Supermarket Refrigeration Cyberattack Hits Europe Again: The OT Security Blind Spot MSPs Can't Ignore

Attackers hijacked internet-facing Danfoss refrigeration controllers at supermarkets in Belgium and Sweden in early November 2026, forcing freezers to defrost and spoiling food, weeks after a nearly identical attack hit French supermarket chains in October 2026. The root cause in both waves: authentication bypass and command injection flaws in Danfoss AK-SM and EKC controller firmware, publicly tracked as CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452.

Key takeaways

• A second wave of supermarket refrigeration attacks hit Belgium and Sweden after France's October 2026 incident, exploiting the same class of Danfoss controller vulnerabilities.
• The flaws, tracked as CVE-2025-41450, -41451 and -41452, include a hidden daily password and command injection that let attackers bypass authentication and remotely control temperature setpoints.
• Researchers found thousands of Danfoss refrigeration systems directly exposed to the internet and discoverable through search engines, long before either attack wave.
• Every incident so far has been caught after physical damage (spoiled stock, defrosted freezers), not through monitoring that could have stopped it in progress.

What happened in the second wave of supermarket refrigeration attacks?

In early November 2026, supermarket operators in Belgium and Sweden reported freezer units climbing to roughly 55 degrees Celsius after attackers remotely manipulated Danfoss refrigeration controllers, according to Brandefense's incident writeup and reporting from Trending Topics. The pattern matched an earlier incident in France, where attackers pushed controllers to roughly 50 degrees Celsius and triggered automatic defrosting across hundreds of stores, as detailed by The Hacker News and Tom's Hardware.

Facilities Dive reported that the French incident alone caused tens of millions in food losses once spoiled inventory, logistics disruption and retail price impacts were tallied. Belgium and Sweden are still assessing totals, but the mechanism was identical: remote access to a refrigeration controller that was never supposed to be reachable from the public internet.

What vulnerability let attackers remotely control refrigeration controllers?

Danfoss AK-SM and EKC 202B refrigeration controllers are industrial devices that manage supermarket cooling, defrost cycles and temperature alarms, and are frequently connected to building management networks for remote monitoring. Claroty's Team82 research documented the underlying flaws that both attack waves exploited.

TechRadar described one of the flaws as a hidden, algorithmically generated daily password that let attackers authenticate without ever knowing an administrator's real credentials. Combined with a command injection bug, this gave attackers a path to full remote code execution on the controller itself, not just a dashboard login.

Tech Insider's scan data counted roughly 2,765 Danfoss systems directly exposed to the public internet, meaning attackers did not need to breach a corporate network first. They searched, found an exposed controller, and logged in. Danfoss's own advisory page lists the coordinated disclosure, which is the right reflex from the vendor, but patch availability does not retroactively secure a controller that has already been internet-facing for years.

Why is OT and BMS monitoring a blind spot for MSPs and MSSPs?

Because refrigeration controllers, HVAC units and other building management system (BMS) devices almost never sit inside the IT monitoring stack an MSP or MSSP already runs. A Cloud Security Alliance research note on the French incident makes the point directly: this was physical sabotage carried out through a device class that most security programs do not even inventory, let alone monitor.

That is the real story here, not just one vendor's firmware. Retail, hospitality and facilities clients run dozens of OT and IoT devices that sit outside EDR, outside identity controls, and outside the SIEM pipeline. An MSP watching endpoints and email can be fully current on patching and still miss a refrigeration controller quietly answering requests from anywhere on the internet.

The gap is not detection capability in the abstract. CISA's "Tale of Two SOCs" framing makes the same distinction for IT environments: a SOC that only alerts is not the same as a SOC that acts. Refrigeration controllers made that distinction physical. Food spoiled because nobody closed the loop between 'controller setpoint changed' and 'cut that session off.'

What should MSPs and MSSPs do about exposed OT and IoT devices right now?

Start with visibility, then move to containment capability, in that order. A few concrete steps:

• Inventory every OT and BMS device a client has internet-facing, including refrigeration, HVAC, access control panels and building sensors. If it has an IP address and nobody owns patching it, it is a liability.
• Pull these devices behind a VPN or firewalled segment. Direct internet exposure is the single factor every supermarket incident so far has shared, per Claroty's analysis.
• Apply Danfoss's published advisories and any available firmware updates without waiting for a renewal cycle.
• Treat OT telemetry as a monitored source, not a device to check quarterly. If a controller's setpoint or session activity can be logged, it belongs in the same detection pipeline as endpoints and identity.

This is also where partners doing co-managed SIEM work need to decide whether OT ingestion is in scope today, because clients in retail and facilities are going to start asking.

How does Vijilan close the detection-to-containment gap for OT?

Vijilan Security's Global SOC is built to act on an alert, not just forward it. For IT and identity, that means ThreatRespond™ and managed identity threat detection and response take containment action against suspicious sessions and compromised credentials in real time, rather than waiting for a client's internal team to triage a ticket at 2am.

The supermarket refrigeration cases are the OT version of the exact same problem. A controller's setpoint changed, a session authenticated from somewhere it should not have, and nobody closed that loop until a store manager found warm freezers in the morning. MSPs managing facilities, retail or hospitality clients need that same detection-to-containment pipeline extended to OT and IoT telemetry, not a separate silo that only gets reviewed after something breaks.

Vijilan's 24/7 SOC monitoring and ThreatHunt™ capability are built around that acting SOC model, and for partners delivering this under their own brand, white-label SOC services extend the same containment posture to clients without adding headcount. We never compete with our partners for their clients.

The next step for partners managing OT-adjacent clients

If your retail, hospitality or facilities clients run refrigeration, HVAC or building management systems with any remote access, treat that exposure with the same urgency as an exposed RDP port. Start with a security assessment to find what is internet-facing before an attacker does.