A second wave of coordinated cyberattacks targeted supermarket refrigeration systems across at least seven European countries on November 2, 2026. The incident, which has led to widespread food spoilage and equipment damage, marks a significant escalation in the targeting of critical infrastructure through vulnerable operational technology (OT).
The latest attacks expanded the geographic scope of the crisis beyond France, where an initial wave in October 2026 impacted approximately 700 stores. The November 2 surge hit retailers in Belgium, Luxembourg, Sweden, Estonia, Ireland, Finland, and the Netherlands. According to reports, attackers remotely manipulated temperature settings, in some instances forcing refrigerators and freezers to reach temperatures as high as 50°C (122°F), rendering entire stocks of perishable goods unsafe for consumption.
Vulnerabilities in Legacy OT Hardware
Security analysis indicates that the attackers are specifically targeting internet-exposed remote controllers, with a focus on older Danfoss and Copeland systems running outdated firmware. The primary hardware models identified in the breaches include the Danfoss AK-SC 355 and AK-SM 800 series. These units are often left accessible via the public internet to allow for remote maintenance, a convenience that has now been weaponized.
The technical exploit involves CVE-2025-41450, a vulnerability related to a “code of the day” algorithm used for administrative access. This mechanism, intended to assist technicians who have lost their credentials, allows unauthorized users to generate valid login codes based on the current date, effectively bypassing traditional administrator passwords on Danfoss AK-SM 800A units and similar hardware.
Disruption of the Food Supply Chain
The scale of the “Black October” wave in France resulted in millions of euros in losses, but the November wave’s geographic dispersion suggests a more systemic threat to the Eurozone. EU Food Commissioner Christophe Hansen stated that the attacks appear to be a deliberate attempt to disrupt the food supply chain across the continent.
The incident highlights a significant security gap regarding end-of-life products. This leaves retailers with a difficult choice: disable remote maintenance capabilities and face higher operational costs, or continue using the vulnerable systems and risk further spoilage.
As of November 2026, it remains unclear if patches will be made available for all affected older controller models. Security experts recommend that retailers immediately move these controllers behind virtual private networks (VPNs) or take them offline to prevent direct exposure to the public internet until more permanent mitigations are established.
