Reconnaissance of Danfoss refrigeration controllers preceded European supermarket cyberattacks

New research indicates that the cyber incidents affecting supermarket refrigeration systems across Europe on 2 and 3 November followed a period of reconnaissance targeting internet-connected industrial controllers.

Lupovis, a Scottish cybersecurity firm, deployed honeypot systems that mimicked vulnerable Danfoss refrigeration controllers after an earlier attack on French supermarkets in October. Between 20 and 30 October, the honeypots recorded 276 reconnaissance and break-in attempts from 91 IP addresses, including attempts to use factory-default credentials and exploit known vulnerabilities. Activity peaked on 26 October before declining at the end of the month.

On 2 and 3 November, attacks disrupted supermarkets in ten European countries and several blood-storage facilities in France, with attackers manipulating Danfoss AK-SM systems to raise temperatures up to 50 °C, forcing the disposal of perishable goods.

"A group of hackers with links to the Russian state may be behind the cyberattacks, based on data and infrastructure patterns such as bullet-proof hosting and overlapping IP addresses," said Xavier Bellekens, CEO of Lupovis. No official attribution has been confirmed, and Russia denies involvement.

The findings illustrate how cyber-physical operations can be preceded by systematic digital probing, highlighting vulnerabilities in operational technology that is increasingly internet-connected. Weak or default credentials and outdated software on management interfaces can provide entry points that allow attackers to alter physical processes, complicating detection.

Analysts stress that securing industrial control systems requires treating operational technology as part of an organization’s overall cyber-attack surface and ensuring that regulatory frameworks enforce effective protection of critical infrastructure.