Fridge hack hits supermarkets in eight European countries, freezers set to 50°C
A second wave of attacks set supermarket freezers to 50°C across eight European countries into Nov 2. No ransom, no claim — sabotage of exposed controllers.
Overnight into Monday, November 2, refrigeration systems in supermarkets across eight European countries — Belgium, Sweden, Ireland, Estonia, the Netherlands, Finland, Portugal and Italy — were remotely reprogrammed: some units were switched into defrost mode, others had their target temperature set to 50°C, and fresh and frozen stock went into the dumpster in batches. It is the second wave of attacks on supermarket refrigeration, after the first hit up to 700 French supermarkets around October 12. The affected systems are largely old, end-of-life controllers such as the Danfoss AK-SM 800 and AK-SC 355, alongside Copeland and Dixell xweb units at some sites. By Monday night no one had claimed the attacks and no ransom had been asked. Belgium’s federal prosecutor has opened a criminal investigation.
Key points
- Eight countries affected: several dozen Delhaize stores, about 15 of Carrefour Belgium’s 700-plus, 13 of SuperValu’s 223 in Ireland, 6–7 of Coop Sweden’s roughly 800, and at least 17 mostly small shops in the Netherlands (The Guardian, The Hacker News, November 2–3, 2026).
- The method: in Belgium, evaporators were switched to defrost mode; an ICA store in Sjöbo, Sweden and a Selver in Estonia had freezers set to 50°C outright. Technicians were dispatched from 1 a.m. to disconnect installations.
- CERT-FR, the French ANSSI’s incident response team, published alert CERTFR-2026-ALE-012 on October 12 (updated October 16), naming exactly these systems — Danfoss AK-SM/AK-SC, Copeland xweb, Dixell xweb — and warning that “attack campaigns are probably still underway.”
Background
France was the first scene. In mid-October, refrigeration control systems at French chains including Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix were taken over, with target temperatures pushed from -27°C to above 50°C; industry losses were reported in the tens of millions of euros, with single stores losing tens of thousands up to more than €130,000. The Paris prosecutor’s office opened an investigation, and the French prime minister tasked ANSSI with it. Most of the equipment came from Denmark’s Danfoss, which says it identified the flaws a year earlier and has long recommended customers install updates. The CERT-FR alert went out October 12, added Copeland xweb and Dixell xweb on October 13, and revised its guidance on October 16 — the second wave landed about two weeks after the alert.
The facts
The second wave’s footprint, as reported by the outlets and the retailers themselves:
| Country | Retailers | Scale | What happened |
|---|---|---|---|
| Belgium/Luxembourg | Delhaize, Carrefour, Intermarché, Colruyt, Spar, IKEA Mons | dozens down to 5 stores | Evaporators switched to defrost; a Hove butcher’s chillers rose to 18°C |
| Sweden | Coop, ICA | Coop 6–7; ICA “a limited number” | An ICA in Sjöbo had freezers set to 50°C |
| Ireland | SuperValu (Musgrave) | 13 of 223 | One refrigeration model; chilled and frozen goods pulled |
| Estonia | Selver | 1 store (its last on the old system) | Set to 50°C; temperature rose 2–3°C before correction within ~10 minutes |
| Netherlands | unnamed businesses | at least 17 | Mostly butchers and small shops, per NOS |
| Finland | Kesko | a few small stores | Checking similar problems |
| Portugal | Intermarché/Mosqueteiros | 7 | Abnormal warming |
| Italy | Coop/Radenza Group | at least 4 in Sicily | Abnormal warming |
On the equipment side, CERT-FR names Danfoss AK-SM 800 and AK-SC 355, both end-of-life, plus Copeland xweb and Dixell xweb. After the French wave, thousands of these controllers were still reachable from the public internet, by a Tributech researcher’s estimate cited in The Guardian. Dutch victims’ setups had no dedicated secure network and were running default passwords, The Hacker News reports from local coverage. The De Laet & Van Haver butcher shop in Hove, near Antwerp, put its own loss at about €15,000. As of Monday night there was no claim of responsibility and no financial demand, and Danfoss had published no advisory of its own as of November 3. Belgium’s federal prosecutor confirmed a criminal case; the country’s cybersecurity center CCB says attribution is unknown and “may never be determined.”
What others say
CERT-FR’s alert is blunt: keeping an internet-exposed end-of-life device without security patches online leaves it with “a very high probability of compromise,” and a factory reset alone is “insufficient” — persistence gets wiped, but the device stays vulnerable and will be compromised again. Rafe Pilling, senior director of threat intelligence at Sophos, gave The Guardian two readings: a state-backed actor signaling with empty shelves, or a lone hacker with personal motives — and he leans toward the former, arguing the psychological impact is part of the point. He also noted why attribution is hard: no malware was involved, so the operation was “like wearing rubber gloves and messing with the switches.” The European Commission called it “a deliberate attempt to disrupt our food supply chain.” Danfoss’s response, relayed via Belgian broadcaster VTM and picked up by Euronews, is that the weakness lies mainly in outdated software and that the customers affected were the ones who had not installed updates. Belgian refrigeration contractor Moelans, quoted by The Hacker News, supplied two more facts: the attackers got into individual supermarkets’ own systems, not the contractor’s, and a software update alone won’t fix that, because the installations “need physical changes that cost money.”
Our take
The wave drags an OT-security lesson out of the factory and into the grocery aisle: keep management interfaces off the public internet, kill default credentials, and budget for replacing gear that no longer receives firmware. Firmware lag is a theme we have covered twice recently: the PXE buffer overflow hidden in EDK2 firmware for 16 years sits in the same spot — patch shipped, devices never updated — and CISA adding the PHP2Shell RCEs to its KEV catalog shows attackers hunting exactly that window. The comparison with the 2021 Oldsmar water-treatment incident in Florida — where an attacker remotely pushed a chemical-dosing setpoint up — is direct: networked control systems, loose access paths, physical consequences. Oldsmar was caught by an operator watching the screen; this one landed in eight countries at once. For anyone running their own infrastructure, CERT-FR’s checklist reads ready to copy: no management exposure to the internet, access via VPN only, Danfoss security level set to Strict, default passwords changed, defrost schedules reviewed, firmware updated. What nobody has answered is why: with no ransom and no claim, the attack breaks the assumption underneath most IoT security models — that intruders want money. You can insure against ransom with backups; against someone who just wants you to throw away every fresh product, the only defense is the checklist above.
What to watch
- Sweden’s national cybersecurity center is coordinating with Nordic and European agencies and reports “quite a lot of exposed OT devices” domestically that need patching.
- Estonia’s Selver says its last store on the old controller system has now been retired onto the new one after the incident.
- UK retailers are working with the NCSC to check exposure; Forescout’s research puts the UK outside the ten most-exposed countries.