What You Need to Know Know About the European Fridge Hacks

Cyber attacks show no signs of cooling down, and now refrigerators are warming up. 

For the second month in a row, Europe is experiencing spoiled food and costly damage as attackers target internet-connected fridges. The spike in attacks follows the discovery of vulnerabilities in two widely-deployed refrigeration controllers, Danfoss AK-SM 800A and Copeland XWEB PRO. 

These disruptions illustrate just how far digital risk now extends into physical supply chains. We’ll take a look at the impacted technologies to better understand how far the threat travels, who might be at risk, and how insurance responds.

The attacks, explained

The discovery

On August 9, Team82 published reports on two different vulnerable refrigeration controllers, Danfoss AK-SM 800A and Copeland XWEB Pro. Both are widely deployed to manage refrigeration infrastructure in commercial environments, like supermarkets, cold-storage facilities, and healthcare facilities. 

Analysis uncovered a total of 23 vulnerabilities impacting the Copeland XWEB Pro platform, which could allow attackers to bypass security mechanisms and execute code remotely. Similarly, researchers identified multiple vulnerabilities affecting Danfoss AK-SM 800A, including a command-injection vulnerability and hidden authentication mechanisms. 

The first round of attacks

On October 12, a cyber attack disrupted the refrigeration systems of several hundred supermarkets in France. More than 400 stores reported equipment malfunctions, resulting in the total loss of fresh and frozen products — adding up to “millions of euros worth of food.”

Hackers had accessed Danfoss refrigeration systems, leveraging the vulnerabilities disclosed in October, to remotely manipulate temperature controls. At the time of the attack, Coalition’s sensors identified 1,668 unique IP addresses publicly exposing a Danfoss web-accessible admin panel. Among them, 851 were associated with French networks — but the risk reached 61 countries overall. As of last week, 498 unique IP addresses total were still exposed. 

These findings establish neither prior compromise of these specific devices nor that the identified addresses belong to the affected stores. Our scanning process remains strictly external: it executed no intrusion tests nor attempted any authentication.

Following the attacks, Danfoss said that many of the affected systems were outdated and no longer received software or security updates. An updated alert from the French Computer Emergency Response Team (CERT-FR) added models sold under Copeland brands as well. 

The latest sweep

On November 2, dozens of grocery stores across Europe experienced incidents eerily similar to the cyber attack in France. Shops across the continent — from Ireland to Germany — reported their first cases of rapidly warming refrigerators. French blood banks were also targeted, but no samples or blood products were lost during the attack.

Copeland controllers were disclosed as the system behind an impacted Belgian chain. In the latest scan (October 22 - November 1), Coalition identified 906 unique IP addresses publicly exposing a Copeland web-accessible admin panel in 70 countries. 

Together, exposed Copeland and Danfoss devices span 87 countries.

Together, exposed Copeland and Danfoss devices span 87 countries. Exposures in France, Portugal and Sweden are almost entirely Danfoss, while Italy, the US, Canada, Czechia, Greece, Bulgaria and Ireland are Copeland territory. The Netherlands is split almost evenly.

France (909), Italy (412), the United States (278), Portugal (145), and the Netherlands (120) have the highest numbers of exposed controller hosts Coalition detected. This demonstrates the global scale of the problem and that many businesses are still exposed. 

Digital risk extends beyond workstations

Supermarkets, warehouses, and healthcare facilities use internet-connected fridges to reliably monitor temperatures remotely. Every connected fridge is an entry point that requires the same level of security as any other IT system.

Thousands of businesses were exposed because they used default passwords, connected to unsecured networks, or had legacy controllers that no longer received updates. Attackers didn’t need to leverage brand new zero-day vulnerabilities, they relied on the convenience of poor cyber hygiene and months-old flaws. 

Every connected fridge is an entry point that requires the same level of security as any other IT system.

Businesses should apply the same level of security to operational technologies and connected devices as they would workstations and email servers. Immediate actions include restricting remote access, applying patches, and controlling security configurations to mitigate risk.

Are your clients covered? 

A hack resulting in spoiled food and business downtime is a unique exposure. Traditionally, spoilage of this nature sits within property insurance programs, but property underwriters widely exclude cyber triggers. On the other hand, standard cyber policies historically exclude property damage. Clients may be surprised to find they are unprotected.

Brokers should examine their clients’ property and cyber policies carefully to watch for critical coverage gaps. Look for cyber policies that explicitly include coverage for physical damages, especially language dedicated to physical spoilage. 

The role of Active Insurance 

Coalition observes the web with the same techniques used by cyber criminals. If an unpatched device is detected within a policyholder's environment, we send a proactive alert with steps for remediation. By cross-referencing exposed surface analysis with other signals, including actively exploited vulnerabilities, compromised credentials, or detections from our honeypots, we help businesses address the most pressing weaknesses before an incident occurs.

Coalition has long offered both first-party and third-party Bodily Injury and Property Damage coverage for clients internationally. To learn more about our latest coverage innovations, contact your local underwriter.

This blog post is designed to provide general information on the topic presented and is not intended to construe or render legal or other professional services of any kind. If legal or other professional services are required, the services of a professional should be sought. Descriptions of coverage are for general informational purposes only and are subject to the terms and conditions, including the limitations and exclusions, of the applicable policy. The reader is cautioned to consult independent professional advisors and formulate independent conclusions and opinions regarding the subject matter discussed herein. Coalition makes no representations as to the accuracy or completeness of this content. Any action taken based on this information is at the sole discretion and risk of the reader. Coalition and its affiliates expressly disclaim any liability for losses or damages resulting from the use of or reliance on this information, which is used strictly at the reader’s own risk. The blog post may include links to other third-party websites. These links are provided as a convenience only. Coalition does not endorse, have control over nor assume responsibility or liability for the content, privacy policy or practices of any such third-party websites.

Copyright © 2026. All rights reserved. Coalition and the Coalition logo are trademarks of Coalition, Inc.