On the night of November 1 to 2, 2026, attackers took remote control of refrigeration systems in supermarkets across Europe and switched fridges and freezers to defrost. By morning, more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia had warm freezers and spoiled food. This was the second wave. Three weeks earlier, the same method hit hundreds of supermarkets in France. No data was stolen and no ransom was demanded. The attackers simply turned off the cold.
Key takeaways
- Attackers reached refrigeration controllers that were exposed to the internet and set them to defrost overnight.
- More than 115 stores in at least six countries were affected on November 2, after up to 700 French stores were hit on October 11.
- The weak points were old controllers, some no longer supported by the maker, and logins that were easy to bypass.
- No one has claimed responsibility.
- The fix is to take these controllers off the open internet, update or replace them, and set up temperature alerts.
In plain English
Think of a supermarket freezer like a smart thermostat at home. It can be controlled from a phone or laptop. In these stores, that remote control was left open on the internet, and some of them still used the factory login. Attackers found them, logged in at night and pressed the equivalent of “defrost”. Nobody was in the store to notice until the morning, when the food was already warm.
What happened on November 2?
Overnight on Sunday, November 1, refrigeration units in dozens of supermarkets began warming up. Staff found the problem early on Monday morning. In some Swedish stores, freezer temperatures had been set to +50°C and could not be changed back. Sabcobel, a Belgian refrigeration company whose systems served several of the affected stores, said the attack began around midnight. Its technicians started disconnecting installations at about 1 a.m.
Which stores and countries were affected?
Figures below are from BleepingComputer, based on reports on November 2. Counts may change as investigations continue.
| Country | Retailer | Stores reported affected |
|---|---|---|
| Belgium / Luxembourg | Ahold Delhaize | About 40 |
| Belgium | Carrefour | 15 (of about 700) |
| Belgium | Intermarché | About 15 |
| Belgium | Spar (independent operators) | About 5 |
| Ireland | SuperValu | 13 |
| Sweden | Coop | 7 |
| Sweden | ICA | At least 4 |
| Netherlands | Butcher shops and local stores | At least 17 |
| Estonia | Selver | 1 |
An IKEA store in Mons and several chocolate shops in Belgium were also reported affected. The BBC reported cases in Finland. ICA said only stores whose refrigeration connections sat outside its central network were hit, and that it could not confirm a cyberattack as the cause.
How did the attack work?
Supermarket fridges and freezers are run by controllers, small computers that set temperatures and defrost cycles. Many of these controllers have a web page so technicians can manage them remotely. In the affected stores, that page was reachable from the open internet.
During the October attack in France, investigators identified these controllers:
- Danfoss AK-SM800 and AK-SC355. The AK-SC355 reached end of life in 2016 and the AK-SM800 in 2021. Danfoss released a fix for the AK-SM800A series in August 2025, so only units that were never updated were exposed.
- Copeland and Dixell XWEB controllers.
Security firm Claroty reported weaknesses in these devices in 2025. One was a hidden login bypass that accepted the device’s date in place of a password. Many units also still accepted “admin” as the username. Once logged in, an attacker could switch the evaporators to defrost mode. Overnight, with few staff on site and no alarms set, temperatures climbed for hours.
The attack, step by step:
Sabcobel said the November attackers used the same weakness as in France. It added that a software update alone is not a complete fix, because some units also need physical changes.
What happened in France in October?
On the night of October 11, 2026, the same method hit French supermarkets. Retailers included:
- Intermarché and Netto (over 300 stores)
- Coopérative U (80)
- Carrefour (80)
- Monoprix (around 30)
- E.Leclerc (several stores)
Some units reached 50°C, and one store in Normandy reported 80°C. Some equipment melted or caught fire. Whole aisles of food were thrown away, and losses are estimated in the tens of millions of euros. France’s cybersecurity agency ANSSI issued an alert, CERTFR-2026-ALE-012, covering the affected controllers.
When did each attack happen?
The attacks came in waves, and the weaknesses were public long before the first one.
| Date | What happened |
|---|---|
| March 2025 | Danfoss publicly discloses vulnerabilities in its supermarket controllers, found by Claroty. |
| August 2025 | Danfoss releases a fix for the AK-SM800A series. Older models get no fix because they are end of life. |
| October 11, 2026 | Overnight attack hits up to 700 supermarkets in France. ANSSI issues an alert. |
| November 1–2, 2026 | Second wave hits more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, with reports from Finland. |
Who is behind it?
No one knows yet, and no group has claimed responsibility. Some researchers point out that the method is simple enough for low-skilled attackers. Until investigators publish findings, any attribution is speculation.
Why does this attack matter?
It shows that a cyberattack can cause physical damage without touching a single computer. The targets were not company networks but forgotten devices: building equipment often installed and managed by outside contractors, rarely updated, and left online for convenience. Many businesses have similar systems, such as heating, cameras, door access and fridges, that nobody tracks as part of IT security.
How can businesses protect refrigeration and building systems?
- Find every internet-connected device, including equipment managed by contractors.
- Take management interfaces off the open internet. Use a VPN or a secure remote-access service instead.
- Update firmware, and replace end-of-life controllers that can no longer be fixed.
- Change default logins and remove shared accounts.
- Separate building systems from the main network with network segmentation.
- Set up independent temperature alerts that text a manager when readings go out of range.
- Add security requirements to contractor agreements, covering patching, access and incident reporting.
Quick check: is your business exposed? If you answer “no” or “not sure” to any of these, act this week.
- Do you know every device in your premises that connects to the internet, including fridges, heating, cameras and door locks?
- Are their control panels hidden from the open internet?
- Has every factory password been changed?
- Is the equipment still supported by the manufacturer with updates?
- Would someone get an alert at 2 a.m. if a freezer warmed up?
To see where your business stands, take the free cybersecurity readiness assessment. For other incidents this year, see our guide to major cyberattacks and data breaches. For a broader plan, read cybersecurity for businesses.
What do the technical terms mean?
| Term | Simple meaning |
|---|---|
| Controller | The small computer that runs a fridge or freezer and its defrost cycles. |
| Defrost mode | A normal setting that warms the cooling coils to melt ice. Left on for hours, it warms the whole unit. |
| Internet-exposed | Anyone on the internet can reach the device’s login page, not just staff or technicians. |
| End of life | The maker no longer releases security fixes for the product. |
| Default credentials | The factory username and password, often printed in public manuals. |
| OT (operational technology) | Computers that control physical things, such as machines, heating and refrigeration. |
Frequently asked questions
Was customer data stolen?
No data theft has been reported. The attack changed fridge and freezer settings and caused food losses.
Is food from affected stores safe?
Stores said they threw out products that warmed up. Some moved stock into refrigerated trucks.
Were these devices already known to be vulnerable?
Yes. The weaknesses were reported in 2025, and some affected controllers had not been supported for years.
Could this happen outside Europe?
Yes. The same controllers are used worldwide. Any business with internet-exposed refrigeration or building controls is at risk.
Who is responsible?
It is unknown. No group has claimed the attacks.
Sources: BleepingComputer, Help Net Security, TechCrunch. This article will be updated as investigations continue.
