One Vulnerability, 700 Stores: How Europe's Freezer Hacks Exposed the Hidden Risk of Shared OT Infrastructure
On the night of October 11, 2026, an unknown threat actor compromised refrigeration control systems—specifically Danfoss AK-SM/AK-SC controllers and Copeland/Dixell XWEB systems—used by hundreds of French supermarkets, triggering extended defrost cycles that spoiled food, damaged equipment, and reportedly started fires across roughly 700 stores. The attack exploited internet-accessible OT devices running default credentials and unpatched legacy firmware, enabling the same technique to be replicated across borders into Belgium, Estonia, Germany, Ireland, Luxembourg, the Netherlands, Poland, Portugal, Spain, and Sweden within weeks. Total damages ran into the millions of euros and a near-simultaneous attack targeted French blood-bank refrigeration units, narrowly avoiding destruction of blood plasma. This incident underscores a maturing attacker playbook targeting shared OT infrastructure: when dozens of retailers deploy the same controller model, same remote-access pattern, and same default credentials, a single reconnaissance sweep yields hundreds of targets. CERT-FR's post-incident advisory and parallel EU grocery-sector warnings signal growing regulatory and sector-level pressure to treat food-cold-chain OT as critical infrastructure.
Kill Chain
