Cold Chain Under Attack: How Hackers Shut Down Refrigerators Across Europe's Supermarkets
Executive Summary
Executive Summary In November 2026, threat actors remotely exploited vulnerabilities in industrial refrigeration controllers—specifically Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB units—to manipulate temperature settings across more than 115 supermarket locations in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. Attackers activated defrost functions and raised freezer temperatures to as high as +50°C overnight, forcing emergency food disposal and the deployment of refrigerated trucks. Over a dozen retail chains were impacted, including Ahold Delhaize, Carrefour, Coop, ICA, and SuperValu. The attack vector was attributed to the same unpatched vulnerability exploited in a comparable campaign targeting French supermarkets the prior month, with refrigeration vendor Sabcobel identified as a common technology supplier across affected sites.
This incident follows a documented escalation in ICS/OT-targeted attacks against civilian critical infrastructure—specifically cold-chain and food-retail systems. As operational technology converges with internet-connected management platforms, the attack surface for remote exploitation expands dramatically, and the consequences move beyond data loss into tangible physical and economic harm.
Why This Matters Now
Why This Matters NowFood-retail OT environments were historically considered low-risk targets, but two coordinated refrigeration attacks across France and Europe within weeks confirm adversaries are actively cataloguing and exploiting ICS vulnerabilities at scale. With ENISA and sector regulators tightening NIS2 obligations for essential-service operators, organizations running internet-exposed industrial control systems face both immediate operational risk and imminent compliance liability if remote-access paths to OT assets remain unprotected.
Attack Path Analysis
Attack Path AnalysisAttackers exploited a known vulnerability in internet-exposed refrigeration controllers (Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB) used by Sabcobel-managed systems across multiple European supermarket chains, gaining direct remote access to OT/ICS control interfaces without requiring credential escalation. Once inside the management plane of the refrigeration systems, attackers issued legitimate control commands to alter temperature setpoints, activate defrost cycles, and shut down cooling units across 115+ store locations, causing widespread food spoilage and operational disruption with no data exfiltration observed.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionAttackers exploited a known vulnerability in internet-exposed Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers managed by Sabcobel. These OT/ICS management interfaces were directly reachable from the internet, likely lacking authentication controls or using default/weak credentials, consistent with the same vulnerability leveraged in the prior French supermarket attacks. The Cloud Native Security Fabric (CNSF) with inline enforcement and the Cloud Firewall (ACF) with URL/FQDN filtering could have blocked or flagged inbound exploit traffic targeting these exposed control endpoints before initial access was achieved.
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesExploitation of Remote Services
Internet Accessible Device
Unauthorized Command Message
Manipulation of Control
Theft of Operational Information
Device Restart/Shutdown
Loss of Availability
Exploit Public-Facing Application
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
NIS2 Directive (EU) 2022/0383 – Security of Network and Information Systems for Essential and Important Entities
Control ID: Article 21 – Cybersecurity Risk Management Measures
DORA (Digital Operational Resilience Act) – Regulation (EU) 2022/2554 – ICT Asset Security and Third-Party Risk Controls
Control ID: Article 9 – ICT Security Policies, Procedures, Protocols and Tools
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Network Segmentation and Least-Privilege Access for OT/ICS Environments
Control ID: Network Pillar – Macro and Micro Segmentation
ISO/IEC 27001:2022 – Network Security Controls and Vulnerability Management
Control ID: Annex A 8.20 – Networks Security / Annex A 8.7 – Protection Against Malware
GDPR – General Data Protection Regulation (EU) 2016/679 – Appropriate Technical and Organizational Security Measures
Control ID: Article 32 – Security of Processing / Article 33 – Notification of Personal Data Breach
NIST SP 800-82 Rev. 3 – Guide to OT Security – OT Incident Response and Remote Access Security
Control ID: SP 800-82r3 Section 5 – OT Risk Management / Control IR-4 Incident Handling
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Supermarkets
ICS/OT remote exploitation of Danfoss and Dixell refrigeration controllers across 115+ European stores caused mass food spoilage, exposing critical gaps in east-west segmentation and OT network visibility.
Food Production
Remote temperature manipulation of freezer and cooling systems threatens cold-chain integrity, with unencrypted OT traffic and absent zero-trust segmentation enabling attackers to trigger defrost cycles at scale.
Retail Industry
Multi-chain retail operators across six countries faced operational disruption as unpatched refrigeration controllers were remotely exploited, highlighting PCI and NIST.800-53.SC-7 compliance failures in OT environments.
Industrial Automation
Sabcobel-managed refrigeration controllers compromised via remote access demonstrate systemic ICS/OT vulnerabilities requiring inline IPS, egress policy enforcement, and multicloud visibility to prevent lateral movement across managed installations.
Sources
Sources- Hackers disrupt refrigeration systems at European supermarketshttps://www.bleepingcomputer.com/news/security/hackers-disrupt-refrigeration-systems-at-european-supermarkets/Verified
- Cyberattack shuts down refrigerators at French supermarketshttps://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/Verified
- CERTFR-2026-ALE-012 - Alerte relative aux attaques visant des systemes de refrigeration industrielshttps://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012Verified
- Ahold Delhaize: Cyberattack affects services across US and Europehttps://www.bleepingcomputer.com/news/security/ahold-delhaize-cyberattack-affects-services-across-us-and-europe/Verified
- ICS/OT Threat Landscape - CISA Industrial Control Systems Advisorieshttps://www.cisa.gov/resources-tools/resources/ics-advisoriesVerified
- Danfoss AK-SM 800A System Manager Product Security Informationhttps://www.danfoss.com/en/about-danfoss/cybersecurity/Verified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker's entire kill chain depended on flat, unsegmented OT network access to internet-exposed refrigeration controllers. By enforcing inline traffic controls, identity-scoped access policies, and east–west segmentation boundaries, the blast radius across 115+ store locations would likely have been significantly reduced.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline enforcement at the CNSF layer could likely constrain inbound exploit traffic reaching the exposed OT management interfaces, reducing the reachability of vulnerable refrigeration controller endpoints from untrusted internet sources before any exploit payload lands.
Control: Zero Trust Segmentation
Mitigation: Identity-based Zero Trust policy enforcement would likely constrain which principals could reach administrative functions of the refrigeration control plane, reducing the scope of what an attacker could immediately act on even after initial access was achieved.
Control: East-West Traffic Security
Mitigation: East–west enforcement policies between workload segments would likely constrain lateral propagation of commands across store environments, reducing the attacker's ability to pivot from one compromised controller to adjacent store systems at scale.
Control: Multicloud Visibility & Control
Mitigation: Traffic observability and anomaly detection across OT command flows would likely surface the unusual volume and timing of out-of-band control requests, reducing the window in which sustained attacker command activity could go undetected across multiple store environments.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement could likely constrain unauthorized outbound connections from OT controller environments, reducing the risk of attacker callback channels or data staging paths even where no exfiltration was observed in this specific incident.
Had earlier segmentation and enforcement controls been in place, the attacker's reach across store environments would likely have been constrained to a smaller subset of locations, reducing the operational and financial impact of the disruption rather than allowing simultaneous multi-country propagation.
Impact at a Glance
Affected Business Functions
- Cold Chain Inventory Management
- In-Store Retail Operations and Food Safety Compliance
- Point-of-Sale and Perishable Goods Availability
- Industrial Refrigeration Control Systems (ICS/OT)
Estimated downtime: 3 days
Estimated loss: $4,500,000
No confirmed exfiltration of customer PII or payment data was reported. The primary impact was physical and operational: attackers remotely manipulated temperature settings on freezer and refrigeration units, triggering defrost cycles and raising temperatures to as high as 50 degrees Celsius. This caused large-scale spoilage of perishable goods including frozen foods, meat, and temperature-sensitive products across more than 115 retail locations in six European countries. Financial losses are estimated based on food waste at scale across approximately 115 stores with affected refrigeration units, combined with emergency logistics costs such as refrigerated truck deployment, technician dispatch, and physical hardware modifications required beyond software patching. Indirect losses include reputational harm to multiple major retail chains and regulatory exposure under EU food safety directives.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Cloud Firewall (ACF) and CNSF inline enforcement in front of OT/ICS management interfaces to block inbound exploit attempts targeting internet-exposed refrigeration controllers such as Danfoss AK-SM/AK-SC and Dixell XWEB, preventing initial compromise before attackers reach the control plane.
- • Enforce Zero Trust Segmentation with identity-based microsegmentation across all refrigeration management networks to ensure that compromise of a single store or controller cannot propagate laterally to dozens of other locations via flat OT network topology.
- • Implement East-West Traffic Security controls between store-level OT environments and any shared Sabcobel or third-party vendor management infrastructure, enforcing workload-to-workload policies that restrict inter-store and inter-region control plane access.
- • Enable Multicloud Visibility & Control with anomaly detection and traffic baselining on refrigeration controller communications to detect and alert on abnormal command patterns, out-of-hours configuration changes, and repeated temperature setpoint modifications indicative of an active attack.
- • Apply Egress Security & Policy Enforcement with FQDN filtering on all OT network egress paths to prevent attacker-controlled C2 channels and unauthorized outbound connections from refrigeration management systems, ensuring that only approved vendor endpoints can communicate externally.
