82 is careful about what that means, and so should we be: an exposure count does not establish that any of them are running vulnerable firmware. It establishes that they can be reached.

Separate reporting says some affected systems in the Netherlands were running default passwords on unsecured networks, which if true means an attacker did not need any of the above.

The attack path used in these waves is unconfirmed. Claroty says so itself. The research tells you what is possible with this equipment, not what happened in these shops.

Why this is different from a ransomware story

Nothing here is encrypted and nothing is stolen. The loss is food, and it is immediate and physical. Retailers are reported to have lost millions of euros of stock, and a defrost cycle in a freezer aisle is not something you recover by restoring a backup.

It also lands on a class of equipment that is maintained by remote access by design. The controllers are internet-facing because that is how the maintenance contractor checks the temperature without driving to the store. The feature and the exposure are the same thing.

What to do

  • Find every refrigeration, HVAC and building controller your organisation owns and check whether it answers from the internet. The scan that found 2,765 took one query.
  • Update Danfoss AK-SM 800A units to R4.3.1 or later. Trane and Copeland have shipped fixes for separate Team82 findings in the same class of product.
  • Change default credentials on every controller, and then verify the change on the device rather than in the inventory.
  • Put these behind a VPN or a jump host. Maintenance access is a reason to restrict the path, not a reason to publish it.
  • Alarm on temperature set-point changes and forced defrost commands as security events, not only as engineering ones.
  • Ask your facilities contractor, in writing, what remote access they hold and how it is authenticated.

What is not established

  • How the attackers got in, in either wave. Claroty says the path is unconfirmed.
  • Who they are. No vendor, police force or government has named anyone.
  • How many stores were affected. Published figures differ by a factor of three.
  • What temperatures were actually reached. Published figures differ by thirty degrees.
  • Whether the US commissary outages are the same campaign. They are described as suspected and under investigation.
  • Whether the 2,765 exposed controllers are unpatched. Exposure is not vulnerability.