Supermarket Freezer Cyberattacks: What Happened in Europe?

The AK-SM 800A is a system manager, not simply a thermometer attached to one freezer. Claroty describes a platform that gathers information from field devices and lets operators configure refrigeration through a web interface. Remote service is useful because a technician can investigate a problem without visiting every installation. The same concentration of control makes access permissions consequential.

The important analytical distinction is between reading a temperature and authorizing a change. A maintenance service may need both, while a reporting dashboard may need only the first. Treating them as the same connection gives a reporting convenience the authority of an operational control. An exposure review should therefore ask what the reachable service can do, not merely whether it has a login screen.

CERT-FR names Danfoss AK-SM and AK-SC series as well as Copeland and Dixell XWEB. It would be misleading to describe all affected installations as old AK-SM 800A units, or to assume that every controller with a familiar brand name has the same software, support status or weaknesses. The model and firmware must be checked for the actual installation.

The strongest version of the open-door argument concerns a preventable access boundary: refrigeration administration should not be available indiscriminately from the internet. The weaker version claims to know the precise exploit from the outcome alone. A changed setpoint tells us something consequential happened; it does not reveal whether the route was a stolen credential, a default password, vulnerable software or another access path.

Claroty’s research identifies authentication and command-execution weaknesses and discusses firmware remediation. Its incident commentary explicitly says the French access method was not yet known. Those two statements can both be true. There were known problems worth fixing, while the specific breach still required investigation. This dossier therefore does not claim that a zero-day was used, or that zero-days have been ruled out in every case.

Similarly, saying a maintenance link used 4G does not establish why it was reachable or weakly protected. The relevant questions are routing, authentication, permitted sources and administrative privilege. A mobile connection is not a substitute for an access policy; changing the network generation would not, by itself, demonstrate that a service is restricted.

The October Reuters figure was a broad Shodan observation of Danfoss interfaces. Censys’ November 2 analysis instead reports just over 1,000 exposed StoreView instances worldwide. These are differently dated observations with different detection scopes, not two measurements of a fixed list of hacked stores. Neither should be converted into a victim count.

Censys also explains how it inferred firmware builds using the HTTP Last-Modified header. That is useful external evidence, but an inference from a service response is not a forensic inspection of the appliance. Its report includes apparently patched systems among the exposed hosts. Being reachable and being susceptible to a particular patched vulnerability are separate properties.

A defensible exposure figure needs a collection date, a product signature and a definition of the counting unit. Without those, a large number can create false certainty. This dossier uses the figures to explain the management surface, not to assert that every visible host was vulnerable, attacked or linked to one retailer.

CERT-FR warns that a factory reset alone is insufficient for end-of-life equipment that remains exposed and vulnerable: it can be compromised again. Its guidance includes removing internet exposure, checking configuration, using protected access and applying the manufacturer’s security measures. Recovery has to address the route back in, not just the visible symptom.

For an owner deciding what to fund, that distinction matters. Replacing stock restores availability temporarily; replacing or isolating an unsupported control path addresses a recurring condition. The broader defense guide explains how patching, restricted access and accountable recovery fit together. It does not turn the supermarket events into a claim about what every hacker thinks or does.

Reuters reported no public claim of responsibility or ransom demand in its October account, and its November report could not establish the perpetrator or a link between the waves. Those are limits of the reporting, not proof that nobody sent a private demand. A destructive result can be consistent with several motives.

The European Commission’s concern about disruption to the food supply chain describes the seriousness of the effect. It is not a forensic attribution. Neither the suggestion of casual interference nor a state-backed explanation should be promoted to a finding without evidence connecting an actor to the activity.

What would strengthen the account? An official incident finding identifying an entry path; a supplier notice mapping that path to affected models; or a supported attribution with a stated evidentiary basis. Until then, a helpful update should change the claim and its evidence label together, rather than adding an unnamed suspect to the headline.

November 3, 2026: first public-source dossier prepared. It separates the October France reporting from the November European wave, dates the 4,500-interface observation, and leaves exploit and actor attribution unresolved. Future revisions should identify the new evidence rather than silently treating an earlier hypothesis as a confirmed fact.