Hackers strike European supermarkets with second refrigeration cyberattack wave

Hackers struck refrigeration controls at European supermarkets overnight into Monday, Nov. 2, 2026, warming units and forcing stores to discard chilled and frozen food. The attacks hit stores in eight countries, including Sweden, the Netherlands, Belgium, Ireland, Luxembourg, Estonia, Portugal and possibly Finland.

In Belgium, attackers switched cooling units into defrost mode, causing units to heat up instead of keeping food cold, Sabcobel chief executive Stephan Moelans said. Carrefour said 15 of its more than 700 stores in Belgium were affected and described the effect as very limited. A butcher shop in Hove had fridges turned up to 18 degrees C, and the owner estimated about 15,000 euros worth of meat was ruined.

Musgrave, owner of SuperValu, identified 13 of its 223 stores in Ireland as affected by a suspected cyber attack tied to a single refrigeration model and pulled chilled and frozen products from sale at those stores, with restocking underway. In Sweden, an ICA store in Sjobo said its fridges and freezers were set to 50 degrees C and staff threw out affected goods. The chain said its affected stores used an outside supplier connected to a network outside its central network. Coop reported seven of its 800 stores in Sweden were affected by unauthorized tampering with refrigeration controls, and Danfoss was among its suppliers.

At a Selver supermarket in Estonia, a freezer was set to 50 degrees C but rose only about 2–3 degrees C. At least 17 businesses in the Netherlands had refrigeration systems hit, Danfoss confirmed, mainly butcher shops along with small independent grocery stores. Danfoss said its products were involved in the November attacks, as they were in the French attack three weeks earlier.

Hackers seized refrigeration management systems at French supermarkets including Intermarche, Carrefour and Monoprix on the night of Oct. 11 into Oct. 12, 2026. The attack affected roughly 700 locations and pushed temperatures to 50 degrees Celsius. Food on an industrial scale was destroyed at several French stores where fires broke out, and the damage totaled tens of millions of euros within a single night.

Refrigeration controllers are computers connected to the internet so contractors can monitor and fix faults remotely. Many compromised units were older, discontinued models no longer eligible for security updates, including the Danfoss AK-SM 800, end-of-life since 2021, and the AK-SC355, retired in 2016.

On Aug. 9, 2026, Claroty researchers disclosed critical vulnerabilities in the Danfoss AK-SM 800A and Copeland XWEB Pro platforms. A disclosed flaw let unauthenticated attackers seize remote control of affected units through a hidden mechanism that bypasses authentication. Danfoss issued firmware patch R4.3.1 and Copeland issued firmware 1.13, but many operators never applied them.

A Danfoss spokesperson said hit Dutch systems lacked a secure network and kept default passwords. Censys counted more than 1,000 Danfoss StoreView management interfaces reachable directly from the public internet around the world.

CERT-FR’s Oct. 16, 2026 alert covers Danfoss AK-SM and AK-SC series controllers and Copeland xweb and Dixell xweb, and the agency says campaigns targeting these devices are likely still in progress. CERT-FR advises operators to keep refrigeration devices unreachable from the internet and restore access only through a secure VPN (virtual private network) or protected network, changing default passwords, setting Danfoss security level to Strict, and following maker firmware update practices. For compromised devices, CERT-FR advises restarting or factory-resetting the Danfoss device and reconfiguring it before returning it to service, though end-of-life devices that stay online are very likely to be compromised again even after a factory reset.

A joint advisory issued on Thursday by five US federal agencies said actors target controllers that regulate temperatures in freezers and cold storage rooms, and might drive those units into nonstop heating and defrost cycles. The UK’s National Cyber Security Centre said it was working with affected organizations and that national impact was minimal, and no UK grocery chain had been directly affected by the refrigeration attacks. “At the moment, the impact is minimal,” Paul Chichester said. The NCSC said the attacks were not AI-enabled and exploited vulnerabilities that have been around for a long time.

Lupovis recorded 256 attempted attacks from 91 sources between Oct. 20 and Oct. 30, 2026, on honeypot traps mimicking Danfoss fridge controllers. Lupovis said the probing infrastructure overlapped with systems previously associated with Russian-linked malicious operations but could not pinpoint a group. No group had claimed the November attacks by Monday night, and Belgium said identifying those responsible may never be possible. Belgium’s federal prosecutor’s office opened a criminal investigation into the November incidents.

French Prime Minister Sebastien Lecornu tasked ANSSI with leading the investigation into the October French attack, expanded to include European partners. ENISA said large-scale attacks across several member states highlight the need for European cooperation, quick information exchange and coordinated responses. European policymakers are speeding up talks on required cybersecurity rules for food supply infrastructure after the twin attacks.

Security professionals are calling on retailers to audit operational technology devices (industrial computers and sensors that run physical equipment) connected to external networks and replace end-of-life controllers that cannot be patched, keeping refrigeration management systems off the public internet. Deloitte cybersecurity expert Frank Groenewegen said retailers should identify vulnerable refrigerator controllers and check whether they connect to the internet, install the latest security updates and remove systems from the public internet if they do not know their status.