Danfoss Fridge Controllers Were Hit Twice in Three Weeks. No One Has Claimed It.

News Analysis · 3 November 2026 · Europe, Cybersecurity

The Danfoss controller cyberattack that sent French supermarket freezers to 50°C on 12 October 2026 returned on 2 November, hitting stores in at least nine European countries, and no one has claimed either attack. Danfoss, the Danish manufacturer, says most of the units hit in France were legacy models that no longer receive updates. The European Commission calls the attacks deliberate. Reuters could not establish who is behind the second wave or whether it connects to the first.

In France, retailers including Intermarché, Coopérative U, E.Leclerc and Carrefour confirmed the attack on 12 October, and more than 350 stores were affected. Temperatures rose as high as 50°C and fires broke out at several stores. The Paris prosecutor’s office opened an investigation. On 2 November retailers in Belgium, Luxembourg, Sweden, Ireland, Estonia, Finland, the Netherlands, Italy and Portugal reported cyberattacks or IT disruptions, according to company statements and wire reports.

Danfoss controllers were the common thread, but not the only product hit

France’s national cybersecurity agency, ANSSI, said through its CERT-FR team on 12 October that it knew of numerous compromises of Danfoss AK-SM and AK-SC controllers, and on 13 October it added Copeland and Dixell xweb consoles. It said exposing a management interface to the internet is contrary to good practice and advised removing internet exposure. Danfoss told the press that most affected units were old AK-SM 800 and AK-SC 355 models that no longer receive software updates.

On 2 November, Sweden’s ICA said its affected stores were connected to an external refrigeration control system from Danfoss, the supplier named in France, and Coop said Danfoss was among its suppliers. Reuters reported that at least some of the units hit used Danfoss technology. In Belgium, the chief executive of refrigeration firm Sabcobel, which operates Delhaize’s systems, said the units’ evaporators were switched to defrost mode. Sabcobel had begun securing its installations after the French attack, but some systems had not yet been upgraded.

The flaw was public before the first attack, but no source says it was used

The security firm Claroty published research on Danfoss AK-SM 800A controllers on 9 August 2026. It described a hidden “code-of-the-day” login that can bypass authentication, a command-injection flaw allowing remote code execution after login, and a configuration flaw that can crash the interface. It counted 2,765 AK-SM 800A interfaces reachable from the public internet. Danfoss fixed the flaws in firmware R4.3.1, and had published an advisory on the authentication flaw in March 2025.

None of this shows the flaw was the way in. CERT-FR’s alert does not state the method used, and Danfoss’s statement, as reported, does not say a published vulnerability was exploited. A source in the French prime minister’s office told Reuters that ANSSI had identified a vulnerability in Danfoss software, without saying which.

Ownership of the problem is blurred. Coopérative U’s chief executive said its stores buy through refrigeration contractors, not directly from Danfoss. In Portugal, the group running seven Intermarché stores said the attack appeared to have targeted an external service provider that manages refrigeration. TES’s reading is that a store which outsources refrigeration also outsources patching, so exposure can persist with nobody inside the retailer able to see it.

The EU says the attacks were deliberate, but no one has been attributed

Agriculture Commissioner Christophe Hansen said the attacks are a deliberate attempt to disrupt the food supply chain and undermine consumers’ confidence. No group has claimed either wave, and Reuters could not establish who was behind the second or whether the two are linked. Reuters also noted heightened concern among European authorities about hybrid threats to infrastructure since Russia’s 2022 invasion of Ukraine.

Other cases offer a contrast. The FBI attributed the 2021 attack on meatpacker JBS to the Russia-linked REvil group within days. A pro-Russian group, NoName057(16), claimed an earlier denial-of-service attack on France’s La Poste in December 2025. In this case, the latest reporting shows no claim and no government attribution.

French trade press reports that ANSSI’s director general, Vincent Strubel, described the attacks as sabotage in a public alert, and that ANSSI’s threat overview, published in March 2026, already described mass, opportunistic exploitation of exposed devices.

In the Danfoss controller cyberattack, “deliberate” describes intent to cause damage. It does not identify an actor or a sponsor. Internet-exposed legacy controllers and a documented flaw fit opportunistic exploitation as readily as a directed campaign, and the public evidence cannot yet separate the two. That is why attribution matters.

Losses are store by store, and an unconfirmed US case predates France

Reported losses are local. Carrefour said 15 of its 700 Belgian stores were affected, Coop 7 of its 800 Swedish stores, and Musgrave 13 SuperValu stores in Ireland. Intermarché’s chief executive said French losses could reach millions of euros, and Axios reported that some stores lost more than €130,000.

Reuters reported on 29 October, citing four officials, that the Pentagon is investigating freezer failures at at least six military commissaries in late August as a suspected cyberattack. The Defense Criminal Investigative Service is leading a joint investigation, and the Army’s Criminal Investigation Division said its cyber office is working with French law enforcement. Reuters could not establish whether the commissaries used Danfoss controllers or another brand, and the Pentagon has not confirmed that hackers caused the failures. If a link is shown, the problem predates 12 October.

What to watch after the second wave of the Danfoss controller cyberattack

Three questions will decide how this episode is read: who is behind it, how the attackers got in, and how many controllers remain exposed. The first two sit with investigators in France and the United States. The third can be measured, and Claroty’s August count of 2,765 exposed AK-SM 800A interfaces is the baseline.

Will anyone claim or attribute the Danfoss controller cyberattack?

No group has claimed either wave, and Reuters could not link them. A claim, or an attribution by French prosecutors or the US inquiry, would separate crime from statecraft. Until then, “deliberate” remains the EU’s description of intent and not a finding on who.

Will exposed controllers be taken offline?

CERT-FR advises removing internet exposure from affected units and, for Danfoss equipment, updating firmware, setting the security level to strict and changing default passwords. Whether any EU body turns that advice into a requirement is the next test.

Will the US and European cases be tied together?

Army investigators are working with French law enforcement. If the commissary failures share a cause with the French attack, the first known incident would date from late August, not October. Reuters could not establish which equipment the commissaries used.

Why maintenance may matter more than attribution for the next attack

The public evidence points to old, internet-reachable controllers with a documented flaw and no clear owner for updates. Danfoss says it had long urged customers to update firmware and move off legacy systems. If investigators confirm that route, the lesson for retailers is contractual: who patches, who audits exposure, who pays. If they find a directed campaign, the response moves from IT departments to ministries.

TES has followed the same pattern of unseen civilian systems becoming strategic exposure in its pieces on submarine cable geopolitics and on supply chains as strategy for defence, and has covered a separate exploited-vulnerability case in the OpenAI and Hugging Face hack. Attribution would settle who is behind the Danfoss controller cyberattack. It would not patch a single controller, and the watch list is short: a claim or attribution, the entry method in CERT-FR’s next update, and the number of controllers still reachable from the internet.

Source note: statements and alerts from France’s CERT-FR and ANSSI, the European Commission and the companies named, research from Claroty Team82 and Danfoss advisories, and reporting by major news agencies. Reported losses and the US commissary inquiry are unconfirmed in cause.