By asahifile 
Just after one in the morning on Monday 2 November, Stephan Moelans began calling technicians. His firm, Sabcobel, manages supermarket refrigeration across Belgium; by the time crews reached the first stores, freezers were blowing hot air, forced into continuous defrost with targets as high as 50C — the manoeuvre that spoiled food in hundreds of French supermarkets three weeks earlier.
The number worth measuring is not how many countries were hit. It is how many hours the industry had between the warning and the repeat.
What happened, in order
This did not start in October. NPR traced earlier incidents to a kosher grocery chain in Israel in March and to US Defense Commissary stores such as Fort Irwin in August — both small, both quietly closed. Overnight from 11 to 12 October, roughly 700 French supermarkets — Intermarché, Coopérative U, Carrefour, Monoprix — had controllers forced into defrost mode. Food spoiled; several reports mention fires.
CERT-FR first tied the compromises to Danfoss AK-SM and AK-SC controllers, then widened its alert to Copeland and Dixell XWEB systems. On 13 October, Danfoss says it told customers to cut their systems’ internet connections and reconnect only through a secure network. Twenty days later the second wave arrived: more than 100 stores in Belgium, Sweden, Ireland, Estonia, Luxembourg and the Netherlands, with problems also reported in Finland, Italy and Portugal.
SuperValu pulled chilled and frozen stock from 13 Irish stores running one controller model. Security researcher Kevin Beaumont said every freezer hit that night had a management interface reachable from the internet. Belgian federal prosecutors opened a criminal file.
The counts do not survive contact with the sources
Scale is reported four ways. The BBC and the European Commission describe attacks in at least ten countries; SecurityWeek’s list of confirmed affected businesses names six. Store counts run from “more than 50” in Belgium to “more than 100” across Europe. Belgian media cited 70C; retailers cite 50C. A country with one affected butcher and one with 40 superstores both count once, so the headlines measure coverage as much as damage.
Attribution has the same shape. No group has claimed either wave, and investigators have not established that the two are connected. NPR quoted a researcher, working for an unnamed client, who is confident an Iranian military-linked group it calls Cyber Isnaad Front is responsible; two former US officials called that plausible but low-confidence. Brussels named nobody.
Twenty days is the measurement that matters
From the 13 October instruction to the first 1am callout on 2 November is twenty days — roughly 480 hours in which a documented, vendor-specific fix was available and, by vendor and technician accounts alike, only partly applied. Danfoss told NOS most stores acted and “a small number did not”; Moelans knew of about 20 affected units among the hundreds Sabcobel manages in Belgium, and they needed physical modification, not a patch.
The exposure estimates disagree too: Forescout counted 12,976 refrigeration management services on 6,017 addresses in 99 countries, Censys just over 1,000 Danfoss StoreView interfaces, ONYPHE 6,212 Danfoss-facing addresses, UK Cyber Defence more than 800 tied to British retailers. Widest and narrowest differ thirteenfold, because each counts something different. Hours of exposure is the only denominator actually tested.
A trade-off that is not one
Putting these controllers online has a real benefit: Danfoss says remote connectivity cuts unnecessary engineer callouts by 15 to 30%. But the recommended fix — off the open internet, contractors in through secure remote access — keeps remote access. What gets traded away is not the 15 to 30% but shared passwords and factory-default logins, which Lupovis says dominated attempts against its Danfoss sensors between 20 and 30 October.
No current law forces a fix: the EU Cyber Resilience Act’s support duties bite from December 2027, and these are discontinued lines. Japan’s JC-STAR scheme, run by IPA under a METI policy published in August 2024, gives conformant IoT products a two-year label, with third-party evaluation and patch support required at its higher tiers. That helps equipment bought now, not the controller already bolted to a wall in 2012.
What to watch
For anyone who runs a store, the test is narrow: if nobody can say whether the refrigeration controller answers a ping from the open internet, nothing else here matters.
- Whether Brussels or the Commission names a perpetrator, and formally links the two waves.
- Whether any retailer discloses real euros — Belgium’s reported EUR 100,000 write-off is the first hard figure.
- Whether Danfoss, Copeland and Dixell publish how many controllers remain reachable, giving the estimates one denominator.
Sources: BBC News, SecurityWeek, The Record, Euronews, NPR via WAMC, IPA.