Some Danfoss cooling systems remain exposed to cyberattacks, BSI warns

By Nathan Brooks

Cyberattacks on European supermarkets hit refrigeration systems from Sweden to Belgium last week, forcing stores to throw away food, Germany’s BSI said.

Germany’s information security office warned on Friday that ongoing vulnerabilities remained in some industrial cooling appliances from Danish firm Danfoss. The advisory came after attacks on refrigeration systems across Europe. It made direct internet exposure a central control issue for the affected equipment.

At least some of the refrigerator units affected used Danfoss temperature-control technology, BSI said. The same technology had been targeted in the attack in France last month. For supermarket technology teams, that overlap turns a broad cyber incident into a specific hardware-and-connectivity review.

The attacks spread across the continent last week, BSI said, hitting both fridges and freezers from Sweden to Belgium. Stores discarded food after refrigeration failures. The reported business loss was therefore physical, not merely an IT service interruption.

For corporate technology leaders, the response starts with the physical refrigeration estate. BSI’s advisory names industrial cooling appliances, their temperature-control technology and internet accessibility as the relevant control points. Teams need to map those components across sites rather than wait for a complete vendor fix.

An AP photograph by Fredrik Sandberg of TT News Agency showed destroyed refrigerated goods being thrown away from powerless freezers at the ICA Baronen store on Odengatan in Stockholm on Monday, Nov. 2, 2026. The caption said the disposal followed refrigerators and freezers shutting down at some stores.

What should supermarket operators do now?

BSI told IT security managers to take affected systems offline where possible. If that was not possible, it advised securing any connection through a VPN, or Virtual Private Network. It also told them to check whether they could install available Danfoss updates.

• Take affected industrial cooling systems offline when possible.
• Secure any necessary connection through a VPN.
• Determine whether Danfoss software updates can be installed.

The sequence matters because BSI treats disconnection and remediation as separate steps. Offline operation is the first preference. A VPN-protected connection is the fallback when a system must remain connected.

A supermarket IT team therefore has to track connections appliance by appliance, rather than only patch corporate systems. BSI’s advice leaves no assumption that vendor software alone closes the exposure. That distinction matters at sites where operators need connected refrigeration rather than a disconnected unit.

Updates remain incomplete. BSI said Danfoss had not yet supplied sufficient software updates to counter the attacks. The office warned managers against assuming the latest patch closes the risk permanently:

“Even new patches do not guarantee that further vulnerabilities in an affected product will not come to light in the near future. Industrial control systems should therefore not be directly accessible from the internet.”

The warning sets a higher bar than routine patch management. For operators, installing an update is necessary but not sufficient under BSI’s guidance. Affected industrial control systems still should not connect directly to the internet, and managers need to keep checking for new Danfoss fixes.

The concern extends beyond BSI’s European advisory. The United States also warned last week of a “cyber threat” to industrial refrigeration systems. The parallel notice indicates that the refrigeration threat was recognized on both sides of the Atlantic.

For business operators, the near-term exposure is straightforward: refrigeration outages can become food write-offs, while an incomplete patch leaves another vulnerability window. Until Danfoss supplies sufficient updates and operators remove direct internet access from affected industrial controls, more stores remain exposed to another shutdown and food disposal.