Store fridge hacks reach 7 countries: what to take offline
Attackers set shop freezers to defrost overnight in seven countries. Any business with remotely managed equipment should check how it is reachable.
The short read
Overnight, attackers set supermarket freezers in seven European countries to defrost, some reportedly reaching 50C.
- Danfoss says the Dutch units hit used a default password off any secured network, weeks after it told customers to disconnect them.
What you can do with this
Ask whoever services your refrigeration or HVAC whether the controller has a public IP address. If it does, move remote access behind a VPN and change the default password.
Overnight into November 2, attackers reached refrigeration controllers in shops across seven European countries and switched them to defrost, the BBC reports. France’s cyber agency had named the targeted controllers and the fix three weeks earlier. If any equipment in your business is serviced remotely, the same check applies to you.
About 40 Delhaize stores in Belgium and Luxembourg were hit, plus shops in Sweden, Ireland, the Netherlands, Estonia and Finland.
A second wave, three weeks after France
The method matches last month’s attack in France, where more than 300 stores were affected, according to BFM TV as cited by SecurityWeek. Sabcobel, which makes some of the affected units and runs Delhaize’s systems, said their evaporators were switched to defrost mode, the BBC reports. Temperatures in some shops reportedly reached 50C.
A Belgian butcher chain, De Laet & Van Haver, told NOS that settings were changed from outside around 03:00. The anti-ice cycle that normally blows a little warm air never switched back to cooling. Its affected units were Copeland systems, so this is not one vendor’s problem.
The losses are concrete. One Delhaize branch in Hoeilaart put its spoiled stock at €100,000, the BBC reports, citing Het Laatste Nieuws. Carrefour counted 15 Belgian stores, Coop 7 of its 800 in Sweden, and Musgrave 13 SuperValu shops in Ireland.
Why these units were reachable
A Danfoss spokesperson gave NOS the plainest explanation. In the Netherlands, systems at at least 17 businesses were attacked, most of them at butchers and small neighborhood shops. Danfoss had told Dutch customers on October 13 to disconnect the systems from the internet and reconnect only through a secured network, and most did. The units hit overnight were not on a secured network and had a default password, the spokesperson said, and the attack could have been prevented.
ICA in Sweden said its affected stores were ones “operating outside ICA’s central network.” That pattern matters more than the brand of fridge. Controllers go online so technicians can fix faults remotely, and in our view a web login on a public address is the easiest way to allow that.
Patching alone does not close the gap. In August, Claroty found 2,765 Danfoss AK-SM 800A interfaces exposed online, with a hidden “code of the day” password derived from the device’s date and time; firmware R4.3.1 fixes it. Sabcobel CEO Stephan Moelans told Belga that some units need physical changes, not only software updates. It is still unclear who is behind the attacks, the BBC reports.
What to do now
The steps below come from CERT-FR’s alert, which names Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb controllers. They apply to any remotely managed controller.
- Find out how it is reached. Ask the contractor who services your refrigeration or HVAC whether the controller has a public IP address. If it does, take it off the internet.
- Read your insurance contract first. CERT-FR says to check its terms before you cut the data feed to your refrigeration contractor.
- Restore access through a VPN or protected network only. Allowing just the contractor’s IP addresses on your firewall works in an emergency, but CERT-FR says it is not a lasting fix.
- Check every setting, defrost schedules included. Then update the firmware and change default passwords; for Danfoss units, CERT-FR also says to set the security level to Strict.
- Keep end-of-life units offline. A factory reset removes an attacker’s foothold, but CERT-FR says an unpatched device left exposed “will certainly be compromised again” (our translation).
The trade-off is convenience: a VPN adds a step every time a technician logs in. The Dutch shops that skipped it after October 13 are the ones that were hit, Danfoss says.
Sources
- BBC News, “Shop freezers in seven European countries hit by suspected cyber-attack,” November 2, 2026: https://www.bbc.com/news/articles/cq1kd1nee80eo
- NOS, Danfoss on 17 Dutch businesses and default passwords, November 2, 2026: https://nos.nl/artikel/2637734-ook-koelsystemen-in-nederland-aangevallen-bij-17-bedrijven-temperatuur-aangepast
- NOS, Belgian, Luxembourg and Swedish chains hit, November 2, 2026: https://nos.nl/artikel/2637705-opnieuw-hack-bij-supermarktketens-koelingen-in-belgie-luxemburg-en-zweden-op-tilt
- CERT-FR, alert CERTFR-2026-ALE-012 on refrigeration remote controllers, October 12, updated October 16, 2026: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-012/
- Claroty Team82, vulnerabilities in Danfoss AK-SM 800A, August 9, 2026: https://blog.claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
- SecurityWeek, French refrigeration controller attack, October 13, 2026: https://www.securityweek.com/refrigeration-controller-hack-spoils-food-across-european-supermarkets/
