Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In the early hours of November 2, 2026, threat actors remotely manipulated industrial refrigeration controllers across supermarkets in Belgium, Sweden, Estonia, Ireland, the Netherlands, Finland, Portugal, and Italy. Attackers exploited internet-exposed Danfoss AK-SM and AK-SC series controllers—many running outdated firmware with default credentials and no VPN protection—switching units into defrost mode or raising setpoints to 50°C. Dozens of stores across chains including Delhaize, Carrefour, ICA, Coop, and SuperValu were forced to discard or pull chilled and frozen goods, with one Belgian butcher estimating €15,000 in losses. The attack mirrored a nearly identical campaign against hundreds of French supermarkets three weeks prior.

This second wave confirms that ICS/OT attacks on retail cold-chain infrastructure are becoming a repeatable, scalable playbook. Attackers require no sophisticated zero-day—only internet-exposed legacy controllers with default passwords. As regulators across the EU accelerate NIS2 enforcement and critical-infrastructure owners expand OT connectivity, the window for unprotected industrial devices to be weaponized for economic disruption is widening rapidly.

Why This Matters Now

Two coordinated waves within three weeks demonstrate that exposed OT devices in retail food infrastructure are now active targets, not theoretical risks. With NIS2 Directive enforcement live across the EU and auditors scrutinizing OT network segmentation, organizations still relying on direct internet-connected industrial controllers without VPN, firmware updates, or credential hygiene face both operational disruption and regulatory liability immediately.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers exploited internet-exposed Danfoss industrial refrigeration controllers running outdated firmware and default or weak passwords, with no VPN or secure network boundary enforcing access. Many affected stores had not applied security guidance issued after the prior French attack three weeks earlier.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker's entire campaign depended on direct internet reachability to OT management interfaces and the absence of any network segmentation between refrigeration controllers. By enforcing identity-aware segmentation and restricting lateral paths across store-level networks, CNSF would likely reduce both the initial reachability of these devices and the blast radius across multi-store, multi-country deployments.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Direct internet reachability to OT management interfaces would likely be constrained by CNSF policy enforcement, reducing the exposed attack surface that made unauthenticated scanning and direct device access trivially achievable across dozens of stores.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation could likely reduce the scope of administrative access available to any single authenticated session by constraining which workloads and management paths are reachable, even when device-level credentials are compromised or default.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls would likely constrain an attacker's ability to pivot freely between refrigeration controllers within and across store networks, reducing the number of devices reachable from any single compromised entry point.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized visibility and control over traffic flows to and from OT management interfaces could likely surface anomalous remote command sessions, and policy enforcement may reduce the set of permitted source addresses or identities allowed to issue commands through those interfaces.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress policy enforcement would likely constrain the set of permitted outbound destinations from OT device segments, reducing the ability of any configuration data or telemetry to reach unauthorized external endpoints even if an attacker attempted opportunistic exfiltration.

Impact (Mitigations)

Had prior CNSF segmentation and access controls been in place, the blast radius of physical disruption would likely have been reduced — limiting attacker reach to fewer devices per location and constraining cross-store and cross-country impact rather than allowing unrestricted access across a flat, internet-exposed OT environment.

Impact at a Glance

Affected Business Functions

  • Cold Chain Integrity and Refrigeration Management (ICS/OT)
  • Perishable Food Inventory and Supply Chain Operations
  • Retail Store Food Safety Compliance
  • Third-Party Refrigeration Contractor Remote Monitoring Services
Operational Disruption

Estimated downtime: 2 days

Financial Impact

Estimated loss: $500,000

Data Exposure

No customer PII or payment data was reported as exposed. The attack was purely operational in nature, targeting ICS/OT refrigeration control systems. The confirmed impact includes destruction of perishable food inventory across more than 80 retail locations spanning Belgium, Luxembourg, Sweden, Ireland, Estonia, Netherlands, Finland, Portugal, and Italy. At least one Belgian butcher reported approximately 15,000 EUR in destroyed meat inventory. Extrapolating across all confirmed affected chains (Delhaize several dozen stores, Carrefour 15, Intermarche 10-15, SuperValu 13, ICA, Coop 6-7, Selver 1, Netherlands 17 businesses, Italy 4, Finland several, Portugal 7), aggregate spoiled perishable goods losses are estimated in the range of 400,000 to 600,000 USD. Additional costs include emergency restocking, logistics disruption, regulatory food safety reporting obligations, and reputational damage to affected retail brands. End-of-life Danfoss AK-SM 800 and AK-SC 355 controllers were specifically noted as primary attack surfaces due to absence of security patches.

Recommended Actions

  • • Eliminate direct internet exposure of OT/ICS devices using Zero Trust Segmentation and Cloud Firewall controls — Danfoss and Copeland controllers should never be reachable on public IPs; deploy identity-based policy enforcement and microsegmentation to restrict all inbound access to refrigeration management interfaces to authorized VPN or private network paths only, consistent with ZTMM.Network and NIST.800-53.SC-7.
  • • Enforce egress security and FQDN-based outbound policy on store networks — Apply Egress Security and Policy Enforcement controls to prevent unauthorized outbound connections from OT network segments, ensuring refrigeration controllers can only communicate with approved contractor management endpoints and blocking any unexpected external destinations that may indicate active compromise or C2 activity.
  • • Deploy East-West Traffic Security to contain lateral movement within store and contractor network segments — Implement workload-to-workload segmentation between IT and OT zones within each retail location so that a compromised refrigeration controller cannot be used as a pivot point to reach other store systems or neighboring devices across shared contractor network infrastructure.
  • • Activate Multicloud Visibility and Anomaly Detection across OT management traffic — Use centralized traffic observability and baselining to detect anomalous command sequences issued to refrigeration controllers, such as sudden defrost mode activation outside scheduled windows or temperature setpoint changes exceeding normal thresholds, enabling rapid alerting and incident response before physical damage occurs.
  • • Apply Inline IPS (Suricata) inspection on traffic to and from exposed OT management interfaces — Where OT devices must retain remote management connectivity, route traffic through inline intrusion prevention capable of identifying known exploit patterns targeting Danfoss AK-SM, AK-SC, and Copeland xweb interfaces, and block malicious payloads before they reach the controller, aligned with NIST.800-53.SI-4 and PCI.4.0.6.4.1.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image