European Supermarket Refrigeration Remote Controllers Hacked; TWCERT Relays CERT-FR and International Warnings Urging Review of Internet-Connected OT

Incident Overview

In a cybersecurity news brief on November 4, 2026, TWCERT/CC noted that since October 2026, refrigeration and cold storage systems at European supermarkets have suffered a series of cyberattacks in which attackers remotely altered temperature and defrost settings, causing widespread food spoilage; the attacks began in France before spreading in early November to Belgium, the Netherlands, Sweden, Ireland, and other countries ^[1].

Official Warnings

France's CERT-FR alert CERTFR-2026-ALE-012 reported numerous compromises of Danfoss AK-SM and AK-SC as well as Copeland xweb and Dixell xweb refrigeration remote controllers, emphasizing that exposing management interfaces directly to the internet violates security best practices ^[2].

As relayed by TWCERT, France's Finance Minister stated that roughly 700 of the country's 10,000 supermarkets were affected; the Dutch NCSC noted that attackers exploited weak and default passwords to gain remote access, and Danfoss stated that affected devices were largely discontinued legacy products still using default credentials ^[1].

Mitigation Recommendations

Consolidated recommendations from CERT-FR and TWCERT include: removing unnecessary internet exposure for controllers and management interfaces; using VPNs for required remote maintenance; changing default credentials and updating firmware per vendor guidance; planning replacement of unpatchable EOL devices; and, if compromised, disconnecting external network access before resetting in accordance with vendor procedures, noting that a factory reset alone is insufficient to prevent re-compromise ^[1][2].