Supermarket Freezers Hacked Across Europe, Including Romania: Exposed Controllers and the Credentials Nobody Changed

Nobody needed to steal a secret from a supermarket to warm its freezers. The management interface was reachable from the internet, and by every account that is enough. Since 11 October, attackers have remotely pushed refrigeration controllers in European supermarkets into modes that heat the cabinets. France saw roughly 700 stores affected overnight that weekend, according to SecurityWeek. A second wave overnight on 1 to 2 November hit over 100 stores across several countries, and Romania's DNSC says six stores of one chain were affected there.

How the attackers got in has not been officially confirmed. What is known points at a familiar set of problems: devices exposed to the internet, end-of-life software and logins that were never changed.

What is confirmed

The effect. Evaporators were forced into defrost mode, warming the cabinets. SecurityWeek reports some units reaching 50 °C, and food was spoiled. Help Net Security and SecurityWeek name Belgium, Luxembourg, Sweden, Estonia, Ireland, the Netherlands and Finland among the countries in the second wave.
The equipment. France's CERT-FR linked the first wave to Danfoss AK-SM and AK-SC controllers and later added Copeland and Dixell XWEB devices. Danfoss said most of the hacked units were legacy products it no longer updated.
The exposure. Researcher Kevin Beaumont told SecurityWeek that people he spoke to confirmed every freezer hit on the Monday had a management interface reachable from the internet. Censys counts about 1,000 Danfoss StoreView interfaces reachable worldwide, and French exposed instances fell from 1,825 to 220 after the first wave.
The vendor's advice. Danfoss told customers on 13 October to cut internet connections and reconnect only through a secure network, and said a small number of stores had not acted. A Belgian installer told SecurityWeek that a software update alone is not enough and that some affected equipment needs physical modification.
Romania. In reporting of DNSC's statements, the temperature in six stores of one chain rose around 01:30 on 2 November and was noticed at about 08:00. DNSC's director said the controllers were connected by GSM routers with fixed IP addresses, reachable directly from the internet, running quite old software, and that the attack appeared somewhat amateurish with no sign of a state-sponsored actor. DNSC has published an alert and an update on the incident.
The officials. The EU agriculture commissioner called the attacks a deliberate bid to disrupt the food supply chain, while saying food security is not under threat for now, and Belgium's federal prosecutor opened an investigation.

What is not confirmed

The entry method. Officials have not publicly said how the attackers got in. The security firm Lupovis saw login attempts against these controllers from 20 to 30 October, peaking on 26 October, mostly using the factory-default credentials Danfoss publishes, and one report describes a confirmed Estonian case involving default or weak credentials. Lupovis links the probing, not the attacks, to its sources. Treat default credentials as the most likely route, not a proven one.
A link to earlier research. Claroty reported flaws in a Danfoss controller in August that could allow a login bypass, and Danfoss shipped fixes. The attacks have not been tied to those flaws.
Whether the two waves are connected. Investigators have not said, and nobody has claimed responsibility.
Shared contractor logins. One outlet lists shared remote-access credentials used by maintenance contractors as a risk under scrutiny. That is a hypothesis, not a finding.

Why this belongs in a secrets discussion

A default password is a secret that everybody knows. A management interface on the internet turns that into an open door, and a controller with no further updates means there is no way to fix a flaw except to take it offline. The common thread with the incidents we usually cover is the same: one credential, held in too many places and changed too rarely, controlling something that matters.

Refrigeration and similar building systems are also commonly serviced by outside contractors who connect remotely. Those remote logins tend to be shared, long-lived and written on a service sheet, which is exactly the shape of credential that leaks.

What to do, for operators and for anyone with building systems

Find your controllers. List every refrigeration, HVAC and building-management controller, including those installed by contractors, and which have a network connection of any kind, including GSM or cellular routers with fixed addresses.
Take management interfaces off the internet. Disconnect them, or put them behind a VPN or a private network that only the maintainer can reach. Follow the vendor's guidance on cutting internet access before patching.
Change every default credential. Replace factory logins with unique, strong ones per device, and record where they are stored. Remove accounts you do not recognise.
Replace end-of-life units on a plan. If a controller gets no updates and cannot be taken off the network, treat it as a liability and schedule its replacement.
Set rules for contractor access. Give each technician their own account, expire it after the job and log what they do. Do not email shared service passwords.
Add an independent alarm. A temperature probe that reports over a separate path and alerts staff means a warm cabinet is noticed at 02:00, not at 08:00.
Prepare for the quiet failure. Know who can switch a store to local control, and have a plan for spoilage and for reporting to the national authority. In Romania that is DNSC.

The credential handover

Changing a hundred controllers' passwords means a hundred values reaching the people who service them. If they travel by email or chat, you have replaced one shared secret with a mailbox full of them. Deliver each value once, to the person who needs it, over a channel that does not keep it.

Where Secretus fits, and where it does not

Secretus covers that handover: a person encrypts a short text secret in the browser and shares a link that stops working after the expiry they set or the first successful open. Team Split can require several holders to reconstruct a high-value text secret.

It is not an operational-technology security product. It cannot find your controllers, take an interface off the internet, patch end-of-life equipment or raise an alarm. Those are engineering and procurement decisions. A one-time link helps with one step in them: getting the new credential to the right person without leaving a copy behind.