Key takeaway
Three incidents in the first days of November point at the same failure mode: management interfaces and update channels that were never designed to face the internet are being used to reach production systems directly.
What happened
Overnight into Monday, 2 November, attackers remotely altered the settings of refrigeration controllers at supermarkets in Belgium, Sweden, Estonia and several other European countries, warming fridges and freezers. No chain reported more than several dozen affected stores, but some discarded chilled and frozen goods or pulled them from sale. Danfoss, the Danish maker of refrigeration controls, confirmed its products were involved — as they were three weeks earlier when attackers hit hundreds of French supermarkets. No group had claimed the campaign by Monday night, and it was not established whether it was linked to the French wave.
Defrost mode, 50 °C setpoints and unchanged passwords
The mechanics were mundane and physical. In Belgium, attackers switched cooling units into defrost mode, which is meant to clear ice but here made the units heat, Stephan Moelans of refrigeration contractor Sabcobel told Belgian media; Sabcobel manages systems for Delhaize. Elsewhere the setpoint was simply raised: an ICA store in Sjöbo in southern Sweden was set to 50 °C and staff threw out the affected goods, and a Selver store in Estonia was also set to 50 °C but rose only 2–3 °C before the problem was resolved in about ten minutes. At a butcher shop in Hove, near Antwerp, fridges reached 18 °C and the owner estimated roughly €15,000 of meat was ruined. Reported counts varied by retailer and by source: Delhaize several dozen stores across Belgium and a few in Luxembourg, Carrefour 15 of more than 700, Intermarché 10 to 15 in Belgium and 7 in Portugal, Spar 5, IKEA one store in Mons, Coop Sweden 6 or 7 of about 800, Musgrave 13 of 223 SuperValu stores in Ireland, and at least 17 Dutch businesses including butchers. The access path described by suppliers was consistent: per Danfoss, the Dutch systems that were hit were not on a secure network and still used default passwords, and the shops that had not taken measures after the French attack were the ones compromised. Danfoss told Belgian broadcaster VTM the weakness lies mainly in outdated software. CERT-FR's October alert, CERTFR-2026-ALE-012, still covers Danfoss AK-SM and AK-SC series controllers as well as Copeland and Dixell xweb units, and states that campaigns against these devices are probably ongoing.
A December 2024 DSM patch and a two-hour update window
Synology, separately, urged customers to update DiskStation Manager after observing ransomware attacks against NAS devices running outdated builds. The vendor did not name a single flaw but linked to its November 2024 advisory SA_24_20, which covers CVE-2024-10441 (CVSS 9.8, remote code execution in the system plugin daemon) alongside two lower-rated issues, fixed in DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8 and later. Customers reported C3RB3R ransomware, which appends .L0CK3D and drops read-me3.txt. Qihoo 360, which analysed the family, notes it has also exploited two DSM flaws Synology fixed in September 2026, CVE-2026-13684 and CVE-2026-13639, both rated 9.8. The third case is a supply-chain compromise with a narrow window. On 2 November at 02:06 UTC, an attacker used compromised credentials to break into the update system of cPGuard, a Linux server security tool made by OPSSHIELD, and pushed a malicious script in versions 5.88.12 through 5.88.19. The script installed a backdoor, collected /etc/shadow, /etc/passwd, root's MySQL or MariaDB my.cnf, root's shell history and root's SSH files, and uploaded the archive to the vendor's own licensing server using a hijacked account. OPSSHIELD detected it within 12 hours, estimates 32 collected files were taken, and said on 2 November that it had not yet established how the credentials were obtained.
Why it matters
None of these were zero-days against a hardened target. Two relied on internet-reachable management interfaces on end-of-life or unmanaged hardware, and one abused the trust customers place in an update channel. That is the pattern worth taking from the week: the control plane of small, boring, often out-of-scope equipment — a refrigeration controller in a stockroom, a NAS in an office, an antivirus agent on a web server — is frequently the shortest path into an organisation.
Contractor access is the control plane
In the refrigeration cases, the connectivity exists for a legitimate reason: contractors monitor and fix faults remotely. Danfoss said the affected French units were mostly older AK-SM 800 and AK-SC 355 models it no longer updates, and Sabcobel's Moelans argued that updating software alone is insufficient because some installations need physical changes that cost money. The impact asymmetry is instructive too: Estonian staff recovered in ten minutes, while a Swedish store discarded stock, which means the difference between a nuisance and a loss event was local monitoring and response, not prevention. For cPGuard, the concern is durable credential exposure. Password hashes in /etc/shadow can be cracked offline if weak, but secrets sitting in my.cnf or shell history are not hashed at all, and OPSSHIELD warns that copied credentials may still work after upgrading. Upgrading removes the backdoor; it does not undo the theft.
What defenders should do
Inventory what you actually expose. For refrigeration and other building or OT controllers, enumerate every device with a public IP, check defrost schedules and setpoints against the expected configuration, and restore remote access only through a VPN or a protected segment. CERT-FR's guidance is explicit that firewall filtering of contractor IP addresses is an emergency measure, not a fix, and that on compromised units you must restart or factory reset and then reconfigure. For Danfoss devices, set the security level to Strict and confirm default passwords are gone. End-of-life controllers left on the internet should be treated as compromised by default.
Build numbers and artefacts to hunt for
For NAS estate, check DSM versions against the fixed builds above rather than assuming automatic updates are on; Synology recommends enabling them. On Linux fleets running cPGuard, grep 'Successfully updated' /opt/cpguard/logs/install_log reveals whether an affected version (5.88.12 to 5.88.19) was installed, but the absence of an entry does not prove cleanliness — a missing or incomplete log is itself a finding. Update with cpgcli update --start and verify cpgcli --version reports 5.88.25 or later, then rotate root and local account passwords from a trusted recovery environment, rotate database passwords, S3 keys, DigitalOcean tokens and anything in root's shell history, and replace the private keys under /root/.ssh while removing the matching public keys elsewhere. Detection is the weaker link, so instrument it deliberately. Watch for new outbound connections from servers to vendor licensing infrastructure, file-integrity changes in /var/tmp (.cpg91511_sh, .cpg91511/loot.tgz), modifications to authorized_keys, and reads of /etc/shadow. On the OT side, alert on setpoint or mode changes to refrigeration controllers outside maintenance windows, and on inbound sessions from addresses that are not your known contractor ranges. Log configuration changes on those controllers at all — many do not by default.
Sources
- The Hacker News — New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food
- BleepingComputer — Hackers disrupt refrigeration systems at European supermarkets
- The Hacker News — Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw
- BleepingComputer — Synology warns of C3RB3R ransomware attacks targeting NAS devices
- The Hacker News — cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes
- CERT-FR — Alerte CERTFR-2026-ALE-012