The Warning Named The Product On 12 October. The Second Wave Came Twenty-One Days Later.

On the night of 11 October, attackers put refrigeration controllers into defrost at hundreds of French supermarkets, heating cabinets to as much as 50C and, in some cases, equipment that began to catch fire. CERT-FR published an alert the next day naming the Danfoss AK-SM and AK-SC controller series, and by its 16 October update the alert also covered Copeland xweb and Dixell xweb. Danfoss told customers that most of the affected units were older products it no longer updates. Twenty-one days later, overnight into Monday 2 November, it happened again, and by 3 November at least eleven European countries had reported impact. Britain was on the list this time, and the organisations that reported impact here were not supermarkets. They were meat suppliers, whose trade body says they were hit because they ran the same software as affected European supermarkets.

What happened

There have been two waves, three weeks apart, and the second is the one that matters commercially.

The second wave crossed at least eight named countries and several unrelated industries. On GCS's reading the common factor is not a sector, a border or a buyer but a shared class of refrigeration controller.

On the night of 11 October, attackers took remote control of refrigeration at hundreds of French supermarkets. Les Mousquetaires, the group behind Intermarche and Netto, said units were put into defrost and heated to as much as 50C. Intermarche said its affected stores had to throw away all the products concerned. Some equipment began to catch fire. Thierry Cotillard expected losses in the tens of millions of euros across France. Reported store counts included at least 300 Intermarche and Netto sites by one wire account and around 150 by another, 80 of Cooperative U's 2,000 stores, 80 Carrefour supermarkets and around 30 Monoprix.

CERT-FR published alert CERTFR-2026-ALE-012 on 12 October, citing numerous compromises affecting the Danfoss AK-SM and AK-SC controller series. By its 16 October update the alert also covered Copeland xweb and Dixell xweb, so this is not a single-vendor problem. The AK-SM 800 has been end of life since May 2021 and the AK-SC 355 was phased out in 2016; neither receives updates. Some units of the current AK-SM 800A were also affected, reportedly running outdated firmware. Danfoss told Reuters it was "aware of incidents in France affecting a limited number of refrigeration management systems" and told the trade press it was working with customers on "firmware updates where available, stronger network protections and removing direct internet exposure where applicable". Separately, researchers at Claroty reported finding thousands of AK-SM 800A management interfaces reachable from the internet; that work was lab-based and described no attacks.

Then it happened again. Overnight into Monday 2 November, refrigeration systems were tampered with across a widening list of European countries, and by 3 November Germany, Romania and the UK had joined it, taking the reported total to at least eleven. Reported counts are small in most places and specific: Carrefour said 15 of its 700-plus Belgian stores; Coop Sweden six or seven of around 800; Musgrave pulled chilled and frozen stock from 13 of its 223 SuperValu stores in Ireland; Intermarche reported seven stores in Portugal; four Coop stores in Sicily; at least 17 businesses in the Netherlands. Delhaize reported several dozen sites, mostly in Belgium. Selver in Estonia had a freezer set to 50C, but the temperature rose only two or three degrees and the problem was resolved in around ten minutes.

• 11 October 2026The first wave. Hundreds of French supermarkets have refrigeration put into defrost, with cabinets heated to as much as 50C and some equipment catching fire.
• 12 October 2026CERT-FR publishes CERTFR-2026-ALE-012, citing numerous compromises affecting the Danfoss AK-SM and AK-SC controller series. No vulnerability, firmware version or entry route is named in the alert. By its 16 October update the alert also covers Copeland xweb and Dixell xweb.
• 13 October 2026Danfoss issues advice to Dutch customers. It states publicly that most affected units were older products it no longer updates, and advises firmware updates where available, stronger network protections and removing direct internet exposure.
• Overnight into Monday 2 NovemberThe second wave. Refrigeration settings are changed remotely at retailers in Belgium, Sweden, Ireland, Estonia, the Netherlands, Finland, Portugal and Italy among others. In Hove, Belgium, the butcher De Laet and Van Haver has fridges raised to 18C and its owner puts the loss at around 15,000 euros of meat. Belgium's Centre for Cybersecurity says the same day that it is not known who is behind the attacks and that "it may never be determined".
• Tuesday 3 NovemberGermany, Romania and the UK join the list. Italy holds emergency talks with intelligence chiefs and its National Cyber Security Agency issues technical advice. Belgian federal prosecutors open a criminal investigation.
• Tuesday 3 NovemberDr Richard Horne, chief executive of the NCSC, says the NCSC had "people working through the night contacting organisations", that "There are handfuls of organisations in the UK we've alerted and we're aware of a couple of impacts", and that on attribution "It's too early for us to say at the moment and give a definitive answer". Paul Chichester, the NCSC's director of operations, adds: "At the moment, the impact is minimal."

On mechanism, the second wave is better documented than the first. Danfoss said the attacks on Dutch systems were the same kind as the French attack, and that those systems were not on a secure network and still used default passwords. Danfoss also said the weakness lies mainly in outdated software and that customers who had not updated were the ones affected. In Belgium, the chief executive of the installer Sabcobel said attackers reached individual supermarkets' systems rather than contractors' systems. In Estonia the affected system was an older Danfoss installation. Note what is still missing: for the October French wave neither CERT-FR nor Danfoss has said how attackers got in, and no CVE has been linked to either wave by any authority.

Why this one is different

Everything needed to prevent the second wave was public three weeks before it happened. The gap was ownership, not information.

The first wave was an incident. The second is a governance finding, and it is the reason this is worth twenty minutes of a board's time rather than a line in a security newsletter.

Work through what was available to any affected operator on 13 October. The product family was named in a national CERT alert. The vendor had publicly said the affected units were older products it no longer updates. The vendor had published its remediation advice in plain language: update the firmware where one exists, put the network protections in, and remove direct internet exposure. For the two end-of-life models that took most of the damage, no firmware fix exists at all, which leaves network isolation as the only available answer. The failure mode had been demonstrated at scale in a neighbouring market, with fires and losses projected in the tens of millions.

Twenty-one days later the same method worked again, across at least eleven countries, on operators who had all of that information. Danfoss's own account of the second wave is that the customers affected were those who had not updated. That is not a story about an unknown flaw or a sophisticated adversary. It is a story about the distance between a published advisory and a changed configuration, measured across a real estate, in weeks.

The second distinguishing feature is who ended up on the list, and it is the part most likely to catch a UK reader by surprise. The affected organisations are not a sector. They are grocery chains in Belgium, Sweden, Ireland and Italy; a furniture retailer's single store in Mons; at least 17 unrelated businesses in the Netherlands; a butcher in a Belgian town; and, in Britain, independent meat suppliers and abattoirs. The Association of Independent Meat Suppliers, which has roughly 300 members, explained its members' involvement in the most useful sentence published all week: members using the same software as affected European supermarkets "unexpectedly become collateral". None of them lost any meat, because abattoir cold units are typically empty overnight.

A British abattoir and a Sicilian grocer are not obvious counterparties. They are not in the same market, the same regulatory regime or, in any direction a procurement team would recognise, the same supply chain. On GCS's reading, what connected them is a class of refrigeration control product, from more than one maker, bought as part of a fridge, commissioned by an installer, owned by facilities, and running a firmware version nobody at board level has ever been asked about. Danfoss is named in reporting of several countries but not of the UK incidents, so for the British organisations this remains an assessment rather than a finding.

This is concentration risk in its least visible form. Boards have learned to ask about cloud concentration, because the providers are few, named and on the balance sheet. Far fewer ask which refrigeration or building management platform their estate standardised on, because nobody chose it in any meaningful sense. It arrived with the equipment, and it has an IP address.

Commercial exposure for UK and European organisations

Four faces, in the order a board will meet them.

Regulatory. The reflex for a UK food business is to assume this is a European matter. For an organisation with no EU establishment that is partly right, but the clause is worth quoting rather than paraphrasing. NIS2, Directive (EU) 2022/2555, lists in Annex II the sector "Production, processing and distribution of food", covering "Food businesses as defined in Article 3, point (2), of Regulation (EC) No 178/2002 ... which are engaged in wholesale distribution and industrial production and processing". Article 2(1) brings Annex II entities into scope where they qualify as medium-sized enterprises under the Annex to Recommendation 2003/361/EC or exceed those ceilings, and Article 3(2) classifies them as important entities. Note that merely being medium-sized is enough; you do not have to exceed the threshold. If you process or wholesale food anywhere in the EU at that size, you are in scope of NIS2 risk-management and incident-reporting obligations whether or not either wave touched you, and those obligations cover operational technology, not only the systems the IT function recognises. In the UK, the Cyber Security and Resilience Bill would widen the regulated perimeter; readers should check its current stage on the day they read this rather than rely on a statement here.

Contractual. Cold-chain and food-safety clauses in retail supply agreements commonly attach consequences to a temperature excursion, and where they do so without reference to cause, a cyber incident that produces an excursion can land in the same contractual box as a failed compressor. Check your own agreements rather than assume either way: whether they treat a cyber-caused excursion as a force majeure event or as a breach decides who absorbs the write-off. The Belgian butcher's 15,000 euros is the scale at which this becomes a real conversation for a mid-sized supplier, and it is a figure that would not trouble a grocery group at all.

Insurance. Where spoilage cover and cyber cover are placed separately and worded independently, a cyber-induced spoilage loss sits on the seam between them. Ask both carriers, in writing, which policy responds when the cause is an attack on a controller owned by a facilities contractor and reached over an internet-exposed interface. CERT-FR makes the related point from the other direction, advising operators to check their insurance contract before cutting the data feed to a refrigeration contractor. Both answers are worth having before a claim and before a disconnection.

Governance. The NCSC's standing advice, restated by Dr Horne this week, is to stop connecting technology to the internet when it does not need to be. That is easy to agree with and hard to execute, because nobody at board level owns the inventory it depends on. This incident puts a narrow and answerable question to a UK board: who here can name every internet-reachable system that controls a physical process, and when were they last asked? If the honest answer is that it would take a fortnight to find out, that is the finding, and it has nothing to do with refrigeration.

What leaders should do now

Six decisions a UK or European leadership team can take this week, none of which require knowing who did this.

1. Establish whether you run any of the named product families, and on what firmware. Danfoss AK-SM and AK-SC controllers are named in the CERT-FR alert, and its 16 October update also covers Copeland xweb and Dixell xweb. A reader who runs Copeland or Dixell equipment is in scope of the alert, not outside it. The AK-SM 800 has been end of life since May 2021 and the AK-SC 355 since 2016. If you run the current AK-SM 800A, the version matters: Strict Session Control, which makes HTTPS mandatory, is enabled by default from version 4.0, and a controller on a 3.x build should move to 4.x before anything later. Your facilities team or installer can answer this today.

2. Remove direct internet exposure from refrigeration and building controls. This is CERT-FR's first instruction, which covers every AK-SM and AK-SC controller: disconnect it or filter access to it. On Danfoss's own three-item list it is the third item. Claroty reported thousands of these management interfaces reachable from the internet. Firmware upgrades on end-of-life hardware are frequently not possible at all, which makes network isolation the only available answer for part of most estates. Be realistic about the cost: one Belgian installer has said a software update alone is not enough because the installations need physical changes, and CERT-FR advises checking your insurance contract before cutting the data feed to a refrigeration contractor.

3. Remove default and shared credentials. Danfoss has said the Dutch systems hit in the second wave were not on a secure network and still used default passwords. Treat that as the base case for your own estate until someone has checked, and put vendor remote access behind authenticated, logged and time-boxed sessions rather than standing access.

4. Inventory the operational technology that is not IT. Refrigeration, HVAC, access control, building management, process control. For each, record what it is, its firmware version, whether it is reachable from the internet, and who owns it. Expect the ownership column to be the uncomfortable one: it usually resolves to facilities, an installer or a maintenance contractor rather than to anyone in a security reporting line.

5. Write and rehearse the manual fallback. What is the temperature-excursion procedure when the controller cannot be trusted, who authorises a stock write-off, how long can a site run blind, and who tells the retailer. The UK members who lost nothing this week were lucky with timing. A procedure is the version of that luck you can repeat.

6. Resolve your NIS2 position rather than assuming you are outside it. The Annex II wording, the Article 2(1) size test and the Article 3(2) classification are set out above. Get a written answer on whether each legal entity is in scope, and if it is, confirm that your risk-management measures and incident-reporting arrangements cover operational technology and the suppliers who maintain it.

Three questions for the board

We were told on 13 October. What changed in our estate between then and 2 November? Most organisations will find the honest answer is nothing, and the reason will be that no one owned the asset. That is the finding, not the firmware.

Which physical processes here can be affected by someone who never touches our corporate network? If producing the list takes more than a week, the inventory is the first project, not the controls.

If a product two tiers below our direct suppliers failed tomorrow, how would we find out it was shared? On GCS's reading the British meat suppliers were not on anyone's target list. They were on a bill of materials.

Strategic takeaway

The useful lesson here is not about fridges. It is that an organisation's exposure is increasingly set by products it did not choose, bought by people who do not report to security, from tiers of the supply chain it does not record. A British abattoir and a Sicilian grocer had nothing in common until, on GCS's reading, a shared class of refrigeration controller put them in the same week's reporting, and neither could have discovered that from any register either of them maintains.

What makes the second wave uncomfortable is that everything needed to prevent it was public on 13 October: the product family, the vendor's own assessment that the affected units were ones it no longer updates, and a three-item remediation list. Twenty-one days later the same method worked across at least eleven countries, and the vendor's explanation was that the customers hit were the ones who had not updated. Known product, published advice, unchanged configuration. That is the most common shape of a preventable incident, and it is almost always an ownership problem rather than a technical one.

There will be a third wave or something like it, and the honest question is not whether your controllers are patched. It is whether anyone in your organisation would have received the 12 October alert, recognised that it applied to equipment they are responsible for, and had the authority to act on it. For most organisations the answer today is no, and fixing that costs a fortnight of someone's attention rather than a capital budget.

Confidence note

Confirmed: the dates of both waves; CERT-FR alert CERTFR-2026-ALE-012 of 12 October citing compromises affecting the Danfoss AK-SM and AK-SC series; the end-of-life dates of the AK-SM 800 and AK-SC 355; Danfoss's public statements to Reuters and the trade press, its advice to Dutch customers and its statement that the Dutch systems affected in the second wave were not on a secure network and still used default passwords; the retailer counts and quotations attributed below; the Annex II wording of NIS2, quoted from the directive rather than paraphrased.

Assessed, and labelled as such: that a shared class of refrigeration controller is what links the cross-sector victim list, including the UK meat suppliers. This is a GCS reading of AIMS's "same software" statement alongside Danfoss's naming in several countries. It is not a single-vendor assessment: the CERT-FR alert also covers Copeland xweb and Dixell xweb, and a Belgian butcher told a Dutch broadcaster that Copeland equipment was attacked. Danfoss is not named in reporting of the UK incidents, and no UK affected organisation has been named at all.

Reported, not confirmed: the attribution of any wave. No group has claimed responsibility, Belgium's Centre for Cybersecurity has said the attackers' identity "may never be determined", and the NCSC says it is too early to say. The entry route for the October French wave has not been established by CERT-FR or by Danfoss, and no CVE has been linked to either wave by any authority. Three 2025 CVEs exist against this product line but have not been connected to these attacks by anyone, and this briefing does not connect them either. Store counts are as reported on 3 and 4 November and are likely to change; no store total is computed across them, because no source states that the counts are complete. The country figure of at least eleven is the wire report's own, which also gives "10 or so EU countries" plus the UK, and which describes a list that grew over several days rather than a single night. The only published damage figures at the time of writing are the Belgian butcher's 15,000 euros, the Sicilian operator's estimate of several thousands of euros, and the tens of millions of euros projected across France for the October wave.

Garzon Cyber Solutions delivers cybersecurity advisory, compliance certification and specialist technology recruitment as one integrated capability for organisations in the UK, EU and beyond.