Three weeks' warning: Europe's exposed refrigeration controllers after the French attacks

Half of the world's visible controllers were still online when the second wave came

Summary

Overnight on 1 to 2 November, three weeks after several hundred French supermarkets lost their refrigeration to a cyberattack, the same thing happened again across Europe. More than a hundred stores in Belgium, Luxembourg, the Netherlands, Sweden, Estonia, Ireland and Portugal had refrigeration controllers forced into defrost, with further reports from Finland, Italy and Germany and a small number of UK organisations. In October we had published a country-by-country map of internet-exposed Danfoss AK-SM 800A controllers. We went back to it to ask whether it showed where the second wave would land. For the big estates it did: three of the five largest outside France were hit. For the small ones it did not, and the gaps are explained by other controller families that the attackers could see as easily as we can. Three weeks after France, half of the world's visible controllers were still online, and the countries about to be hit had moved no faster than anyone else. By 4 November the exploitable remainder in the attacked countries was down to about two hundred addresses, almost all of them reachable only through their carrier.

1. What happened since 14 October

The quiet period between the two waves was not quiet. Lupovis, which runs decoy Danfoss controllers, saw login attempts against them from 20 to 30 October, peaking on 26 October. Most used the factory-default credentials that Danfoss documents publicly, and the traffic came from hosting providers associated with Russian criminal infrastructure. Every attempt against the decoys was rejected, which says the probing was real but not what it found elsewhere.

Overnight on 1 to 2 November, controllers were switched to defrost at Carrefour (15 of more than 700 Belgian stores), Delhaize (several dozen stores in Belgium and four in Luxembourg), Colruyt (five franchised Spar shops), one IKEA store in Mons, Intermarché (15 of 153 Belgian stores and seven in Portugal), ICA (23 Swedish stores, eight of which discarded stock), Coop Sweden (a handful), SuperValu (13 Irish stores), a Selver store in Estonia, at least 17 Dutch businesses, mostly butchers and small grocers, and a few K Group stores in Finland. A Coop-branded operator in Sicily reported several stores to Italy's national cybersecurity agency. Some units reached 50 °C. The NCSC said on 3 November that it was "aware of a small number of UK organisations that may be affected by this incident" and that it was supporting them, and its chief executive told the BBC it had worked through the night to alert potentially affected organisations; reporting points to meat processors rather than supermarkets. Danfoss had told customers on 13 October to disconnect controllers from the internet and reconnect only through a secure network. It says most did and "a small number did not", that the Dutch victims were running default passwords on unsecured networks, and that most affected units were the older AK-SM 800 and AK-SC 355 rather than the 800A. Copeland has confirmed that some of its XWEB controllers were targeted through previously disclosed vulnerabilities (CISA advisory ICSA-26-057-10), and a Belgian victim has named the XWEB family. Sabcobel, which runs refrigeration for Delhaize in Belgium, says a software update alone does not close the weakness and the equipment needs physical modification.

The European Commission has convened its inter-institutional cyber task force, the Belgian federal prosecutor has opened an investigation, CISA says it is "actively monitoring and assessing" the activity, and CERT-FR's alert CERTFR-2026-ALE-012, revised on 16 October, remains the reference guidance. No group has claimed either wave and no authority has named a perpetrator or said whether the two are connected. Nothing in this post speaks to who the attackers are. Our evidence is about what they could see from the internet, and what was still there when they looked.

2. What the map got right, and what it missed

Figure 1 ranks every country by estimated exposed AK-SM 800A controllers in the 30 days to 13 October. France led with about 2,300, then Belgium with about 250, the US and Canada together and Poland with about 195 each, Portugal with about 140 and the Netherlands with about 110. Seventy-four countries had at least one. The table adds what we learned since: the other controller families counted for the month to 4 November, who was hit, and what share of each country's regularly scanned controllers was still visible in the four days around the second wave.

Three things stand out.

Right: the big estates. Belgium, Portugal and the Netherlands were three of the five largest exposed Danfoss estates in the world after France, and all three were hit. The US, Canada and Poland, the other two, have reported nothing, and nor have Spain and Romania, which together with Poland hold about 375 exposed controllers. Portugal's position has not been reported elsewhere, and it is easy to miss: counted by unique addresses Portugal would rank second with 544, but 401 of those were seen only once or twice in the month, almost all in one carrier's dynamic business pools, so the address count overstates its estate about four times. Belgium's 329 addresses are stable and its two measures agree.

Missed: the small estates, which belong to other families. Estonia had three visible Danfoss addresses and Ireland one, yet both had confirmed incidents, and an Estonian supplier has said the units attacked there were older Danfoss models. Counting the other families explains the pattern. CERT-FR added the Copeland and Dixell XWEB family to its alert on 13 October, and Copeland has said its controllers were hit on 2 November. We built fingerprints for that family, for Copeland's Site Supervisor and for CAREL's pCOWeb card, and counted them for the month to 4 November. Worldwide they are together larger than the Danfoss estate: about 2,050 XWEB EVO units, 2,100 of the newer XWEB PRO generation, 950 CAREL pCOWeb and 780 Site Supervisor, the last almost entirely in North America. For the countries hit on 2 November and the UK:

Belgium's XWEB estate is as large as its Danfoss one and the Netherlands' is larger. Estonia's exposure is CAREL, Ireland's is XWEB, and neither showed on the Danfoss map. Sweden, by contrast, has nothing but Danfoss. The attackers had more than one map to work from, and in every hit country at least one of the maps showed a target.

Worldwide the two main families come to about 10,000 exposed controller addresses, 4,500 Danfoss and 5,500 XWEB, and the XWEB estate is older than it looks. Where a unit's build date is visible, about 1,800 are the end-of-life 300D and 500D line with no fix available; 155 are XWEB PRO units below the 1.13 release of February 2026 that closed 23 vulnerabilities including an authentication bypass; and about 680 are on current 2026 builds. The remaining 2,800 are EVO or system units whose pages are dynamic, so their age cannot be read from outside. The same maps show comparable estates in several countries that have reported nothing so far, in southern, central and eastern Europe and in South America; Italy, where a handful of Sicilian stores have already reported incidents, holds about a thousand XWEB units, a hundred times its Danfoss count. The national CERTs for those countries have the lists.

Invisible: the legacy units. Danfoss has said that most of the victims were the older AK-SM 800 and AK-SC 355. Neither has a known fingerprint. No scanner index we checked carries their name in a page title, banner or search term, and nobody has published a sample unit to derive one from. A full listing of every service on 2,500 addresses already known to host a modern controller in the attacked countries found no co-located legacy unit, and the proprietary Danfoss port, when it answered, always belonged to an 800A. A site running only a legacy unit would not appear in that sample at all. Every number in this post is therefore a floor. The attackers chose their targets partly from devices we cannot count, and the map that showed where the second wave would land covers an unknown fraction of the attack surface, possibly the smaller part.

3. Has Europe learned from France?

We re-ran our scan on 4 November with the same three signals as in October, and checked every address from the 13 October baseline against three later windows: the three days after the CERT-FR alert (11 to 14 October), the fortnight between the waves (15 to 31 October), and the four days around the second wave (1 to 4 November). The population is the 2,743 addresses our scanner visited regularly in the baseline month, nine or more times, so that an address missing from a window means the controller was not reachable, not that our scanner did not call.

France has largely gone dark. Of 1,676 regularly scanned French controllers, 70 percent were still visible three days after the alert, 26 percent at some point in the second half of October, and 12 percent in the four days around 2 November. The two largest named French estates, half gone on 14 October, were entirely gone by the end of the month, and so were every multi-controller site and both of the DMZ "gateways" still up on 14 October. Censys, counting live hosts on single days, reports France falling from 1,825 StoreView hosts to 220 by 2 November, the same 88 percent. Whether those controllers were secured or simply unplugged is not visible from outside.

The rest of the world reacted, slowly. Outside France, 95 percent of regularly scanned controllers were still visible on 14 October, 77 percent were seen at least once between 15 and 31 October, and 55 percent in the four days around the second wave. Three weeks after France, roughly half of the world's visible estate was still visible.

The countries about to be hit moved no faster than anyone else. Taken together, the seven countries hit on 2 November had 46 percent of their regularly scanned controllers visible in the four days around the attack; the countries with no reported attacks had 59 percent. Belgium went into 2 November with between 40 and 70 percent of its October estate still exposed, the Netherlands and Sweden with between 55 and 90 percent. Countries that have reported no attacks, among them Denmark, Romania and the United States, reduced at the same pace, and Poland, which has reported nothing, cut its exposure harder than any hit country. There is no sign that the countries about to be hit read the French alert as being about them.

Half of what was exposed was unpatched. Every AK-SM 800A login page carries a build date, and the exposed population shows only two dozen of them. The newest, 31 July 2025, is the day before Danfoss published the R4.3.1 advisory that closes the three Claroty vulnerabilities; the March 2025 build matches R4.2, which closes the authentication bypass but not the command injection; and the newer StoreView Web interface appears only on 2026 builds. Reading the build date as the firmware version:

Nearly a third of the world's exposed units are on builds from December 2022 and May 2023. Censys and Forescout both put the share below R4.3.1 at about 80 percent in mid-October; our window runs later, and the controllers that went dark after the French alert were disproportionately the old ones, so what is still online in November is more likely to be patched. Censys's figure of 41 percent patched among the French remainder on 2 November matches our 39 percent, and the ACDS Security Research Group's independent reading of the same build date, counting unique addresses since 4 October, gives the same worldwide split: 54 percent below R4.2, 10 percent at R4.2 to R4.3.0 and 35 percent patched. Patched does not mean safe: a controller on R4.3.1 is still reachable from the internet, and still opens to anyone holding its daily password.

What was actually still there on 4 November. Our scan data can only say when a controller was last seen. The ACDS Security Research Group took every address in France, the second-wave countries and the UK whose firmware class is exploitable (AK-SM 800A below R4.3.1, or XWEB PRO below 1.13) and, between 15:00 and 15:40 UTC on 4 November, made one unauthenticated connection to each: a TLS handshake and a request for the front page, matched against the same fingerprints. Of 2,316 address-and-port pairs our scanner had not seen for two days or more, 154 still answered with the fingerprint, 111 refused and 2,046 were silent, and a slow retry of 120 of the silent ones found none alive. Of 176 pairs seen in the previous two days, 132 answered, 75 percent. The check sees devices that exist, and the silence in our scan data is real. Across the nine countries, 202 addresses were confirmed live on exploitable firmware, about two thirds of them in France and the rest spread across the eight others; the per-country figures are with the national CERTs. Four in five were below R4.2, open to the unauthenticated daily-password bypass. Units already on R4.3.1 were not checked, so this is the exploitable remainder, not everything still online. Of the 202, 16 can be tied to a named organisation with any confidence, 48 carry only a weak label such as a netblock name, and 138 are plain carrier lines, most of them with a handful of national carriers, where only the carrier or the national CERT can identify the operator.

Reading the windows. A controller seen once in the fortnight window may have been removed the next day, so that column is an upper bound on exposure at the end of October. About 5 percent of live controllers are missed in any four-day window, judged by the October control, so the last column is a slight undercount. That window also includes two days after the attack, so part of the fall in Belgium, the Netherlands and Sweden is reaction to their own incident rather than preparation. Exposure on the night of the attack lies between the last two columns. In every case "not seen" means not reachable by our scanner; secured, firewalled, unplugged and moved to a new address all look the same from outside.

4. One controller per line

The French finding in October was that exposure is spread one controller per store, behind a small business router, with no concentration at contractors. The rest of the world looks the same.

In every country hit on 2 November with more than a handful of exposed addresses, no more than 12 percent of them show more than one controller; the Netherlands is highest, Portugal is near 1 percent and Luxembourg has none. Across the Danfoss and XWEB families worldwide, only nine addresses front ten or more controllers. There is no contractor gateway through which a country's exposure could be fixed at once, which is consistent with attackers reaching stores one by one.

Worldwide, 92 percent of exposed controllers sit on consumer or business access lines, where registry data names the carrier and not the operator. In Portugal every exposed address is in a carrier pool. In Belgium, Germany, Sweden and the Netherlands a few small food businesses, a care-home operator and a refrigeration contractor hold their own address blocks, but together they account for fewer than twenty addresses. The chains named in the press sit on anonymous carrier lines, exactly as in France. Most Swedish exposure is on the mobile networks of the three national carriers, and a share of German and Dutch exposure is on mobile pools too: typically a 4G router installed with the refrigeration plant, outside the store's own network. ICA has said that every affected store had its refrigeration connected outside its centrally managed network, and Coop Sweden has said it is moving away from 4G modems; our scan data shows what that arrangement looks like from outside.

The United Kingdom's Danfoss estate is tiny and anonymous: eleven addresses on 13 October, one controller each, eight on machine-to-machine SIM providers and three on business broadband, and ten of the eleven still visible three days after the French alert. Across the other families the picture is twenty times larger: 154 addresses and about 220 controllers in the month to 4 November, two thirds of them CAREL pCOWeb and the newer XWEB generation, on business DSL and machine-to-machine SIM pools from a handful of providers. Where a hostname names the owner, the owners are small food producers and butchers, a school and a nursery, which fits the NCSC's pointer to meat processors. Other published UK figures in the hundreds probably count scan observations rather than devices and are not comparable.

The controller is rarely the only exposed service at its address. On the same addresses as exposed Danfoss units, the team found the controller's own remote-screen service (VNC on port 15900) on 399, the Danfoss proprietary management service on ports 1041 and 1042 on 282, router management (TR-069) on 258, firewall administration interfaces on 91, and a scatter of cameras, Modbus and VPN endpoints. These are the services a store router exposes when it is configured for remote maintenance rather than isolation. An attacker who finds the controller finds the rest.

5. How we measured, and what we did not do

The October brief used 30 days of our internet scan data, 13 September to 13 October, to count Danfoss AK-SM 800A controllers whose StoreView web interface answers from the internet, using three signals: the page title, the self-signed certificate name and a CORS header specific to the product. We count unique addresses, estimate controllers at roughly ten scan observations per device, never below the number of regularly scanned addresses, and treat every figure as "seen in the window", not "online now". Ranking by estimated controllers rather than addresses matters where addresses are dynamic, as Portugal shows.

For this post we looked up the public registry owner of every exposed address outside France; built fingerprints for the Copeland and Dixell XWEB controllers (two generations), Copeland Site Supervisor and CAREL pCOWeb from page titles and certificates, checked them against our raw scan records, and counted each by country; re-ran our Danfoss scan on 4 November and checked every baseline address against three later windows; and read the firmware build date from the login page's modification stamp across the whole population. Separately, the ACDS Security Research Group checked every exploitable address in nine countries directly on 4 November and classified the Danfoss and XWEB populations by the same build-date signal. Its per-country findings have been prepared for the national CERTs; this post uses the totals only.

Three measurements carry stated confidence. The firmware classes are inferred from build dates matched to advisory dates, not read from a version string; the team's independent reading of the same stamp gives the same worldwide split, so we hold it with moderate to high confidence, and the line that matters, R4.3.1, is the firmest. The XWEB counts carry a small contamination, about 2 to 4 percent of pages titled "XWEB" are unrelated sites, and are the month to 4 November where the Danfoss column is 13 October. The 202 live addresses are a fact about one afternoon and about exploitable firmware only.

What we did not do: our scan work contacted no device, and the direct check sent one unauthenticated request per address and nothing else. We have not named the owners our registry work identified or the carriers whose lines carry the exposure. The owners are mostly small food businesses that have not been told they are exposed; the carriers are not at fault for what their customers plug in; and the per-country lists, with owners and abuse contacts, are with the national CERTs, which is where they belong.

6. What to do

For operators, the guidance has not changed since October. The second wave shows what happens to those who did not follow it.

• Remove refrigeration controller management interfaces from direct internet exposure, including DMZ and port-forwarding rules on store routers and 4G routers installed with the plant, and allow remote access only through a VPN or a strict allow-list. Close the controller's other services too: the remote-screen port and the proprietary management ports are exposed on hundreds of the same addresses.
• Treat the controller's connectivity as part of the store's network even when a contractor installed it, change default and shared passwords, and rotate credentials held by maintenance providers. The probing between the two waves used Danfoss's published factory defaults.
• Update AK-SM 800A units to R4.3.1 or later, half of the exposed estate has not, and apply Copeland's fixes for XWEB. Where the equipment is end-of-life, isolate or replace it; CERT-FR, Danfoss and Sabcobel all say a reset or update alone is not enough.
• Review defrost schedules and setpoints after any suspected access.

How to check your own controller from outside. Find the public address of the store's internet line, from the router or from the carrier. From a connection outside the store, open that address in a browser on the ports the installer used, commonly 80, 443, 8080 and the high ports used for port-forwarding. A Danfoss StoreView login page, or an XWEB, Site Supervisor or pCOWeb page, means the controller is exposed, whatever firmware it is on. Then check the controller's own firmware version against the vendor's current advisory, and ask whoever installed it which other services on that line are reachable from outside. If the login page is visible to you, it is visible to everyone.

For carriers and national CERTs, the exploitable units still online in the attacked countries are almost all on carrier access lines that nobody outside the carrier can tie to a customer. The lists exist, country by country, with the evidence for each address. The remaining step is routing them to the operators, and that is a job only the carriers and CERTs can do.

What we will check next. The lists were prepared on 4 November and "live" is a fact about one afternoon. Once the national CERTs have actioned them we will re-run our scan and the same check, and publish the result either way: whether the 202 became zero, whether the countries that have reported nothing have moved, and whether anyone has found a way to see the legacy AK-SM 800 and AK-SC 355 units that made up most of the victims and none of the map.

Sources

• CERT-FR, alert CERTFR-2026-ALE-012 (rev. 16 Oct): https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/
• Censys, 2 Nov: https://censys.com/blog/european-refrigerator-controller-redux-a-new-wave-of-refrigeration-attacks
• Censys, French take-down: https://censys.com/blog/frostbitten-in-france-a-danfoss-storeview-internet-exposure-report/
• Forescout, 22 Oct: https://www.forescout.com/blog/cold-chain-open-control-exposed-refrigeration-systems-reveal-global-risk/
• Onyphe, Copeland/Dixell XWEB exposure: https://blog.onyphe.io/en/refrigeration-as-critical-infrastructure-beyond-danfoss-the-exposure-of-copeland-dixell-supervisory-systems/
• Cybersecurity Dive, 3 Nov (Copeland, CISA, Commission): https://www.cybersecuritydive.com/news/european-authorities-probe-attacks-grocery-refrigerators/873598/
• SecurityWeek, 3 Nov: https://www.securityweek.com/over-100-european-stores-hit-as-supermarket-fridge-attacks-resume/
• NBC News, 2 Nov: https://www.nbcnews.com/world/europe/european-supermarkets-hit-new-fridge-cyberattack-rcna606972
• Help Net Security, 2 Nov (Lupovis, Beaumont): https://helpnetsecurity.com/2026/11/02/european-supermarkets-refrigeration-units-cyberattacks
• The Hacker News, 2 Nov: https://thehackernews.com/2026/11/second-wave-of-cyberattacks-hits.html
• NCSC statement, 3 Nov ("aware of a small number of UK organisations that may be affected"), and Richard Horne on BBC Radio 4 Today, 3 Nov, as reported by The Telegraph: https://www.yahoo.com/news/world/articles/fridge-hacks-hit-uk-food-191236991.html; Food Management Today, 5 Nov: https://foodmanagement.today/uk-businesses-affected-by-european-fridge-hack/
• CISA, ICS advisory ICSA-26-057-10 (Copeland XWEB)
• ACDS, Exposed refrigeration controllers in France, 14 Oct 2026 (public brief)

We have shared our findings with the relevant national CERTs. Each received, ahead of this post, the per-country list of exposed and exploitable addresses with owners and abuse contacts where we could establish them, and the evidence behind each entry. This post publishes country-level totals only. It names no owner, no carrier and no address, and it omits the per-country breakdown of the 4 November direct check, so that the figures help those responsible for the equipment without serving as a target list for anyone else.

‍