Overnight into Monday, refrigeration controllers at dozens of supermarkets in Belgium, Ireland, Luxembourg and Sweden were pushed into defrost and held at temperatures far above their set points. Ahold Delhaize and Colruyt confirmed incidents. Belgian media counted roughly 40 Delhaize stores, 15 Carrefour outlets and five Spar locations, plus the butcher De Laet en Van Haver, with about €100,000 of stock thrown away. Swedish ICA stores reported problems the same night. Euronews cited Belgian reports of units driven as high as 70°C; other outlets described peaks nearer 50°C. Either way, the food was gone.

This is the second wave in three weeks, and it is not a new vulnerability. Claroty's Team82 published research in August on Danfoss refrigeration controllers — the AK-SM 800A management platform and the older AK-SM 800 and AK-SC 355 units — showing that internet-exposed interfaces let an attacker rewrite set points and defrost schedules. Danfoss issued advisories, including CVE-2025-41451, and said the units hit hardest in France were legacy models that no longer receive security updates. On 12 October, hundreds of Intermarché and Coopérative U stores lost stock the same way.

Stephan Moelans, chief executive of the refrigeration installer Sabcobel, told Belga that the Belgian wave used exactly the same mechanism as the French one, and was blunt about the remedy: a software update alone is not enough. Some sites need physical modification, and the practical fix most of his customers adopted after October is to stop exposing the controllers to the open internet and manage them over a secured connection instead. Sabcobel knew of about twenty affected units among the hundreds it manages.

That detail is the story. The controllers are fifteen-year assets bolted to buildings; the network design around them is often a decade younger and owned by nobody in particular. The manufacturer sells hardware, the installer sells a service contract, the retailer buys uptime, and the integrator who punched the port-forward through the store firewall left years ago. Nobody's job is the attack surface.

The consequences are no longer theoretical. Food spoilage is the mild version. The same class of device sits in distribution centres and cold-chain logistics, and TechCrunch reports that US Department of Defense officials are looking at whether freezer units on military bases were touched by Iran-linked intrusions. Water utilities have already been through this: the vulnerability was known, the assets were unowned, and the incident arrived anyway.

What to watch: whether Delhaize and Colruyt disclose how the attackers got in — an exposed management port or stolen credentials — because that decides whether the fix is a firewall rule or a fleet-wide credential rotation. Whether the same actors move from ruining stock to damaging compressors, which is a different insurance conversation. And whether retailers' insurers start asking about unattended operational technology before renewing policies, which is the only pressure that has ever moved this problem faster than an incident does.

Sources