Overnight into Monday, 2 November 2026, attackers changed the settings of refrigeration controls in supermarkets across Europe and warmed their fridges and freezers. Three weeks after the attacks on hundreds of French stores, it is clear that this was not a one-off.
What happened
A store's fridges and freezers are run by a refrigeration controller, a small computer that refrigeration contractors can monitor and adjust remotely. That remote access is the target. The Hacker News has collected what the chains and their suppliers have said so far.
The attackers used two methods. In Belgium they switched cooling units into defrost mode, which is meant to clear ice but here heated the units up. Elsewhere they simply raised the set temperature: a store in southern Sweden found its fridges and freezers set to 50°C, and a butcher near Antwerp lost meat worth about €15,000 at up to 18°C.
No chain reported more than a few dozen stores, but the list is long:
- Belgium and Luxembourg: Delhaize, Carrefour, Intermarché, independent Spar stores and an IKEA in Mons
- Sweden: ICA and Coop
- Ireland: 13 SuperValu stores, which took chilled and frozen food off sale
- Netherlands: at least 17 businesses, including butchers and small local shops
- Estonia, Finland, Portugal and Italy: individual stores
Not every company calls it a cyberattack. Some speak of an IT incident or of unusual temperatures. Danfoss, the Danish maker of the controllers, says its products were involved, as they were in France. In Belgium a second maker, Copeland, was reportedly hit as well.
How the attackers got in
No vulnerability has been named. What the companies describe is less spectacular. According to Danfoss, the Dutch systems that were hit were not on a secure network and still used default passwords. Most shops there had acted after the French attack, and the few that had not were the ones hit. Danfoss also points to outdated software on systems that had not been updated, and the Estonian supplier says old controllers without updates were the target. In Estonia, the store that was hit was the last one still waiting for a new system.
Who is behind it is open. Nobody has claimed the attacks, and a similar method does not prove the same attackers. Belgium's Centre for Cybersecurity said it may never be determined. The Belgian federal prosecutor has opened a criminal investigation.
Are you affected?
If your business keeps goods cold and a contractor maintains the system remotely, quite possibly. That is not only supermarkets but also butchers, bakeries, restaurants, hotels and warehouses. The French CERT names Danfoss AK-SM and AK-SC controllers as well as Copeland xweb and Dixell xweb, and it considers the campaigns probably still under way. Reports so far name no cases in Switzerland, but nothing about the method is tied to a country.
What to do now
- Ask your refrigeration contractor. How is the controller reached from outside, which model and firmware is it running, and have the default passwords been changed? Ask for the answer in writing.
- Take the controller off the internet. It should not be reachable from outside, including through a public IP address. Before you cut the data feed to your contractor, check your insurance contract.
- Allow remote access only through a VPN or a protected network. CERT-FR accepts filtering the contractor's IP addresses at the firewall as an emergency measure, not as a lasting fix.
- Check the whole configuration. Pay particular attention to the defrost schedules, because the Belgian attacks worked through defrost mode.
- Update and harden. Install current firmware. On Danfoss devices, set the security level to Strict.
- Replace end-of-life devices. According to Danfoss, most units hit in France were the AK-SM 800 and AK-SC 355, which no longer get updates. CERT-FR expects such devices to be compromised if they stay on the internet, and a factory reset alone does not change that.
- Make sure someone notices. A temperature alarm that reaches a person at night limits the damage, whatever the cause.
If a controller has already been tampered with, CERT-FR recommends restarting it or resetting it to factory settings and then reconfiguring it completely before it goes back into service. Sweden's National Cybersecurity Centre adds the step behind all of this: list every device that is connected to the internet, decide whether it really has to be, and keep the rest up to date.
A Belgian contractor pointed out that a software update alone is often not enough, because older installations need physical changes that cost money. That is worth planning for now rather than after the next wave.
Not sure which of your devices can be reached from the internet? Pentesting and consulting →