Insights on Europe’s Supermarket Refrigeration Cyber-Attacks

Hackers have remotely pushed supermarket freezer temperatures as high as 50°C in at least ten European countries, forcing retailers to throw away large quantities of food. Early findings point not to sophisticated malware but to refrigeration controllers left open on the internet, a weakness shared by many organizations that run connected equipment.

SUMMARIZE WITH AI

Distinguishing AI-Assisted Detection from Automation Technical Definitions and Use Cases

Ebryx Marketing

Nov 05, 2026

Key Takeaways

1. On 2 November 2026, attackers tampered with refrigeration systems in supermarkets across at least 10 European countries, pushing temperatures as high as 50°C.
2. The wave followed an October attack on around 700 French supermarkets, in which Danfoss controllers were hijacked.
3. Officials point to internet-exposed interfaces, weak authentication and outdated or end-of-life firmware.
4. No group has claimed responsibility, and investigations are under way in several countries.
5. Any business running connected operational technology (OT) should audit its internet exposure now.

What Happened

In the early hours of Monday 2 November, store staff across Europe began finding freezers and chilled cabinets blowing warm air. According to the BBC, supermarkets in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany and Sweden reported problems, and temperatures in some units were said to have reached 50°C (122°F). Some store managers said they could not override the settings, and large amounts of chilled and frozen stock had to be discarded.

The impact varied by country:
1. Belgium: among the hardest hit, with dozens of stores reporting cooling failures. Federal prosecutors have opened an investigation. Ireland: 13 SuperValu stores were affected by what owner Musgrave Group called a “cyber-incident.”
2. Portugal: seven Intermarché stores were linked to an attack that “appears to have targeted an external service provider responsible for managing the refrigeration systems.”
3. Germany: cooling at a Rewe supermarket in western Germany was disrupted after an attack on systems supplied by Danfoss.
4. Italy: at least four Co-op supermarkets in Sicily and one business in Tuscany were affected, according to the national cybersecurity agency.
5. Netherlands, Sweden, Finland and Estonia: corner shops, butchers and a limited number of stores belonging to larger chains reported abnormal temperatures. In Estonia, hackers reportedly set the units at one supermarket to 50°C.

In the UK, the National Cyber Security Centre (NCSC) urged retailers to update the software on refrigeration temperature controls. NCSC chief Richard Horne told the BBC there were “a couple of instances where vulnerable technology has been exploited.” He said the risk covered “the whole food supply chain,” not just supermarkets.

Not the First Time: The French Precursor

The November wave came three weeks after a similar attack in France. On the night of 11 October 2026, attackers took remote control of cooling systems in about 700 French supermarkets, according to French Finance Minister Roland Lescure. Stores belonging to Intermarché, Netto, Carrefour, Coopérative U and Monoprix were among those reported affected. The controllers were switched into defrost mode overnight, when many stores were unstaffed, and some cabinets reached around 50°C. Parts of the equipment melted or caught fire, and sprinkler systems caused further water damage. Food losses were estimated in the tens of millions of euros.

Within days, France’s national cybersecurity agency, ANSSI, issued an alert through CERT-FR about compromised Danfoss AK-SM and AK-SC controllers and urged operators to disconnect them from the network. Danfoss said most affected units were legacy models, such as the AK-SC 355 (phased out in 2016) and AK-SM 800 (end of life since May 2021), along with some newer AK-SM 800A units that had not received the latest firmware update.

Timeline of the refrigeration attacks, October–November 2026.

How the Attacks Worked: A Cybersecurity Breakdown

Investigations are still under way, but official statements and vendor disclosures point to a familiar pattern. Italy’s government said the affected businesses were “mostly still equipped with obsolete security systems, with interfaces directly exposed to the internet and inadequate authentication mechanisms.”

1. Internet-exposed OT devices Keep the Window Small:
Supermarket refrigeration is managed by networked controllers with web-based dashboards that let engineers adjust setpoints, defrost cycles and alarms remotely. When these interfaces are placed directly on the internet, search engines for connected devices such as Shodan and Censys index them quickly. Researchers counted thousands of Danfoss controllers reachable from the internet as the attacks spread

2. Weak authentication and known vulnerabilities Subagents and Compaction:
Many legacy controllers rely on simple logins, shared or default passwords and no multi-factor authentication. Reports since the French attack indicate that numerous units could be accessed with the username “admin” and a password based on the current date. This resembles CVE-2025-41450, an authentication bypass in the Danfoss AK-SM 8xxA series caused by a hidden date-based “code of the day” login, which Danfoss disclosed in 2025 after research by Claroty Team82. A second flaw, CVE-2025-41451, allows command injection on the same product line. Firmware fixes for both have been available since 2025. It has not been confirmed that these specific flaws were exploited in the 2026 attacks, but they show how easily an unpatched controller can be taken over.

3. End-of-life equipment that can’t be patched
Danfoss and Copeland both said the targeted devices were mainly discontinued products that no longer receive security updates. An installer in Belgium said some affected units needed physical changes, not just a software update. Legacy equipment often stays in service for years after vendor support ends: the AK-SC 355 was still running in French stores a decade after it was phased out.

4. Third parties as the entry point
In Portugal and Germany, the attacks reportedly reached stores through an external refrigeration service provider and a supplier’s systems, rather than through the retailers’ own networks. Refrigeration, HVAC and building-management contractors often hold remote access to hundreds of sites at once, which makes them a valuable target.

Likely attack chain, from discovery of an exposed controller to physical damage.

Why This Matters Beyond Supermarkets

These incidents show how quickly a cyber-attack can cause real-world, physical harm. No ransom demand or data theft has been reported, yet the attacks caused heavy financial losses, a food-safety risk and, in some cases, fires. Several points stand out for security leaders:

1. The food supply chain is critical infrastructure. The attacks have heightened concerns about government-backed “hybrid” attacks on essential services, although no attribution has been made.
2. AI is speeding up exploitation. Belgium’s Centre for Cybersecurity said it was concerned about a rising number of incidents, partly due to the targeted use of AI to find and exploit vulnerabilities. The UK NCSC has warned that an AI-powered attack on critical national infrastructure is likely within two years.
3. Regulation is still catching up. The EU Cyber Resilience Act will require manufacturers to support products with security updates from December 2027, but until then many devices may receive no patches at all.
4. The risk is not limited to fridges. HVAC, building management systems, CCTV, smart meters and industrial controllers can suffer from the same weaknesses.

What Organizations Should Do Now

Whether you run a retail chain, a warehouse, a hospital, a factory or an office building, these steps lower the risk of a similar attack:
1. Build a complete asset inventory of every connected OT and IoT device, including controllers managed by vendors.
2. Remove direct internet exposure. Scan your public IP ranges for exposed management interfaces and take them offline.
3. Secure remote access with a VPN or zero-trust gateway and multi-factor authentication. Never publish a management panel directly to the internet.
4. Patch, upgrade or replace controllers running outdated firmware, and plan to replace end-of-life equipment.
5. Remove default and shared credentials. Use unique, strong passwords for each site and each vendor.
6. Segment networks so that OT, point-of-sale and corporate IT cannot reach each other freely.
7. Review third-party access. Know which contractors can connect, from where and when, and log every session.
8. Monitor for abnormal behavior, such as unexpected setpoint changes or temperature drift, with alerts sent to staff who can act.
9. Prepare an OT incident response plan that includes manual overrides, food-safety procedures and regulator notification.

How We Can Help

Ebryx helps organizations identify security weaknesses and strengthen their defenses through:
1. External attack surface assessments that find internet-exposed devices, forgotten services and management interfaces before attackers do.
2. Vulnerability assessment and penetration testing (VAPT) of networks, web applications and cloud environments.
3. Network architecture and segmentation reviews that keep critical systems isolated from the internet and corporate IT.
4. Red team exercises that test how well your people, processes and technology hold up against real attack techniques.
5. Security awareness training that helps staff spot and report suspicious activity early.

The supermarket freezer attacks are a reminder that any connected device can become a target. Contact our team today to find out what your organization exposes to the internet and how to secure it.