Lessons Not Learned? Hackers Heat Up Supermarket Freezers Again

Three weeks after the cyberattack on French supermarkets, unknown attackers have again heated up supermarket freezers remotely, this time in at least six countries. Controllers from Danfoss and Copeland were hit once more. According to Danfoss, some systems sat unprotected on the internet and used a default password.

What happened overnight into November 2?

The attackers remotely switched the evaporators of refrigerated cabinets into defrost mode, in which the unit heats up to melt ice. In Belgium, freezers reached around 15 degrees Celsius, Belgian broadcaster RTBF reported. At Delhaize, mainly small formats were hit, such as Shop & Go convenience stores at Q8 fuel stations. According to figures compiled by Flemish broadcaster VRT NWS, Delhaize reported at least 40 affected stores in Belgium, Carrefour 15, Intermarché up to 15 and Spar five. An IKEA store in Mons and several butcher shops were also hit. In Sweden, ICA and Coop stores were affected, with retailers reporting setpoints of up to 50 degrees Celsius. SuperValu reported disruptions at 13 of its 223 Irish stores. In the Netherlands, Danfoss said at least 17 smaller businesses were attacked, mostly butcher shops.

Update, November 3, 2026: Supermarkets in Germany have also reported tampered refrigeration systems. A CAP store in Wuppertal said an “external intervention” had heated up its fridges and freezers and that all goods had to be thrown away. Wuppertal police confirmed to German news site t-online that a criminal complaint had been filed. The Edeka Ernst store in Reisbach, Lower Bavaria, reported temperatures of up to 50 degrees Celsius.

In Raesfeld, North Rhine-Westphalia, the operator of a Rewe store found refrigerated cabinets in defrost mode on Monday morning, also at up to 50 degrees. The store’s refrigeration runs on a Danfoss controller, and the maintenance contractor told the operator that systems elsewhere in Germany had problems as well, t-online reported. A link between the Raesfeld incident and the European wave is unconfirmed. The details on the German cases come from the store operators.

Is it the same vulnerability as in France?

The pattern is the same. Belgian refrigeration contractor Sabcobel describes the same mechanism as in October, when the attack in France hit around 700 victims, according to the Paris prosecutor’s office. Danfoss controllers were hit again, and in Belgium Copeland equipment as well. Authorities have still not named the vulnerability that was exploited. A Danfoss spokesperson told Dutch public broadcaster NOS that the systems attacked in the Netherlands used a default password and were not on a secured network.

Danfoss had asked its customers there on October 13 to disconnect the systems from the internet. Most did, some did not. “There is not a single reason for refrigeration systems to be openly accessible,” Keanu Nys of security firm Spotit told VRT. Fixing older devices takes more effort. Older Danfoss controllers such as the AK-SM 800 have not received security updates for years. According to Sabcobel CEO Stephan Moelans, a software update is not enough for such systems; they need a physical modification. About twenty of the hundreds of systems Sabcobel manages in Belgium were affected.

Who is behind the attacks?

That remains unclear. Nobody has claimed responsibility, and the attackers did not demand a ransom. Whether they are the same as in October is unknown. According to security researcher Sijmen Ruwhof, the spread across many chains suggests that the attackers were not targeting any one company. Belgium’s Centre for Cybersecurity (CCB) has left open whether criminals, state-backed actors or hacktivists are behind it. European governments blame Moscow for a growing number of incidents affecting critical infrastructure, which Russia denies. That alone is no lead. According to Danfoss, unknown attackers had already targeted controllers of this type in Russian and Israeli supermarkets in 2022.

Who needs to act now?

This mainly concerns operators of small stores, franchisees and butcher shops, as well as the refrigeration contractors who maintain their systems remotely. Manufacturers, authorities and security researchers all recommend the same first step: disconnect the controller from the public internet and allow remote maintenance only via a VPN, an encrypted tunnel into the internal network. We outlined further measures after the attack in France. The warnings after France came from manufacturers, authorities and contractors. They did not reach everyone. 

What happened in the supermarket freezer cyberattacks in November 2026?

Overnight into November 2, 2026, unknown attackers remotely switched refrigeration and freezer systems in supermarkets and smaller food businesses into defrost mode. The units heated up, and many retailers had to throw away food. Affected stores included Delhaize, Carrefour, Spar, ICA, Coop and SuperValu.

Which countries were affected by the attacks on supermarket refrigeration?

Incidents were reported in Belgium, Luxembourg, Sweden, the Netherlands, Ireland and Estonia. In Belgium alone, more than 70 sites reported disruptions. Overnight into October 12, 2026, a similar attack hit supermarkets in France, with around 700 victims according to the Paris prosecutor’s office.

Which refrigeration controllers were manipulated in the attacks?

Controllers from Danish manufacturer Danfoss were affected, and in Belgium also equipment from US manufacturer Copeland. According to Danfoss, systems attacked in the Netherlands used a default password and were not on a secured network. Authorities have not yet named the vulnerability the attackers exploited.

Could the supermarket freezer attacks spread to other countries?

Any supermarket or food business whose refrigeration controller can be reached from the public internet is potentially exposed, whatever the country. The head of Sweden’s national cybersecurity centre said authorities had found a large number of exposed operational technology devices, meaning industrial control equipment, in Sweden and had urged operators to update or patch them. Danfoss controllers were hit in both the October and the November waves.

Who is behind the cyberattacks on supermarket refrigeration?

That remains unclear. Nobody has claimed responsibility for either the November or the October attacks, and the attackers have not demanded a ransom. Belgium’s federal prosecutor’s office is investigating, and Belgium’s Centre for Cybersecurity (CCB) considers attribution unclear for now.

How can supermarkets protect their refrigeration systems from hackers?

Refrigeration controllers should not be directly reachable from the public internet. Remote maintenance should run only through a secured network such as a VPN, and default passwords must be replaced. Operators should replace devices that no longer receive security updates.