Europe Supermarket Refrigeration Cyberattacks: What Retailers and Cold-Chain Vendors Should Do Now

Status: Developing incident, 2 November 2026. Attribution: none confirmed. No one has claimed responsibility.

Executive Summary

Overnight from 1 to 2 November 2026, supermarkets in at least seven European countries (Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden) saw temperatures in their fridges and freezers climb sharply. Several chains confirmed a cyberattack (AFP, The Guardian). Some stores reported temperatures as high as 50°C. Chilled and frozen food was thrown out, and some shops closed for a while or ran with empty cold shelves.

This is the second wave in three weeks. On 12 October 2026, France's CERT-FR issued an alert on "numerous compromises" of remote controllers for refrigeration installations. The alert names the Danfoss AK-SM and AK-SC series, Copeland XWEB and Dixell XWEB (CERT-FR CERTFR-2026-ALE-012). In this second wave, Swedish, Estonian, Dutch and Belgian sources again point to Danfoss-supplied refrigeration control systems. Danfoss told Danish broadcaster DR that the incidents reported in several European countries "also involve our products" (DR). Danfoss and its partners blame outdated or end-of-life software.

For third-party risk teams, this story is mostly about suppliers. In several of the reported cases the affected systems sat with an external refrigeration contractor, or connected outside the retailer's central network. That means the retailer's attack surface includes its refrigeration OEMs, installers and monitoring providers.

What Happened (2 November 2026 wave)

Belgium and Luxembourg. Ahold Delhaize said fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg were hit (The Guardian). A Delhaize spokesperson told Euronews: "We have identified an IT incident affecting the refrigeration systems in several dozen stores" (Euronews). Carrefour Belgium reported disruption in about 15 of its 700 stores, and spokesperson Mich Vergauwen said: "It's a cyberattack, there is no other reason." According to AFP, Delhaize said four Luxembourg stores were affected. Colruyt Group, which runs Spar in Belgium under franchise, said five Spar shops had their fridge systems attacked (Reuters via CP24). Intermarché also reported fridge problems. An Ikea Belgium spokesperson told AFP that a cyberattack had made freezer temperatures rise at its Mons store.

Stephan Moelans is CEO of Sabcobel, the refrigeration company that operates Delhaize's systems. He told Belga the incident was a cyberattack that switched the units' evaporators into defrost mode, and that "we've been working all night and morning to disconnect the affected units from the network" (Reuters via CNBC; also BBC). He told AFP that Sabcobel began securing its installations after the French attack, but that about 10% were still not fixed and some of those were in the stores hit on Monday. Per Euronews, he said a software update alone is not enough and physical modifications are needed.

The Centre for Cybersecurity Belgium (CCB) said: "We are aware of an incident, but have no further information" (Euronews). Belgium's federal prosecutor has opened a criminal investigation (Euronews; VRT NWS live blog). Belgium's food-safety agency FAVV/AFSCA reminded stores that they must check whether products went above their maximum temperatures.

Secondary, unconfirmed: Belgian store totals are media tallies, not official counts. Le Soir (via Euronews) counted about 40 Delhaize Proxy stores and about 15 Intermarché shops, Euronews put the Belgian total at about 75, and the BBC and VRT NWS reported around 40 Delhaize stores.

Sweden. Coop confirmed a cyber incident. Spokesman Carlos Cancino told AFP: "We can confirm that it is a cyber incident. The problem has now been resolved." He said the affected stores were on a 4G mobile connection rather than the updated 5G system, which made them "more exposed." The figure is six stores according to AFP and Aftonbladet, and seven according to the BBC. ICA said "a limited number of stores" were affected, did not confirm a cyberattack as the cause, and said the affected stores used an external supplier with connectivity outside ICA's central network (BBC, NBC News). An ICA spokesperson told AFP those stores were connected to a refrigeration control system from Danfoss. John Billow, head of Sweden's National Cyber Security Centre (at FRA), said the centre was working on several incidents. He added that it had "quite a lot of exposed operational technology devices in Sweden that we have been clear about the necessity to update or patch" (Reuters via CP24).

Estonia, Finland, Ireland, Netherlands. Jann Mutso of Kitman Coldtech told ERR that attackers raised refrigeration temperatures to 50°C at an Estonian chain, and that the units were older Danfoss models. Selver said one of its outlets was affected. In Finland, Kesko said it was investigating irregular temperatures at a few smaller stores, and that "interference via the network has not yet been ruled out." Traficom's NCSC-FI did not rule out cyber interference (AFP). In Ireland, Musgrave said a cyber incident affected refrigeration in 13 SuperValu stores, limited to a "specific model." In the Netherlands, a Danfoss spokesperson told NOS that systems at at least 17 companies, mainly small local shops, were attacked (BBC).

Attribution. No group has been named and no one has claimed responsibility. Reuters said it was unable to establish who was behind the 2 November attacks or whether they are linked to the October attacks in France (Reuters via CNBC). One researcher quoted by Reuters, Tom Hegel of SentinelOne, said the lack of financial demands points to sabotage. That is one analyst's commentary, not attribution.

Separate topic: In October 2026, Ahold Delhaize separately reported an IT cybersecurity incident to Dutch police after detecting suspicious activity in its infrastructure (Reuters). Per SecurityWeek, the Dutch NCSC said in October that it did not believe that incident was connected to the refrigerator attacks in France. That statement predates the 2 November wave. Treat the October IT incident as separate from the refrigeration problems at Delhaize stores described above.

Technical Information

What the public sources establish:

What was targeted. Remote supervisory and management controllers for commercial refrigeration, the systems that set setpoints, defrost schedules and alarms for display cases and cold rooms. They are not the retailer's core IT.
What the attackers did. Evaporators were forced into defrost mode, or setpoints were raised, which pushed cabinet temperatures up to about 50°C (Sabcobel via Belga, store posts quoted by Reuters). In France, Le Monde reported via SecurityWeek that defrost cycles were stretched from one hour to as many as eight, which delayed alarms.
How the systems were reachable. CERT-FR says that exposing a management interface on the internet goes against good practice, and it lists Danfoss AK-SM/AK-SC, Copeland XWEB and Dixell XWEB as targeted. Coop linked its affected stores to 4G cellular connectivity. ICA linked its affected stores to an external supplier's connection outside its central network. On 2 November, Sweden's NCSC chief told SVT that after the French attack in October it emerged that several of the units had very simple passwords and no MFA (SVT).
Legacy and end-of-life equipment. After the French wave, Danfoss said most affected systems were legacy AK-SM 800 and AK-SC 355 units that no longer get software or security updates. It said affected AK-SM 800A units were running outdated firmware (Danfoss via AFP and SecurityWeek). On 2 November, a Danfoss spokesperson told VTM NIEUWS the vulnerability lies "primarily in outdated software" (Euronews).
What is not established. The initial access method has not been publicly tied to any specific CVE. Danfoss published advisory DSA-2025-08-01 for the AK-SM 8xxA series before version 4.3.1 (CVE-2025-41451, CVE-2025-41452). Both are post-authentication flaws, meaning an attacker must already be logged in. Neither Danfoss nor CERT-FR has linked the 2026 compromises to those flaws (SecurityWeek), so treat them as background patch hygiene, not as the confirmed vector.

Affected Product Versions

This is an incident against a class of operational technology, not a single vulnerable product release. Based on official and vendor-sourced reporting:

Product family (as named in sources)	Source	Notes
Danfoss AK-SM series (incl. legacy AK-SM 800, current AK-SM 800A on outdated firmware)	CERT-FR ALE-012; Danfoss statement (Oct)	AK-SM 800 reported end of life (SecurityWeek). Patch DSA-2025-08-01 → 4.3.1 for AK-SM 8xxA
Danfoss AK-SC series (incl. AK-SC 355)	CERT-FR ALE-012; Danfoss statement (Oct)	Reported discontinued and unpatched
Copeland XWEB	CERT-FR ALE-012 (added 13 Oct)	Copeland acknowledged a vulnerability (SecurityWeek)
Dixell XWEB	CERT-FR ALE-012 (added 13 Oct)	Copeland brand
2 Nov wave: Danfoss-supplied control systems	ICA (AFP), Kitman Coldtech (ERR), Danfoss (NOS, VTM)	Musgrave: a "specific model," not named

We have not published a model or firmware list for the 2 November wave beyond what the sources above state. Anyone running a remotely managed supermarket refrigeration controller, whether internet- or cellular-reachable, should assume they are in scope until they have checked.

Workaround and Mitigation

From CERT-FR ALE-012, Danfoss and national CSIRT guidance, plus TPRM steps:

Remove internet exposure now. Take refrigeration controllers off public IP addresses, including cellular (4G) modems with public reachability. CERT-FR advises checking insurance contract terms before cutting data feeds to the refrigeration contractor.
Restore remote access only through a secure VPN or protected network. CERT-FR allows source-IP allow-listing of the refrigeration contractors only as a temporary emergency measure.
Audit configurations, especially defrost schedules and durations, setpoints and alarm thresholds. Make sure alarms escalate to someone who is awake at 02:00.
If compromised: reboot or factory-reset, reconfigure, then harden. CERT-FR warns that a factory reset alone is not enough for an end-of-life device left exposed, because it will very likely be compromised again.
Patch or replace. Update supported firmware (e.g. AK-SM 8xxA to 4.3.1 or later per DSA-2025-08-01), set Danfoss security level to Strict, change default passwords, and budget to replace EOL units. For Copeland and Dixell XWEB, follow the Dixell secure-use recommendations for XWEB supervisors linked from CERT-FR. Sabcobel says physical modifications may be needed.
Food safety. Follow local authority guidance on temperature excursions (e.g. FAVV/AFSCA self-check in Belgium).

Indicators of Compromise

No public IOCs (IP addresses, hashes, domains) have been released by CERT-FR, CCB, Sweden's NCSC or the vendors as of our re-check on 3 November 2026 at 07:17 Cyprus/Nicosia time (UTC+2). Behavioural indicators drawn from the reporting:

Unscheduled or extended defrost cycles across multiple cases at once, especially overnight (reported around 01:00 to 02:00 local time).
Setpoint changes to abnormal positive temperatures (reports up to about 50°C).
New or unexpected sessions on refrigeration supervisory web interfaces from outside the contractor's known ranges.
Alarms suppressed, delayed or rerouted.

We will not publish invented indicators. Check CERT-FR and your national CSIRT for updates.

What to Do With These Vendors Today (TPRM)

The pattern in the reported cases is that the exposed asset belongs to, or is run by, a supplier: a refrigeration OEM, an installer like Sabcobel, or a monitoring provider on its own connection. Send these questions to every cold-chain, HVAC-R and building-automation supplier serving your stores, warehouses and food logistics:

Who operates and remotes into your cold-chain OT? Name the company, the access method (vendor cloud, VPN, direct web UI, cellular modem) and who holds the credentials.
Are any units internet- or cellular-reachable? Ask for a site-by-site list of controllers with public IP or 4G/5G reachability, and for confirmation of default-password removal and MFA where supported.
Patch and segmentation status since the French wave on 12 October and this wave on 2 November. Which units are end of life (e.g. AK-SM 800, AK-SC 355)? Which are on current firmware? What is the replacement date for the rest?
Incident notification path. If your refrigeration OEM or MSP is hit, who calls whom, how fast, and does the contract require it? Also confirm that alarm routing reaches a staffed contact overnight.

Our platform validates vendor claims against live attack-surface signal and chases findings to closure under your approval.

Need help working through refrigeration, cold-chain and building-automation OT suppliers exposed to the European supermarket fridge cyberattacks? Our team can help you prioritize them and track their answers. Talk to an expert