European Supermarket Cyberattacks: Hackers Hijack Refrigeration Controls in a Second Wave Across Multiple Countries

Overnight on 1–2 November 2026, fridges and freezers in supermarkets and small food shops across several European countries began heating up. Retailers in Belgium, Luxembourg, Sweden, Ireland, Estonia and the Netherlands reported disruption, and later reporting added Finland, Portugal and Italy. It was the second incident of its kind in three weeks, after a much larger attack on French supermarkets on the night of 11–12 October. In both cases the reported target was the same class of device: internet-reachable supervisory controllers that refrigeration contractors use to manage cooling remotely.

This is an OT story more than a retail one. No ransomware note and no stolen data have been reported. Attackers appear to have simply logged in to building-automation controllers and changed how they behave, with physical consequences: spoiled stock, closed freezer aisles and, in France, fires.

Key takeaways

• Scale: BleepingComputer counted more than 115 stores affected on 2 November across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, and said it was unclear whether the attacks were coordinated or targeted individually. The October French wave was larger: the Paris prosecutor’s office told The Record there were around 700 victims, while Reuters and other outlets reported lower store-level counts (about 350 at first).
• Equipment: Danfoss said its products were involved in the second wave, as in France. Copeland equipment was also reported hit in Belgium (via a butcher quoted by Dutch broadcaster NOS). Not every affected operator named a manufacturer.
• Cause (as far as is public): Danfoss and others point to end-of-life or outdated firmware, internet exposure and weak or default credentials. No single CVE has been publicly confirmed as the entry point.
• Attribution: None. No group has claimed responsibility, and Belgium’s Centre for Cybersecurity has said the perpetrators may never be identified.
• Investigations: Paris prosecutors and France’s ANSSI (October); Belgium’s federal prosecutor (November).

Incident overview

First wave: France, 11–12 October 2026

Attackers remotely forced refrigeration systems at hundreds of French food stores into a prolonged defrost cycle. Reuters, Al Jazeera and others reported temperatures reaching as high as 50 °C (122 °F) after roughly six hours overnight, spoiling fresh and frozen stock and causing fires at several stores. Affected banners included Intermarché and Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc. Reported figures vary by source and date: Les Mousquetaires (Intermarché’s owner) said about 150 of its stores were hit, Carrefour said about 80, and Monoprix said about 5% of its roughly 490 stores. France’s ANSSI said the attacks involved remote controllers from several brands, and Prime Minister Sébastien Lecornu tasked the agency with investigating.

The Paris prosecutor’s office opened an investigation into a large-scale cyberattack on the refrigerators of major food retail chains, to identify victims and link them to the reported food losses and fires.

Second wave: 1–2 November 2026

Per Reuters, an ICA franchise store in Stockholm said the attack happened at about 2 a.m. local time (0100 GMT) but was only noticed hours later. The following list is drawn from The Hacker News, Reuters, AP and The Record, using each company’s own description of the incident. Not all companies called it a cyberattack.

Country	Operator	Stores reported affected	What was said
Belgium / Luxembourg	Delhaize (Ahold Delhaize)	Several dozen, mostly Belgium	Described as an ‘IT incident’; distribution centres unaffected
Belgium	Carrefour	15 of 700+	Cyberattack on refrigeration installations, impact ‘extremely limited’
Belgium	Spar (Colruyt Group, franchise)	5	Fridge systems attacked
Belgium	IKEA (Mons)	1	Fridges and freezers hit
Sweden	ICA	‘Limited number’, no count	Incident hit refrigeration; ICA did not confirm a cyberattack
Sweden	Coop	6–7 of ~800	Unauthorised tampering with refrigeration; Danfoss named among suppliers
Ireland	Musgrave (SuperValu)	13 of 223	‘Cyber incident’ limited to one refrigeration model; resolved and restocking by Monday afternoon
Estonia	Selver (via Kitman Coldtech)	1	Older Danfoss system; temperature rose only ~2–3 °C and was fixed in ~10 minutes
Netherlands	Unnamed businesses	At least 17	Butchers and local shops, per Danfoss
Finland	Kesko	A few small stores	Unusual temperatures, cause under investigation
Portugal / Italy	Intermarché (7); Coop (Radenza, 4+)	—	Reported by AFP

Swedish ICA franchise staff described freezers reaching 50 °C. In Belgium, Sabcobel, the contractor managing Delhaize’s systems, said attackers switched cooling units into defrost mode. At a butcher shop near Antwerp, fridges were reportedly pushed to 18 °C, and the owner estimated about €15,000 of meat was lost.

Root cause: exposed, aging supervisory controllers

What is confirmed

• Supermarket cold aisles are typically run by controllers that can be reached over the internet so maintenance firms can adjust them and receive alerts. These devices were the reported target in both waves.
• Danfoss told reporters after the French attack that affected units were running outdated firmware, and that many were legacy products that no longer receive security updates. Danfoss named the AK-SM 800 and AK-SC 355; reporting indicates AK-SC 355 support ended in 2016 and AK-SM 800 in 2021.
• CERT-FR’s alert CERTFR-2026-ALE-012 covers Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB. It states that attack campaigns against them are probably still underway.
• On 2 November, Danfoss told Dutch broadcaster NOS that the Dutch systems hit were not on a secure network and still used default passwords. A Danfoss spokesperson also told VTM that the weakness lies mainly in outdated software.
• Sabcobel said that in Belgium, attackers got into individual supermarkets’ systems rather than the contractors’. ICA said its affected stores used an outside supplier’s Danfoss control system connected outside ICA’s central network.

Known vulnerabilities (context, not confirmed entry points)

In research published in August 2026, Claroty’s Team82 described flaws in Danfoss AK-SM 800A supervisory controllers, which Danfoss had already fixed. Team82 scanned Shodan and Censys and found 2,765 AK-SM 800A devices reachable from the public internet. After the French attack, Reuters reported locating at least 4,500 Danfoss refrigeration interfaces online, though how many ran vulnerable firmware was not established.

CVE	Issue	Notes
CVE-2025-41450	Improper authentication; a hidden date-based ‘code-of-the-day’ mechanism could bypass the admin password	CVSS 8.2 (High). Danfoss advisory DSA-2025-03-01; AK-SM 8xxA before v4.2
CVE-2025-41451	Command injection (SMTP notification feature), requires authentication	Fixed in R4.3.1; advisory DSA-2025-08-01
CVE-2025-41452	Configuration injection leading to denial of service, requires authentication	Fixed in R4.3.1; advisory DSA-2025-08-01

Important caveat: The Register reported that authorities have not identified the entry point or confirmed exploitation of these CVEs. Danfoss says most French victims ran end-of-life AK-SM 800 and AK-SC 355 units, which these fixes do not cover. Sources that state the CVEs were ‘exploited in the wild’ in these incidents should be treated with caution until ANSSI, CERT-FR or Danfoss say so.

Attack methodology

Public detail is thin and mostly comes from vendors, contractors and retailers, not forensic reports. What is consistent across reporting:

1. Initial access: Remote access to internet-reachable management interfaces, apparently via weak, default or bypassable authentication on outdated firmware. Whether this was scripted mass scanning or targeted selection is not public.
2. Action on objective: Changing controller behaviour, either forcing the built-in defrost function to run continuously (normally a short, scheduled cycle) or raising setpoints to about 50 °C. The ‘weapon’ is a legitimate feature misused, which is why no malware has been reported.
3. Timing: Overnight, when stores were largely unstaffed, so the damage ran for hours before anyone noticed. In France, reporting says it ran for roughly six hours.
4. Not reported: Lateral movement, privilege escalation to enterprise IT, data theft or ransom demands. Absence of reporting is not proof they did not occur; it only means they are not publicly documented.

Danfoss said the Dutch attacks were the same kind as the French one, Sabcobel said the same method was used in Belgium, and Kitman said the Estonian method was similar. As The Hacker News noted, a shared method does not by itself show the same people were responsible.

Threat actors and attribution

Confirmed: Nothing. No group or individual has claimed either wave, and no government agency has attributed them. Belgium’s Centre for Cybersecurity said it is not known who is behind the attacks and that it may never be determined.

Unverified assessments: In October, a French cybersecurity expert quoted by Reuters said a destabilisation operation to instil fear was most likely and named Iran and Russia as the two state actors known for such activity. That is one analyst’s opinion, not attribution. Other observers note the low barrier to entry means opportunistic or non-state actors cannot be ruled out. A Danfoss newsletter from October 2025 referenced earlier incidents involving its controllers, including supermarkets in Russia early in the invasion of Ukraine and about 40 stores in Israel lacking adequate firewall or VPN protection (as reported by The Record), and Reuters noted a similar episode at about a dozen US military commissaries in late August. These precedents show the technique is not new; they do not link any actor to the European incidents.

Impact assessment

• Operational: Fresh and frozen ranges were pulled in affected stores; Delhaize said ranges were temporarily limited while its distribution centres kept running. Some stores used refrigerated trucks to preserve stock, per BleepingComputer. SuperValu pulled chilled and frozen goods from 13 stores as a precaution.
• Financial: In France, retail executives warned of tens of millions of euros in losses; two stores in Alsace reported €270,000 between them, according to BFMTV. No consolidated figure exists for the November wave. Individual losses so far are modest by comparison (for example, about €15,000 at one Belgian butcher), but counts are still being compiled.
• Safety and physical: Fires and equipment damage were reported at some French stores; in November, no comparable fire reports appeared in the sources reviewed. Food-safety rules in the EU generally require write-offs once cold-chain integrity is in doubt.
• Regulatory and political: EU agriculture commissioner Christophe Hansen called the repeated attacks a deliberate effort to disrupt the food supply chain and shake consumer confidence. The Record notes that the EU Cyber Resilience Act will tighten manufacturer obligations from December 2027, but there is currently no legal requirement for manufacturers to fix products like these.
• Reputational / contractual: Coopérative U’s president pointed to the refrigeration contractors rather than Danfoss as the relevant customers, and France’s retail federation called for transparency from Danfoss, highlighting an unresolved question about who owns security in outsourced OT.

Why this matters for IT, OT, IoT and critical infrastructure

• It is an OT incident in IT clothing. Supervisory controllers for refrigeration sit between corporate networks and physical equipment, often managed by third-party contractors, with long lifecycles and weak vendor support after end of life. Facilities Dive noted that these devices commonly rely on protocols such as Modbus, which were designed decades ago without security in mind.
• Ownership is split. Retailers, contractors, installers and manufacturers each hold a piece of the risk. Several affected stores were franchise or independent, outside central IT protections, as ICA and Kesko both indicated.
• Alarms did not stop it. Reporting says the French attack did not trigger the alarms that would normally prompt a response, and Claroty research presented at DEF CON in August reportedly showed a compromised AK-SM 800A could disable cooling while falsifying readings. Treat that second point as researcher-reported until you review the primary material.
• Food is critical infrastructure. Under the EU’s NIS2 framework, food production, processing and distribution are regulated sectors, and cold-chain tampering is a safety event, not just an availability one.
• Direct blast radius is limited, but the pattern is the point. The same exposure applies to cold storage, pharmacies, hospitals and other sites using similar supervisory controllers.

Incident response and recovery

• Retailers: Most affected chains kept stores open and removed compromised stock. Musgrave said the SuperValu incident was resolved by Monday afternoon with restocking under way. Coop said the situation was contained.
• Contractors: Sabcobel began mobilising technicians at 1 a.m. and knows of about 20 affected units across the hundreds it manages in Belgium. Its CEO said some units need physical changes, not just a software update. After the French attack most of its customers had moved to a secure remote-access arrangement.
• Manufacturer: Danfoss said it is working with affected customers. On 13 October it advised Dutch customers to disconnect systems from the internet and reconnect only through a secure network. When The Hacker News checked on 3 November, Danfoss had published no new advisory on these attacks.
• Authorities: CERT-FR’s alert is the most detailed public guidance. Sweden’s National Cybersecurity Centre said it is following the incidents and sharing information with Nordic and European partners.

Security recommendations

The first group reflects CERT-FR’s published guidance as summarised by The Hacker News and Danfoss’s public advice. The second is OT Ecosystem analysis.

Immediate actions (from CERT-FR and vendor advice)

1. Remove internet exposure. Make sure controllers have no public IP address and are not reachable directly from the internet.
2. Audit configuration. Check the full configuration, especially defrost schedules and setpoints.
3. Restrict remote access. Restore access only through a secure VPN or protected network. Filtering contractor IP addresses at a firewall is an emergency measure, not a lasting fix.
4. Harden devices. Update firmware, change default passwords and, on Danfoss devices, set the security level to Strict.
5. If compromised: Restart or factory-reset, then reconfigure before returning to service.
6. End-of-life devices: CERT-FR warns those remaining internet-facing are very likely to be compromised, and a factory reset alone leaves them open to re-attack. Replace them.

Longer-term (OT Ecosystem analysis)

• Inventory what you actually have. Ask contractors for a list of every connected refrigeration controller, its model, firmware version and how it connects (fixed line, 4G, vendor cloud). Sweden’s NCSC advises listing which devices are internet-connected and deciding whether each needs to be.
• Independent monitoring. Use temperature sensors and alerting that do not depend on the same controller or network, so a manipulated controller cannot also hide its effects. Route alerts out of band to on-call staff.
• Hardware safeguards. Where possible, add independent high-temperature cut-outs or limits that software cannot override remotely.
• Contract for security. Write patching, remote-access method, logging and end-of-support replacement into contractor agreements, and decide who pays when hardware must change.
• Rehearse the failure. Add a ‘cold chain tampering’ scenario to incident-response plans: who can verify store temperatures, how stock is quarantined, and who contacts regulators and insurers. Preserve controller event logs before any restart so investigators can reconstruct what happened.
• Plan for the product lifecycle. Track vendor end-of-service dates for OT devices and budget replacement ahead of them.

Latest developments and open questions

Latest (as of 3 November 2026):

• Belgium’s federal prosecutor has opened a criminal investigation.
• Belgium’s CCB said it has no further information and that AI can make exploitation of weaknesses easier, especially for sophisticated actors.
• CERT-FR’s alert was last updated on 16 October when checked by The Hacker News on 3 November.
• IKEA said it cannot rule out that further locations were affected as its investigation continues.

Still unknown: the precise initial-access method in either wave; whether the same actor was behind both; whether specific CVEs were exploited; the total number of victims and losses in November; and motive.