European refrigeration and the power to change a physical process

A wider geography, with connections still to be established

The incidents disclosed on November 2 extend the refrigeration controller issue beyond France. Reuters documents incidents in Sweden, Belgium, and Luxembourg, while explaining that neither the actor nor a connection with October’s French attacks has been established. Operational consequences across countries do not, in my assessment, establish a common directing authority.

Food retail nevertheless depends on equipment capable of acting on remote commands, which creates a concrete strategic exposure because access that changes a physical process can have consequences before an organization reconstructs the incident. The shared question I would examine concerns the effective power to intervene in equipment operation, while possible coordination between attackers remains an investigative question.

Ireland: precautionary withdrawal defines the documented impact

In its statement reported by The Irish Times, Musgrave says thirteen SuperValu stores and a specific, publicly unidentified equipment model were affected. Monitoring detected the issue; chilled and frozen products were withdrawn as a precaution while other products remained available. Work with suppliers and specialists continues, without publicly establishing the manufacturer, actual temperature, or any harm to health.

Maintaining that scope matters because describing every withdrawn product as destroyed, or applying temperatures reported elsewhere to Ireland, would turn a precautionary decision into an unsupported conclusion. The statement supports recognition of a commercial and organizational impact, while examination of individual batches and the route of unauthorized access require their own evidence.

A configured value does not establish what happened to stock

The Estonian case makes the distinction particularly clear. ERR reports confirmation of one affected Selver store and partner Kitman Coldtech’s account: the setting was changed to +50°C, but the actual rise was reportedly about 2–3°C. A response within ten minutes reportedly avoided damage, with normal temperature restored in 10–15 minutes. These remain company statements rather than a forensic measurement independently reproduced here.

The setpoint, meaning the target assigned to the controller, must therefore remain distinct from measured temperature and the conditions experienced by stock, whose assessment also depends on exposure duration. If the infrastructure generating records were involved, I would also require evidence of their reliability. That is an analytical consequence of the risk, rather than a finding that records were falsified in these incidents.

Remote maintenance distributes responsibility and operational authority

In the Netherlands, NOS reports a Danfoss spokesperson’s account of at least seventeen affected businesses, mainly smaller establishments, and unprotected networks and default passwords in the affected systems. This is the manufacturer’s account for that scope; it does not establish the same access route in Ireland or every other country.

The CERT-FR bulletin issued October 12 and updated October 16 lists Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers. It recommends removing public exposure, checking configuration, protecting access, and applying manufacturer measures, warning that a factory reset alone leaves vulnerable exposure unresolved. The Irish NCSC’s general ICS guidance likewise recommends preventing direct Internet access; it is not a SuperValu incident advisory.

Original research by Claroty Team82 documents an alternative authentication path associated with CVE-2025-41450 and post-authentication command execution, CVE-2025-41451, on the Danfoss AK-SM 800A platform. These capabilities explain why checking only the visible administrator password is insufficient, but do not establish exploitation in the November 2 incidents; remediation must be selected for the actual model and version, following the manufacturer’s guidance.

The operational chain consequently connects maintenance access, command authorization, physical execution, anomaly detection, and store decisions. Disconnecting a route can contain access, provided that someone retains local control and understands which monitoring functions have become unavailable.

Cyber-geopolitical relevance remains separate from attribution

The international dimension concerns reported impacts across jurisdictions and a recognizable technical and organizational dependency; it does not establish a global food supply crisis. In my assessment, the ability to put pressure on everyday activities through distributed equipment deserves strategic attention even while the directing actor and specific motive remain undetermined.

If comparable access routes remained usable, further incidents could place simultaneous demands on maintenance teams, replacement equipment, and stock relocation capacity. Alternatively, protections already implemented and rapid local response could limit consequences. Comparable configurations, access records, observed commands, and investigative findings could establish connections; timing alone cannot.

The evidence I would request before treating recovery as complete

The facilities lead, working with cybersecurity and the maintenance provider, should reconstruct authorized access, verify configurations and local control, and test restart conditions, producing an equipment-level record of outstanding exceptions. The expected result is demonstrable knowledge of who can still intervene and through which route, rather than confidence inferred solely from the controller being reachable again.

The quality and food safety lead should connect batches, time intervals, and available measurements, verify their reliability, and document stock decisions under applicable procedures. Bringing the two records together allows management to distinguish technical control from commercial availability, so that pressure to reopen does not overtake what the organization can substantiate.