Overnight into 2 November 2026, supermarket refrigeration units across a dozen European countries woke up stuck in defrost or chasing a 50°C target. Attackers had not dropped ransomware. They had typed weak or default passwords into internet-facing controller admin screens left open for contractor remote maintenance. According to SentinelOne Labs, the access path was credential-only login to supervisory refrigeration controllers, mostly Danfoss units, and the damage was done through those controllers' normal management screens.
No malware, no claimed group, and no ransom demand appeared in the public record. The operators simply authenticated, then rewrote setpoints that grocery cold chains treat as sacred.
How weak passwords unlocked Danfoss admin screens
Contractors leave refrigeration supervisory hubs reachable from the public internet so technicians can adjust defrost cycles and temperature targets without a truck roll. That convenience became the entire attack surface. Attackers password-sprayed and brute-forced those remote admin interfaces until weak or factory-default credentials worked, then used the legitimate UI the same way a service engineer would.
According to SentinelOne Labs, France's ANSSI had already tied an October 2026 French wave to admin interfaces open to the internet with weak passwords. Danfoss stated that affected Dutch systems sat off a secure network and still carried default passwords. An Estonian store was running an old controller. Danfoss also pointed at outdated, unpatched software on some units. None of those disclosures describe multi-factor authentication on the hit interfaces.
Researchers have documented an authentication-bypass issue in the Danfoss AK-SM 800A. ANSSI said that flaw was not used in the French wave. Public reporting has not confirmed whether it played any role outside France, so the documented common path remains password guessing against exposed logins.
The login ceremony itself was the whole game. Once the password worked, the management screens accepted setpoint changes without a second factor, a hardware-bound proof, or a step-up challenge. Password-only remote admin on OT gear is still a first-class workforce and contractor login path. It just lives on a cold-room hub instead of a SaaS portal.
| Control on the hub | What happened | Why it failed |
|---|---|---|
| Default or weak password | Guessed or sprayed until login worked | Single shared secret, no device binding |
| Internet-exposed admin UI | Reachable without VPN or jump host | Contractor convenience beat network isolation |
| Management screens after login | Defrost and temperature rewritten | No second factor after password success |
| Patch level / old hardware | Outdated software, old Estonian unit | Unpatched code did not block password entry |
What the November wave did inside European stores
The second wave landed overnight into 2 November 2026. SentinelOne Labs lists hits in Belgium, the Netherlands, Sweden, Estonia, Ireland, Luxembourg, Finland, Italy, Portugal, Romania, and Germany. Controllers were left stuck in defrost mode or given target temperatures of 50°C. Food safety and spoilage risk followed from those legitimate setpoint writes, not from encrypted disks or wiped PLCs.
ICA reported 23 affected stores. Those sites connected through an outside supplier and sat outside ICA's central corporate network. No public source describes lateral movement from the controllers into payment systems, customer databases, or core IT. No persistence on OT or IT networks is described either. Impact stayed on the refrigeration management plane: change the numbers the hub already trusts, watch the cold chain misbehave.
Attribution remains open. Russian-aligned groups appear only as a line of investigation in reporting, not as a confirmed actor. No group claimed the campaign. No ransom note is on the record. Affected payment or customer record counts are not published. The story that is published is simpler and uglier: password-only OT admin, exposed for remote maintenance, abused at scale.
Why password-only OT remote admin still fails the same way
Enterprise identity teams spent years hardening Microsoft 365 and VPN portals, then left the freezer hub on admin/admin. The authentication model on these Danfoss-class interfaces matched a 2005 appliance: one password field, often a factory default, sometimes never rotated after install. Contractor remote maintenance justified the internet exposure. Nothing in the public account shows MFA prompts, hardware keys, or origin-bound device proofs on the successful logins.
Password spray and brute force thrived because the secret was transferable and the interface was public. An attacker who could reach the login form could keep trying until the weak credential worked. After that, the same screens a legitimate technician uses became the payload delivery system. Changing defrost state or driving a setpoint to 50°C required no exploit chain once authentication succeeded.
Device-bound login would have removed that password-only controller admin surface. Without a reusable secret to spray, the remote management path stops being a free credential lottery. A fix for that class of login exists; the companion write-up covers how phishing-proof, device-bound authentication closes password-only remote admin without turning every cold-room hub into a detection science project.
Grocery cold chains do not need another novel ransomware family to lose a weekend of inventory. They need remote admin paths that stop treating a guessable password as proof that a contractor is standing in front of the unit.
FAQ
How did attackers get into the Danfoss supermarket refrigeration controllers?
Attackers got into the Danfoss supermarket refrigeration controllers by guessing weak or default passwords on internet-exposed remote admin interfaces left open for contractor maintenance. According to SentinelOne Labs, they then used the controllers' normal management screens to change defrost and temperature setpoints. No malware or ransomware was required once the password worked.
Did the European fridge controller attacks use ransomware or malware?
The European supermarket refrigeration controller attacks did not use ransomware or malware in the public account. Attackers authenticated to supervisory hubs, mostly Danfoss units, and rewrote setpoints through legitimate management UIs, leaving units stuck in defrost or targeting 50°C. Damage came from trusted admin functions after password login, not from encrypting hosts.
How many ICA stores were affected by the refrigeration controller incidents?
ICA reported 23 affected stores in the refrigeration controller incidents. Those stores connected through an outside supplier and sat outside ICA's central corporate network. Public reporting does not describe compromise of ICA's core IT or payment systems from these controller logins.
Was multi-factor authentication present on the hit refrigeration admin interfaces?
No public source states that multi-factor authentication was present on the affected refrigeration controller admin interfaces. Authentication is described as password-only against weak or default credentials on internet-reachable hubs. That single-factor remote admin path is what password spraying defeated.
Was the Danfoss AK-SM 800A authentication bypass used in these attacks?
ANSSI said the documented Danfoss AK-SM 800A authentication-bypass flaw was not used in the French wave. Public reporting has not confirmed use of that bypass outside France. The path that is documented across the campaign remains weak and default passwords on exposed admin logins, plus outdated software on some units.
