--- title: "Freezers set to 50°C: a second wave hits supermarkets in six European countries" summary: "What retailers, Censys and France’s CERT-FR said about the refrigeration attacks of 2 November in six countries, three weeks after about 700 French supermarkets were hit." url: https://www.thetechbag.com/blog/supermarket-freezers-hacked-second-wave-europe format: Note desk: "Security" area: "Network & cloud" region: Global published: 2026-11-03 facts_checked: 2026-11-03 author: TechBag (The TechBag Journal) tags: ["refrigeration controllers","Danfoss","Copeland","Dixell","StoreView","operational technology","supermarkets","Ahold Delhaize","Carrefour","Coop","ICA","CERT-FR","Censys","internet exposure","CERT-In"] cover: https://www.thetechbag.com/blog/covers/supermarket-freezers-hacked-second-wave-europe.png --- # Freezers set to 50°C: a second wave hits supermarkets in six European countries *What retailers, Censys and France’s CERT-FR said about the refrigeration attacks of 2 November in six countries, three weeks after about 700 French supermarkets were hit.* Note · Security · Network & cloud · By TechBag · Published 2026-11-03 · Facts checked 2026-11-03 · Canonical: https://www.thetechbag.com/blog/supermarket-freezers-hacked-second-wave-europe Overnight into Monday 2 November, attackers remotely changed the refrigeration settings at supermarkets and small shops in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Some freezers were shut down or put into defrost; an ICA store manager told Sweden’s TV4 the settings had been changed to +50°C and could not be changed back, and the store threw its frozen food away.[1] It is the second wave in three weeks: on the night of 11 October attackers switched refrigeration in hundreds of French supermarkets into defrost,[6] about 700 of the country’s 10,000, France’s finance minister told Parliament.[5] No one has claimed either attack.[2] ## Each company's own count, and why there is no total What the retailers said on 2 November, as quoted by BleepingComputer:[1] - **Ahold Delhaize** (Delhaize, Belgium and Luxembourg): “an IT incident affecting the refrigeration systems in several dozen stores”. BleepingComputer put it at around 40. - **Carrefour Belgium:** “currently 15 of our 700 stores are affected, both in Flanders and Wallonia”. - **Coop Sweden:** “7 out of more than 800 stores”; the situation is “contained and under control”. - **ICA (Sweden):** “a small number of ICA stores operating outside ICA’s central network”. - **Colruyt Group:** “around five Spar stores” in Belgium. BleepingComputer also counted 13 SuperValu stores in Ireland, one Selver store in Estonia and at least 17 butchers and neighbourhood shops in the Netherlands.[1] We found no statement from SuperValu or its owner, Musgrave. Ahold Delhaize’s own releases of 12, 13 and 19 October concern a network incident that took its brands’ websites offline; none mentions refrigeration.[7] ReportedTwo outlets, two totals BleepingComputer reported “more than 115 stores”.[1] The Record reported more than 50 in Belgium and over a dozen across Ireland, Estonia, the Netherlands and Luxembourg combined.[2] The counts were made on the day and overlap; we do not add them up. Stephan Moelans of Sabcobel, which installs refrigeration in Belgian stores, said about 20 of the units it manages were hit, by “the same vulnerability used in similar attacks last month in France”.[1][2] An Estonian contractor said an older Danfoss system was reached.[2] ## Three weeks after a public warning In an alert first issued on 12 October and last updated on 16 October, France’s CERT-FR said it knew of “de nombreuses compromissions” (numerous compromises) of remote controllers for refrigeration: Danfoss AK-SM and AK-SC, then Copeland and Dixell xweb, added on 13 October. It warned that “des campagnes d’attaques sont probablement toujours en cours” (attack campaigns are probably still under way), and that keeping an internet-exposed unit that no longer gets security fixes “est l’exposer à une très forte probabilité de compromission” (exposes it to a very high probability of compromise).[4] After the French wave, Danfoss and Copeland said most affected units were older, discontinued products no longer receiving security updates.[5][2] **Figure: France warned in mid-October that the attacks were probably still under way; the second wave came three weeks later** *Attacks on store refrigeration controllers, the CERT-FR alert and Censys exposure counts, 11 October to 2 November 2026* | Date | Event | Detail | | --- | --- | --- | | 11 Oct 2026 | France: fridges set to defrost | Overnight, hundreds of supermarkets (Censys) | | 12 Oct 2026 | CERT-FR alert | CERTFR-2026-ALE-012 names Danfoss AK-SM and AK-SC | | 13 Oct 2026 | About 700 French stores | Finance minister to Parliament; CERT-FR adds Copeland and Dixell xweb | | 14 Oct 2026 | 537 French units online | Censys, down from 1,825 on 11 October | | 16 Oct 2026 | CERT-FR updates advice | Recommendations revised | | 2 Nov 2026 | Second wave, six countries | Belgium, Netherlands, Sweden, Luxembourg, Ireland, Estonia | Source: Censys (14 October, 2 November); CERT-FR, CERTFR-2026-ALE-012; AP; BleepingComputer; The Record · as of 3 November 2026 · Exposure counts are Danfoss StoreView controllers seen online by Censys, not devices known to be compromised ReportedReported by Censys, not counted by us On 2 November Censys saw “just over 1,000” Danfoss StoreView controllers still reachable from the internet: 220 in France, where it had seen 1,825 before the first attack, and in the countries hit on Monday 138 in Belgium, 51 in the Netherlands, 50 in Sweden, six in Luxembourg, three in Ireland and two in Estonia.[3] After the French wave, operators were “simply taking them off the internet” rather than patching, it said.[6] ## What CERT-FR tells operators to do For units not yet compromised, in CERT-FR’s order:[4] - Remove internet exposure for the affected units and for every unit on a public IP address. - Check the insurance terms before cutting the data link to the refrigeration contractor. - Review the whole configuration, “notamment les plages de dégivrage” (including the defrost schedules). - Restore access only through a secure VPN or a protected network, and apply the vendor’s hardening and firmware. A compromised unit must also be reconfigured before it goes back into service: a factory reset alone is “insuffisant”. Filtering contractors’ IP addresses on a firewall will do in an emergency, not for good.[4] Our viewOur view, for anyone with stores, kitchens or cold rooms CERT-FR’s advice assumes a contractor with a remote link into the store, and ICA said the stores hit run outside its central network: these controllers may not be on IT’s asset list. Ask the contractor, in writing, which have a public IP address and how its engineers reach them. In India No Indian store has been reported hit, and Censys’s 2 November report gives no figure for India.[3] If it happens here, CERT-In’s Directions of 28 April 2022 list “Attacks on Critical infrastructure, SCADA and operational technology systems” and “Attacks on Internet of Things (IoT) devices” among the incidents a body corporate must report within 6 hours of noticing them.[8] Remote access without a public interface is compared in the [zero-trust access guide](https://www.thetechbag.com/browse/network-security-sase/zero-trust-access). How we did this Figures as of 3 November 2026, 7pm IST Store counts are the companies’ words as quoted by BleepingComputer, or labelled as an outlet’s count; we did not add them. CERT-FR’s alert was read in French; the translations are ours. Exposure counts are Censys’s and change as it rescans. Not used: unconfirmed reports from other countries, and any attribution. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [BleepingComputer, Bill Toulas: Hackers disrupt refrigeration systems at European supermarkets](https://www.bleepingcomputer.com/news/security/hackers-disrupt-refrigeration-systems-at-european-supermarkets/) — 2 November 2026 2. [The Record, Alexander Martin: Second wave of suspected cyberattacks hits supermarket freezers across Europe](https://therecord.media/cyberattack-grocery-freezers-europe) — 2 November 2026 3. [Censys ARC: European refrigerator controller redux: a new wave of refrigeration attacks](https://censys.com/blog/european-refrigerator-controller-redux-a-new-wave-of-refrigeration-attacks) — 2 November 2026 4. [CERT-FR, CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (versions of 12, 13 and 16 October)](https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/) — 12 October 2026, updated 16 October 2026 5. [Associated Press (on Click2Houston): Cyberattack targeting refrigeration systems hits 700 supermarkets, French government says](https://www.click2houston.com/business/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says/) — 13 October 2026 6. [Censys: Frostbitten in France: a Danfoss StoreView internet exposure report](https://censys.com/blog/frostbitten-in-france-a-danfoss-storeview-internet-exposure-report) — 14 October 2026 7. [Ahold Delhaize, press releases on its cybersecurity incident (12, 13 and 19 October)](https://media.aholddelhaize.com/media/frxnw5d2/ahold-delhaize-update-on-status-of-cybersecurity-incident.pdf) — 19 October 2026 8. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (direction (ii) and Annexure I, items ix and xiii)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Zero-trust access guide](https://www.thetechbag.com/browse/network-security-sase/zero-trust-access) — remote access for contractors without a management interface on the internet - [Tenable OT Security](https://www.thetechbag.com/tenable/tenable-ot-security) — finding controllers and building systems the IT asset list misses - [Vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) — exposure scanning and end-of-life devices that will not be patched