Supermarket Fridge Cyberattack Hits Europe Again: What Happened and How to Stay Safe
A second supermarket fridge cyberattack hit stores across Europe on 2 November 2026. Here is what happened, who was hit and how businesses can secure refrigeration controllers.
A second supermarket fridge cyberattack hit Europe overnight into Monday, 2 November 2026. Attackers remotely changed the settings of internet-connected refrigeration controllers, switching fridges into defrost mode or setting freezers to 50°C, in stores across Belgium, Sweden, Ireland, the Netherlands and several other countries. It came three weeks after a similar attack spoiled food in hundreds of French supermarkets, and no group has claimed responsibility.
Quick summary
- When: overnight into 2 November 2026, three weeks after the 11–12 October attack in France.
- Where: Belgium (about 75 stores), Sweden, Ireland, the Netherlands, Luxembourg, Finland, Estonia, Portugal and Italy.
- How: remote refrigeration controllers left reachable on the internet, many running outdated software or default passwords.
- Equipment named: Danfoss said its controllers were involved. France’s CERT-FR also lists Copeland and Dixell xweb devices.
- Who: unknown. Belgium’s federal prosecutor has opened a criminal investigation.
- Fix: take controllers off the public internet, update firmware, change default passwords and allow access only over a VPN.
What happened in the supermarket fridge cyberattack?
During the night, someone logged in to supermarkets’ refrigeration controllers and changed their settings. In Belgium, cooling units were switched into defrost mode. In Sweden and Estonia, freezers were set to 50°C. Staff found warm cabinets in the morning, and several chains pulled chilled and frozen food from shelves as a precaution.
Most chains reported only a small share of their stores affected, and most stores stayed open. Losses still added up: one Belgian butcher said meat worth about €15,000 was ruined after its fridges were raised to 18°C.
Also read: Here Are Top 9 Anime Streaming Websites
Which countries and stores were hit?
These are the figures retailers and suppliers had reported publicly by 3 November 2026. Several chains gave no exact count.
| Country | Retailer | Stores affected (reported) |
|---|---|---|
| Belgium / Luxembourg | Delhaize | Several dozen |
| Belgium | Carrefour | 15 of about 700 |
| Belgium | Intermarché | 10–15 |
| Belgium | Spar (Colruyt Group) | 5 |
| Belgium | IKEA (Mons) | 1 |
| Sweden | Coop | 6–7 of about 800 |
| Sweden | ICA | A limited number |
| Ireland | SuperValu (Musgrave) | 13 |
| Netherlands | Not named | At least 17 businesses |
| Finland | K Group | A few smaller stores |
| Estonia | Selver | 1 (fixed in about 10 minutes) |
| Portugal | Intermarché | 7 |
| Italy (Sicily) | Coop | At least 4 |
SuperValu’s owner Musgrave said the problem was limited to one specific fridge model and was fully resolved the same afternoon. In Estonia, the freezer warmed by only 2–3°C before staff fixed it, and no products were damaged.
How did hackers get into the fridges?
Supermarket fridges are run by central controllers that refrigeration contractors monitor remotely. When a controller’s web interface is reachable from the public internet, anyone who can log in can change temperatures and defrost schedules. France’s CERT-FR says exposing these management interfaces to the internet goes against good practice.
- Outdated software: Danfoss said the customers affected had not updated their software. In October it said most French units hit were end-of-life AK-SM 800 and AK-SC 355 models that no longer get updates.
- Default passwords: Danfoss said the Dutch systems hit still used default passwords and were not on a secure network.
- A known flaw: Danfoss’s 2025 advisory for CVE-2025-41450 (CVSS 8.2, High) describes an authentication bypass in AK-SM 8xxA controllers before version 4.2.
- No alarm: the changes were made overnight, when few staff were in stores.
The supplier that installs Delhaize’s systems in Belgium said attackers broke into individual stores’ controllers, not the contractors’ own systems. It knew of about 20 affected units among the hundreds it manages.
Who is behind the attacks?
Nobody knows yet. No group has claimed responsibility, and Belgium’s Centre for Cybersecurity said the attacker may never be identified. Suppliers said the methods were similar across countries, but a shared method does not prove the same people carried out both waves. The European Commissioner for Agriculture and Food called the attacks a deliberate attempt to disrupt the food supply, while saying food security itself is not currently at risk.
The first wave: France in October
On the night of 11 October 2026, refrigeration controllers in hundreds of French supermarkets, including Intermarché, Coopérative U, Carrefour and Monoprix stores, were put into continuous defrost. Some cabinets reached 50°C, equipment melted and tonnes of food were thrown away. CERT-FR issued alert CERTFR-2026-ALE-012 on 12 October and updated it on 16 October, warning that attacks were probably still under way. For more on how attackers exploit exposed devices, read our guide to common cyber security threats.
How businesses can secure refrigeration controllers
CERT-FR’s alert gives a clear checklist. It applies to any remotely managed cooling system, from supermarkets to cold storage, pharmacies and quick-commerce dark stores in India.
- Remove internet exposure: make sure no controller is reachable on a public IP address. Check your insurance terms before cutting data uploads to the refrigeration contractor.
- Review the configuration: check temperature set points and defrost schedules for changes.
- Allow remote access only through a VPN or protected network. Filtering contractors’ IP addresses on a firewall is acceptable only as a temporary measure.
- Update and harden: install the latest firmware, change default passwords and, on Danfoss AK-SM 800A, keep the security level on Strict, which Danfoss recommends.
- If a unit was compromised: restart it or restore factory settings, then reconfigure it before use. CERT-FR warns a factory reset alone is not enough, because the device can be infected again.
- Replace end-of-life controllers: a device that no longer gets security updates will stay vulnerable.
The same lessons apply to other internet-facing devices, such as NAS drives hit by ransomware (see our Synology NAS ransomware alert) and home routers with factory passwords (see how to safeguard Wi-Fi at home). Businesses that need firewall and VPN setup for remote sites can find help from Suprams’ firewall solutions.
Frequently asked questions
What was the supermarket fridge cyberattack?
It was a series of attacks in which hackers remotely changed the settings of supermarkets’ internet-connected refrigeration controllers, warming fridges and freezers. The first wave hit France on 11–12 October 2026, and a second hit stores in about ten European countries on 2 November 2026.
Which refrigeration systems were affected?
CERT-FR lists Danfoss AK-SC and AK-SM controllers and Copeland and Dixell xweb devices. Danfoss said many affected units were end-of-life models or had not been updated.
Is food safety at risk for shoppers?
Stores removed warmed products as a precaution, and the EU’s agriculture and food commissioner said food security is not currently at risk. The damage so far has been wasted stock and business losses.
Has anyone claimed the attacks?
No. Belgium’s federal prosecutor has opened a criminal investigation, and Belgium’s Centre for Cybersecurity said the attacker may never be identified.
The bottom line
Two waves in three weeks show how easily old, internet-exposed building controllers can be abused. Any business running remotely managed cooling should check today that its controllers are off the public internet, updated and protected by strong passwords and a VPN.
Sources
- CERT-FR: Alert CERTFR-2026-ALE-012, refrigeration remote controllers (French)
- Danfoss: Security advisory DSA-2025-03-01 (CVE-2025-41450)
- Danfoss: AK-SM 800A software and security guidance
About The Author
