On the night of 1 to 2 November, fridges and freezers in more than 100 European stores began to heat up, some as high as 50°C. Retailers blamed a cyberattack. Three weeks earlier, around 700 French supermarkets had been hit the same way, and French authorities have now confirmed that cold rooms storing blood were also affected, although no blood products were lost.
No Gulf victims have been reported. But the weakness behind these attacks is not unique to Europe or to supermarkets. It is any piece of building equipment that someone connected to the internet for convenience and then forgot about.
What happened
The first wave hit France overnight on 11 to 12 October, forcing refrigeration units into defrost mode and spoiling food. France's CERT-FR linked the compromises to Danfoss AK-SM and AK-SC controllers, then to Copeland and Dixell XWEB systems.
The second wave reached stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden, with problems also reported in Finland, Italy and Portugal. It came after Danfoss told customers on 13 October to cut their systems' internet connections and reconnect only through a secure network. Danfoss says most stores acted, but a small number did not.
Much is still unknown. No formal attribution has been made, investigators have not established whether the waves are connected, and officials have not publicly explained how the attackers got in. Security researcher Kevin Beaumont says people he spoke to confirmed that every freezer hit on 2 November had a management interface reachable from the internet.
Why these systems were online at all
This was not simple carelessness. Remote access lets contractors fix faults without a site visit, and Danfoss says it typically cuts unnecessary callouts by 15 to 30%. Forescout found that some manufacturers' own documentation describes configuring routers to allow this access.
The trouble is ownership. A contractor manages the platform, a facilities team owns the equipment and IT runs the connection, so nobody sees the whole picture. Forescout counted 12,976 exposed refrigeration management services across 99 countries and territories, covering equipment also used in hospitals and agriculture. These figures count exposed systems, not hacked ones.
Three findings should concern any business with similar equipment:
- Old equipment stays in service. The Danfoss AK-SM 800 reached end of life in May 2021 and cannot be patched.
- Default passwords are being tried. Lupovis told SecurityWeek that most login attempts against its decoy controllers in late October used factory-default credentials.
- Exploits are getting easier to rebuild. Claroty's researchers used an AI coding agent, with human guidance, to reproduce the Danfoss flaws in about 28 minutes.
Why this matters in the UAE
Cooling is critical here. Food stores, hospitals, pharmacies, hotels, data rooms and logistics sites all depend on it. The same pattern also applies beyond refrigeration, to building management systems, CCTV, access control and generators.
Lupovis told the BBC that probing of its decoys was seen only in Europe, so there is no sign that the Gulf is being targeted in this campaign. Treat that as time to check your own sites, not as protection.
CCTV shows why. On 9 October, Dubai Municipality urged residents to secure their surveillance cameras, warning that a single weak setting could leave privacy exposed. Its advice included changing default passwords and keeping systems updated, and the same basics apply to business sites. We found no recent public report of a hacked business camera system in the UAE, but there is an older local precedent: in 2017, authorities blocked websites streaming live CCTV footage from homes and companies in Dubai, and police blamed installers for leaving default usernames and passwords in place.
How to check your own building
- List everything connected. Include cooling, building management, CCTV, access control, power and anything installed by a contractor. Ask each contractor what they connected and how they log in.
- Check it from outside. From a mobile connection, try your site's public address and the ports your router forwards. If a login page loads, it is exposed. Our firewall admin page guide explains the same test.
- Remove direct internet access. Close port-forwarding rules and give contractors access through a VPN or secure remote access gateway with multi-factor authentication.
- End shared logins. Change default passwords and give each contractor a named account. Remove accounts for former suppliers and staff.
- Separate the network. Put building systems on their own VLAN, with firewall rules that keep them away from office computers and servers.
- Update or replace. Apply vendor firmware where it exists. Plan to replace anything no longer supported, and remember that some fixes may need more than a software update.
- Plan for failure. Keep an independent temperature alarm and a manual procedure, so that a tampered system cannot quietly spoil stock overnight.
- Name one owner. Make one person accountable for every connected building system, with IT, facilities and contractors reporting into that role.
Closing thoughts
Spoiled food was the visible cost of these attacks, but the lesson is about visibility. If nobody in your business can say what is connected, who can reach it and who would notice a change, the risk is already there. A short review with your facilities team and contractors will answer those questions.
At COMMPRO Technologies, we supply firewalls and networking equipment across the UAE and GCC. Not sure what is reachable in your building? Contact the COMMPRO team and we will help you plan the review and the network changes that follow.
