Supermarket freezer hacks spread to at least 9 European countries

What happened on Nov. 2

Attackers remotely changed refrigeration settings at supermarkets and food suppliers in at least nine European countries overnight on Nov. 1 and 2, 2026, forcing stores to pull food. The Hacker News, citing AFP, lists Belgium, Luxembourg, Sweden, Estonia, the Netherlands, Ireland, Finland, Portugal and Italy. No group has claimed responsibility, and officials have not named one.^[2]

Help Net Security reported that the attackers switched evaporators into defrost mode, and that Swedish freezers were set as high as 50 C (122 F). The affected equipment included internet-exposed, unpatched management interfaces, many of them end-of-life units with no patch available, the outlet said.^[1]

The reported impact differs by country. Delhaize said several dozen stores, mostly in Belgium and a few in Luxembourg, had an "IT incident". Carrefour Belgium put its affected stores at 15 of more than 700. In Ireland, Musgrave, the parent of SuperValu, said 13 of 223 stores were hit, about 5.8 percent by a calculation from those two figures, and the problem was resolved on Monday afternoon. Coop Sweden reported six or seven of about 800 stores, depending on the news agency. AFP counted seven Intermarche stores in Portugal and at least four Coop stores in Sicily. Danfoss told Dutch broadcaster NOS that at least 17 Dutch businesses were affected.^[2]

Losses were small in the cases that have been quantified. A butcher in Hove, Belgium, estimated about 15,000 euros of meat lost, according to Reuters as cited by The Hacker News. In Estonia, one Selver store was affected through its refrigeration contractor Kitman Coldtech.^[2]

Which equipment and weaknesses are involved

The Hacker News said the affected products include the Danfoss AK-SM and AK-SC controllers, and that France's CERT-FR also covers Copeland xweb and Dixell xweb products. Danfoss told NOS that the affected Dutch systems sat on open networks with default passwords, and told Belgian broadcaster VTM that the software involved was outdated. As of Nov. 3 the Danfoss advisories page showed no advisory for this wave, and the CERT-FR alert was last updated on Oct. 16, The Hacker News said.^[2]

The security firm Lupovis, which runs decoy Danfoss AK-SM sensors on the internet, recorded 256 login attempts from 91 sources between Oct. 20 and Oct. 30, with activity peaking on Oct. 26. Most used the manufacturer's factory default credentials. Lupovis chief executive Xavier Bellekens said the hosting infrastructure overlapped with infrastructure previously linked to Russian-linked operations, but that the company could not yet pin the activity on a group. These were decoys, so the data shows probing of the product type, not proof of who attacked the real stores.^[1][5]

Belgium's Centre for Cybersecurity said the attacker's identity may never be determined, and Belgium's federal prosecutor has opened a criminal investigation, according to VRT as cited by The Hacker News. Sweden's National Cybersecurity Centre said it is sharing information with Nordic and European agencies.^[2]

How this connects to the French attack

The wave follows an attack on French supermarkets overnight on Oct. 11 and 12. Al Jazeera, citing AFP and Reuters, reported that refrigeration systems at Intermarche, Coopérative U, E.Leclerc, Carrefour and Monoprix stores were forced into defrost cycles with temperatures raised to as much as 50 C. Intermarche chief executive Thierry Cotillard told BFM TV the losses would reach tens of millions of euros nationwide in a single day. Danfoss said the affected French units were running outdated firmware.^[4]

Officials have not said the two waves are linked. The same product family, the same defrost method and the same pattern of exposed, unpatched controllers appear in both.^[1][4]

What it means for the UK

In Britain, the British Association of Independent Meat Suppliers said some of its more than 300 members were affected, with one supplier's cold unit reaching 100 C and two reporting units defrosting. The units were empty and no meat was lost, the association said. No UK grocery chain has been directly affected, according to the Guardian report as reprinted by Shango Media.^[5]

The National Cyber Security Centre said the impact so far is minimal and that the attackers used flaws that had been known for a long time, not AI tools. Chief executive Richard Horne told BBC Radio 4 that the agency had alerted potentially affected organisations, Xinhua reported, citing the BBC.^[3][5]

What happens next

Operators have been told to take the controllers off the internet, put them behind a VPN, change default passwords, check defrost schedules and set the Danfoss security level to Strict. Compromised devices should be restarted or factory reset and then reconfigured, The Hacker News said. A Danfoss advisory and any attribution by investigators in Belgium or France are the next developments to watch.^[2]