Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In October and November 2026, an unknown threat actor executed two successive waves of cyberattacks against Internet-connected commercial refrigeration controllers at hundreds of European supermarkets across France, Belgium, Germany, the Netherlands, Portugal, Poland, Spain, Luxembourg, Estonia, Ireland, Sweden, and Finland. Attackers exploited unpatched firmware vulnerabilities and default credentials in controllers manufactured by Danfoss, Dixell, and Copeland—forcing systems into defrost mode at 50°C (122°F) and triggering widespread food spoilage. The first wave impacted over 700 stores; the second struck dozens more. No group has claimed responsibility, and European authorities are actively investigating.

These incidents underscore a worsening pattern of ICS/OT sabotage targeting Internet-exposed operational technology with poor security hygiene. As threat actors increasingly leverage automated scanning, credential stuffing, and known CVEs against legacy OT devices, the attack surface extends far beyond retail—threatening pharmaceutical cold storage, food distribution, and industrial temperature-control systems globally.

Why This Matters Now

Two attack waves in under three weeks against European cold-chain infrastructure—affecting over 700 stores—signal that automated OT sabotage campaigns are now operational at scale. With unpatched Danfoss and Copeland CVEs publicly disclosed in August 2026 and default credentials still prevalent, adversaries face almost no barrier to entry. Regulatory scrutiny under NIS2 and the expanding pharmaceutical and food-safety implications make immediate OT network segmentation, remote-access controls, and firmware patching urgent priorities for any organization operating temperature-sensitive critical infrastructure.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Researchers believe attackers used automated Internet scanning to fingerprint Danfoss, Dixell, and Copeland controllers exposed online, then exploited known firmware CVEs and default or shared credentials to gain unauthorized access and trigger defrost mode remotely.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker exploited flat, internet-exposed OT network architectures to reach hundreds of refrigeration controllers with no meaningful segmentation in place. By enforcing identity-aware access boundaries and east-west segmentation, CNSF would likely have reduced the attacker's reachability and constrained the blast radius across distributed retail sites.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Enforcing a Zero Trust perimeter around OT supervisory interfaces would likely reduce their direct reachability from arbitrary internet sources, limiting the attacker's ability to scan and connect to exposed controllers at scale without passing through controlled access boundaries.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation could reduce the practical scope of elevated access by enforcing identity-scoped boundaries around controller management functions, so that even a session authenticated with valid credentials would likely face constraints on which commands or interfaces it could reach within the broader OT environment.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement would likely constrain the attacker's ability to propagate laterally across store sites at scale, as segmentation policies could reduce reachability between controller endpoints that have no legitimate operational reason to communicate directly with one another.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized visibility and control over traffic flows reaching OT management interfaces could help surface anomalous command patterns across the distributed controller fleet, and policy enforcement may reduce the reachability of those interfaces to unsanctioned external sources that would be expected to issue operational commands.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security policies could reduce the pathways available for any opportunistic outbound data movement from OT controller environments, limiting what configuration or operational data could be transmitted to external destinations even if the attacker attempted to extract it alongside their disruptive commands.

Impact (Mitigations)

Had earlier segmentation and access controls meaningfully reduced attacker reachability, the number of controller endpoints exposed to simultaneous command issuance would likely have been smaller, reducing the scale of food spoilage and limiting the geographic blast radius of the disruption across hundreds of distributed retail sites.

Impact at a Glance

Affected Business Functions

  • Cold Chain Inventory Management and Food Safety Compliance
  • Retail Refrigeration and Temperature-Controlled Storage Operations
  • Supply Chain Logistics and Perishable Goods Distribution
  • Remote OT/ICS Infrastructure Management and Monitoring
Operational Disruption

Estimated downtime: 5 days

Financial Impact

Estimated loss: $47,000,000

Data Exposure

No confirmed exfiltration of customer PII or financial records was reported. The primary impact was physical and operational: spoilage of temperature-sensitive perishable inventory including fresh produce, dairy, meat, and frozen goods across hundreds of retail locations in multiple European countries. Indirect exposure includes proprietary refrigeration configuration data, controller credentials, and network topology details potentially harvested by the threat actor during reconnaissance scanning. Secondary risk sectors identified include pharmaceutical cold-chain storage where compromise could affect temperature-sensitive medicines and vaccines, representing a high-consequence data and safety exposure if similar attacks propagate beyond retail grocery.

Recommended Actions

  • • Apply Zero Trust Segmentation to OT/ICS environments by isolating refrigeration controllers and supervisory systems into identity-based microsegmented zones, preventing automated lateral propagation across distributed store locations even when a single controller is compromised.
  • • Enforce East-West Traffic Security controls between OT network segments to detect and block unauthorized workload-to-workload and controller-to-controller communication patterns that enabled simultaneous multi-site command execution via shared credentials.
  • • Deploy Multicloud Visibility & Control capabilities with centralized traffic observability across hybrid OT/IT environments to detect anomalous interactions such as mass simultaneous controller access, repeated automated login attempts, and suspicious defrost command sequences before physical impact occurs.
  • • Implement Egress Security & Policy Enforcement with FQDN filtering and outbound traffic controls on all internet-facing OT assets to restrict which external sources can reach supervisory controllers, eliminating direct internet exposure that enabled the initial scanning and exploitation phase.
  • • Leverage Cloud Native Security Fabric (CNSF) inline enforcement and real-time inspection capabilities to establish distributed policy enforcement at the network edge of OT environments, enabling automated detection and blocking of exploit traffic targeting known CVEs in refrigeration controller firmware before commands reach physical systems.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image