Freezers set to 50°C: a second wave hits supermarkets in six European countries
What retailers, Censys and France’s CERT-FR said about the refrigeration attacks of 2 November in six countries, three weeks after about 700 French supermarkets were hit.
Overnight into Monday 2 November, attackers remotely changed the refrigeration settings at supermarkets and small shops in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Some freezers were shut down or put into defrost; an ICA store manager told Sweden’s TV4 the settings had been changed to +50°C and could not be changed back, and the store threw its frozen food away.1 It is the second wave in three weeks: on the night of 11 October attackers switched refrigeration in hundreds of French supermarkets into defrost,6 about 700 of the country’s 10,000, France’s finance minister told Parliament.5 No one has claimed either attack.2
01Each company's own count, and why there is no total
What the retailers said on 2 November, as quoted by BleepingComputer:1
- Ahold Delhaize (Delhaize, Belgium and Luxembourg): “an IT incident affecting the refrigeration systems in several dozen stores”. BleepingComputer put it at around 40.
- Carrefour Belgium: “currently 15 of our 700 stores are affected, both in Flanders and Wallonia”.
- Coop Sweden: “7 out of more than 800 stores”; the situation is “contained and under control”.
- ICA (Sweden): “a small number of ICA stores operating outside ICA’s central network”.
- Colruyt Group: “around five Spar stores” in Belgium.
BleepingComputer also counted 13 SuperValu stores in Ireland, one Selver store in Estonia and at least 17 butchers and neighbourhood shops in the Netherlands.1 We found no statement from SuperValu or its owner, Musgrave. Ahold Delhaize’s own releases of 12, 13 and 19 October concern a network incident that took its brands’ websites offline; none mentions refrigeration.7
Stephan Moelans of Sabcobel, which installs refrigeration in Belgian stores, said about 20 of the units it manages were hit, by “the same vulnerability used in similar attacks last month in France”.12 An Estonian contractor said an older Danfoss system was reached.2
02Three weeks after a public warning
In an alert first issued on 12 October and last updated on 16 October, France’s CERT-FR said it knew of “de nombreuses compromissions” (numerous compromises) of remote controllers for refrigeration: Danfoss AK-SM and AK-SC, then Copeland and Dixell xweb, added on 13 October. It warned that “des campagnes d’attaques sont probablement toujours en cours” (attack campaigns are probably still under way), and that keeping an internet-exposed unit that no longer gets security fixes “est l’exposer à une très forte probabilité de compromission” (exposes it to a very high probability of compromise).4 After the French wave, Danfoss and Copeland said most affected units were older, discontinued products no longer receiving security updates.52
France warned in mid-October that the attacks were probably still under way; the second wave came three weeks later
Attacks on store refrigeration controllers, the CERT-FR alert and Censys exposure counts, 11 October to 2 November 2026
Show tableHide table
| Date | Event | Detail |
|---|---|---|
| 11 Oct 2026 | France: fridges set to defrost | Overnight, hundreds of supermarkets (Censys) |
| 12 Oct 2026 | CERT-FR alert | CERTFR-2026-ALE-012 names Danfoss AK-SM and AK-SC |
| 13 Oct 2026 | About 700 French stores | Finance minister to Parliament; CERT-FR adds Copeland and Dixell xweb |
| 14 Oct 2026 | 537 French units online | Censys, down from 1,825 on 11 October |
| 16 Oct 2026 | CERT-FR updates advice | Recommendations revised |
| 2 Nov 2026 | Second wave, six countries | Belgium, Netherlands, Sweden, Luxembourg, Ireland, Estonia |
Source: Censys (14 October, 2 November); CERT-FR, CERTFR-2026-ALE-012; AP; BleepingComputer; The Record · as of 3 November 2026 · Exposure counts are Danfoss StoreView controllers seen online by Censys, not devices known to be compromised
03What CERT-FR tells operators to do
For units not yet compromised, in CERT-FR’s order:4
- Remove internet exposure for the affected units and for every unit on a public IP address.
- Check the insurance terms before cutting the data link to the refrigeration contractor.
- Review the whole configuration, “notamment les plages de dégivrage” (including the defrost schedules).
- Restore access only through a secure VPN or a protected network, and apply the vendor’s hardening and firmware.
A compromised unit must also be reconfigured before it goes back into service: a factory reset alone is “insuffisant”. Filtering contractors’ IP addresses on a firewall will do in an emergency, not for good.4
Sources
- BleepingComputer, Bill Toulas: Hackers disrupt refrigeration systems at European supermarkets — 2 November 2026
- The Record, Alexander Martin: Second wave of suspected cyberattacks hits supermarket freezers across Europe — 2 November 2026
- Censys ARC: European refrigerator controller redux: a new wave of refrigeration attacks — 2 November 2026
- CERT-FR, CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (versions of 12, 13 and 16 October) — 12 October 2026, updated 16 October 2026
- Associated Press (on Click2Houston): Cyberattack targeting refrigeration systems hits 700 supermarkets, French government says — 13 October 2026
- Censys: Frostbitten in France: a Danfoss StoreView internet exposure report — 14 October 2026
- Ahold Delhaize, press releases on its cybersecurity incident (12, 13 and 19 October) — 19 October 2026
- CERT-In, Directions under section 70B(6) of the IT Act, 2000 (direction (ii) and Annexure I, items ix and xiii) — 28 April 2022
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
