Recently, malicious incidents involving supermarket refrigerators across Europe—where large numbers were hacked and temperatures were raised, causing malfunctions and spoilage—continue to escalate. Just as most people are blaming hackers’ use of AI, the UK National Cyber Security Centre (NCSC) has reached an utterly unremarkable investigative conclusion: hackers did not need AI, nor did they use any zero-day vulnerabilities. The intrusion methods were just two methods anyone could use, and one of them was even printed directly in the manufacturer’s own installation manual.
The default password, Supervisor/12345, is written right in the public manual.
The main target of this wave of attacks is the AK-SM series refrigeration temperature controllers from the major Danish manufacturer Danfoss. According to cybersecurity media Decryption Digest, which outlined the attack flow, AK-SM controllers ship with a fixed set of built-in credentials: username Supervisor, password 12345. These default values are documented in black and white in the AK-SM 800A installation manual, which is available for free download on the official website. Attackers do not need to guess the password at all; the answer is right there when they open the manual.
The second key is hidden deeper and is even more low-level. CVE-2025-41450 (CVSS 8.2) is a hidden “daily password” maintenance function in the controller: the device accepts “today’s date,” written in a specific format, as the passcode, completely bypassing the password set by the administrator. Once attackers have the device, they do not need to touch your password at all—just by looking at today’s date, they can log in.
Three attack steps: scan webpages, try passwords, raise the temperature.
None of the steps in this entire approach requires advanced hacking skills. The attacker first uses a scanner to search the public internet for devices that respond on ports 80 or 443 and whose characteristics match the Danfoss web management interface; then logs in using the default password or daily password; finally, in the management backend, raises the temperature setting, disables high-temperature alarms, and tampers with configuration files. Honeypot records from security company Lupovis show that automated login attempts against the AK-SM interface began on October 20 and peaked on October 26, with large-scale scanning preceding the attack.
SentinelOne Labs wrote in an operational assessment titled “Defrost and Disrupt”: These devices had been exposed on the public internet with factory default settings for years, and the 2026 wave of attacks was simply attackers finally deciding to use this entry point at scale. The report compares this wave of attacks with the 2021 Oldsmar water treatment plant incident in the United States, when attackers remotely logged in with legitimate accounts and changed the chemical dosing controls.
The manufacturer already issued a notice in 2025 that stores are using old models that are no longer updated.
The second layer of the elementary mistake lies on the maintenance side: Danfoss issued security advisories as early as March and August 2025 to patch software vulnerabilities that could be used to control refrigeration systems; yet the attacked devices include a large number of end-of-life models that no longer receive software and security updates. After France’s national cybersecurity agency ANSSI intervened to investigate, the affected supermarkets simply disconnected their refrigeration systems from the network entirely as a precaution. The affected control systems include Copeland xweb, Danfoss AK-SC and AK-SM series, and Dixell xweb.
The first wave of attacks occurred on the night of October 11–12, 2026, affecting about 300 Intermarché and Netto stores, 100 Coopérative U stores, 80 Carrefour stores, 30 Monoprix stores, and multiple E.Leclerc supermarkets. The attackers raised freezer and cold-storage temperatures to 50°C and extended defrost cycles from 1 hour to 8 hours, delaying alerts and intervention; at one store, the low-temperature cold room briefly reached 80°C. A single Intermarché store in Gradignan in southwestern France suffered losses equivalent to about €21,000 at purchase price (about NT$700,000), with nationwide losses estimated at several million to more than €10 million.
Spreads to the UK: Meat plant freezers idle as cold storage soars to 100 degrees
On November 2, a second wave of attacks spread across Belgium, Luxembourg, the Netherlands, Sweden, Estonia, Ireland, and Portugal, with overnight refrigeration failing at more than 100 stores. The UK was also affected. In a radio interview, NCSC Chief Executive Richard Horne said the team had been “working through the night” to notify potentially affected organizations, and that it was currently aware of a small number of cases domestically in which vulnerable technology had been exploited.
The Association of Independent Meat Suppliers (AIMS) confirmed that several of its more than 300 members were innocently caught up in the incident, which AIMS called collateral: two members’ freezers began defrosting, and another member’s cold store temperature soared to 100°C. Fortunately, the equipment was empty at the time, so no meat was lost. Langridge Organic, an organic food wholesaler in West London, further revealed that hackers had taken control of 6 of its 10 cold room systems and remotely started defrost cycles.
The NCSC CEO punctured it in one sentence: for decades, we’ve been getting by on cheap technology.
Speaking at the launch of the NCSC annual report, Horne said bluntly: “For decades, we have collectively got away with doing tech on the cheap.” He stressed that shortcuts that went unpunished in the past are now being found and exploited faster by attackers. NCSC Operations Director Paul Chichester said they are working with affected organizations to patch vulnerabilities before they can be exploited.
On the other side of the Atlantic, five federal agencies including the FBI and CISA issued a joint emergency bulletin on November 5, naming food retail and cold storage facilities as the current primary targets, with pharmacies, blood banks, hospital cold storage, military supply systems, and food transport all on the same attack surface. The Pentagon also confirmed it is examining whether the August freezer malfunction at a U.S. military supply depot is related to this wave of attacks.
Conclusion: This wave of attacks is a reminder of the most basic thing.
Looking at the whole incident, none of it would have happened if any one of the basic tasks had been fully carried out: changing default passwords, moving control devices off the public internet, updating or replacing end-of-support devices, not letting alerts be disabled… Each is basic knowledge, yet no one implemented them (just as many people’s home surveillance systems use default credentials, so hackers can log in and view them at will). The figures published in NCSC’s annual report echo this point: its incident management team receives 1,831 cyberattack reports a year, of which 337 require support, 80 are national-level major incidents, and it separately notified 8,500 organizations that their systems had been compromised. Hackers have not become smarter; the default passwords that should have been changed and the things MIS failed to do have finally been found.
Source:Decryption Digest
Source: KOCPC Chinese