TL;DR
- The Incident: Remote attacks on internet-exposed commercial refrigeration systems across Europe forced cooling units into defrost mode, spoiling food in hundreds of stores.
- The Flaw: Perimeter network controls fail because many legacy IoT devices remain unpatched or exposed via default credentials.
- The Solution: Exein’s runtime security places protection directly on the device kernel to intercept unauthorized physical commands and prevent mass attacks.
Overnight on November 1–2, fridges and freezers in more than 100 stores across Europe began to heat up, with Belgium hit hardest and further cases reported in Sweden, Ireland, the Netherlands, Luxembourg and Estonia. Some units reportedly reached 50°C or more, and stores had to throw away fresh and frozen food. The method matches what happened in France in October, when around 700 supermarkets were affected: attackers remotely forced the cooling equipment into defrost mode. Some stores lost more than €130,000, while two markets in the French region of Alsace reported combined losses of €270,000 (per The Guardian). Intermarché's parent company estimated its nationwide losses in the tens of millions of euros.
What we know so far
The French wave was traced to internet-exposed refrigeration supervisors (central control systems used to monitor and regulate commercial cooling equipment) including Danfoss AK-SM and AK-SC and Copeland/Dixell XWEB systems, many of them end-of-life. Danfoss and Copeland devices have also been reported in this new wave, but investigators have not yet explained how the attackers got in, whether the two waves are connected, or who is responsible. No group has claimed the attacks.
What is clear is that the exposure remains. Censys counts about 1,000 Danfoss StoreView interfaces still reachable online worldwide, even though the number exposed in France fell from 1,825 to 220 after the October attacks. Between October 20 and 30, security firm Lupovis also recorded suspicious login attempts against its Danfoss AK-SM sensors, most of them using factory-default credentials.
Why this matters beyond supermarkets
Refrigeration is one example of a wider shift. For years, attacks on physical equipment were too complex and too costly to be worth attempting at scale. Connected devices now share much of the same standard software, and AI is lowering the effort needed to analyze them. As Exein CEO Gianni Cuozzo told Repubblica after the French attacks:
“Attacks on digital systems create digital problems, while attacks on physical systems create physical problems.”
Why the network is not enough
The immediate advice is sound: take these management interfaces off the public internet and patch what can still be patched. It does not address the underlying problem, however. Many of these devices no longer receive updates, and those that do are often left unpatched because an update can disrupt how they are configured. Network controls, meanwhile, verify who is connecting, not what they are asking the device to do. In Cuozzo’s words: “The firmware should have a safeguard: even if the command to go to 50 degrees arrives from outside, it should understand that the command needs to be validated. If the firmware has no such protection, it will execute any command from any source.”
How Exein approaches the problem
Exein Runtime places protection on the device itself. On modern Linux-based systems, our Photon engine enforces security policy in the kernel, so if an attacker tries to exploit the controller’s software, start a shell or write to system locations, the action can be raised as an alert and refused. We have shown this containment in practice in our analysis of the PHP2Shell vulnerabilities.
Exein protects connected devices directly at the runtime level using specialized agents tailored to different system architectures:
- Photon Engine: For modern Linux-based systems. Enforces security policy directly in the kernel to prevent unauthorized shell executions, illegal file writes, or memory exploits.
- Linux Lite Agent: For legacy embedded Linux devices. Delivers robust runtime protection without requiring a full kernel rebuild or hardware upgrades.
- Runtime Zephyr Agent: For resource-constrained microcontrollers. Built directly into the firmware to detect and report early warning signs of attack or system failure.
How much of an attack like this can be stopped depends on how each controller handles the command, and defrost and temperature changes may not work the same way. If a device keeps its operating parameters, such as temperature, in a file, Photon can prevent that file from being opened in the first place, blocking the change directly in the kernel. Pulsar, by contrast, detects the attempt and kills the offending process a few milliseconds later, giving enough time to revert the change to that file, a delay unlikely to matter for equipment like a fridge.
For older embedded Linux devices already in the field, our Linux Lite agent provides runtime protection without a kernel rebuild or a hardware refresh. For the microcontrollers inside industrial equipment, our Runtime Zephyr Agent, now in public beta, is built into the firmware and reports the warning signs of attack or failure to the same platform, while on-device blocking is still experimental.
The Future
No single control replaces patching and network hygiene, and no device is ever fully secure. What changes is the scale of the damage an attacker can do:
“Security has to be distributed on board the object. This doesn’t make the object impenetrable or absolutely secure, but it prevents mass attacks like this one. You could take out one refrigerator, not all the devices in the chain.” - Gianni Cuozzo (Exein Founder & CEO)
For manufacturers, the lesson is to build that protection in before a device ships, starting with knowing what the firmware contains, which is the job of Exein Analyzer, and to plan for maintaining it over the product’s life. The EU Cyber Resilience Act is turning that responsibility into a legal obligation. As Gianni Cuozzo put it: “If you sell connected objects, you have to know that you must maintain their security. [...] You can’t base your security strategy on hope.”
If you are responsible for connected equipment and want to see how this works on your own devices, book a demo with our team.
.png)
