Supermarket fridge cyberattack in Europe: what we know
By Jorge Graells · November 2, 2026 at 3:49 PM UTC · 8 min read
Updated:
Since November 2, attackers have remotely changed the temperature of fridges and freezers in more than 100 stores across at least nine European countries, Portugal included. What we know, which equipment was hit and what to do if your business has connected refrigeration.
Supermarket fridge cyberattack in Europe: what we know
- Type
- News
- Author
- Jorge Graells
- Date
- Updated
- Reading time
- 8 min read
- Subjects
Summary
Since November 2, attackers have remotely changed the temperature of fridges and freezers in more than 100 stores across at least nine European countries, Portugal included. What we know, which equipment was hit and what to do if your business has connected refrigeration.
In the early hours of Monday, November 2, someone remotely changed the temperature of fridges and freezers in supermarkets across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Affected chains include Delhaize, Carrefour, Intermarché, Spar, ICA, Coop and SuperValu, according to BleepingComputer1. In Belgium alone, more than 50 stores have been identified, according to The Record2. It's the second wave in a few weeks: in mid-October the same thing happened to hundreds of supermarkets in France.
Updated November 6. The United States is now warning about the same thing. CISA, the FBI and the Departments of Health, Agriculture and Transportation published a joint fact sheet3 on November 5 on protecting refrigeration and cold-chain monitoring systems. It names no vendors and gives no technical indicators. It says attackers exploit authentication bypasses, code injection or weak configurations in unpatched or internet-accessible controllers, and force them into continuous heating and defrost cycles. They can also leave you unable to see the real temperature. The fact sheet mentions healthcare, chemicals, food and transportation, and BleepingComputer4 connects it to the European waves. In France, the public blood service (EFS5) confirmed that on November 2 an incident at a supplier altered the settings of cold rooms at three of its sites. Its alarms caught it in time and it says no blood products were lost. EFS doesn't link it to this campaign.
Updated November 4. The European Commission is in direct contact with national authorities and convened its interinstitutional task force on Tuesday. In the UK, the National Cyber Security Centre says a small number of organisations may be affected. The chains are now giving numbers: ICA reports 23 stores in Sweden, eight of which had to throw out products, and SuperValu reports 13 in Ireland, according to TechCentral6, citing Cybersecurity Dive.
Updated November 3. The count is now over 100 stores and the attack has reached the Iberian peninsula: the Mosqueteiros group confirmed incidents at seven Intermarché supermarkets in Portugal. There are also cases in Italy (an operator of Coop supermarkets in Sicily alerted the national cybersecurity agency) and Finland, and Belgium's federal prosecutor has opened an investigation, according to SecurityWeek7. No cases have been confirmed in Spain. Details below, under "What we don't know".
This is a developing story. I'll update it as authorities or manufacturers share more details.
◢What happened
The attackers got into the systems used to control refrigeration remotely and changed their settings: they raised temperatures, switched units off or put them into defrost mode. Stephan Moelans, CEO of Sabcobel, a Belgian refrigeration installer, told the Belga8 news agency that the evaporators were switched to defrost mode, the same trick used in France, and that his technicians started disconnecting the affected units from the network at 1 a.m.
At an ICA store in southern Sweden, the manager told broadcaster TV4 that the temperature had been set to +50 °C and that staff couldn't change it, as reported by BleepingComputer1.
The damage is very concrete. A freezer that spends hours at room temperature means throwing out everything inside it, for food safety reasons. Attackers don't need to steal data or demand a ransom to hurt a business.
◢What happened in France in October
On October 12, the French cybersecurity agency published an alert9 about attacks on the remote controllers of refrigeration systems. It names four product families: Danfoss AK-SC and AK-SM, and the XWEB controllers from Copeland and Dixell. It doesn't describe a specific flaw. It points to the management interface being exposed to the internet as the main problem, which goes against good practice, and warns that the campaigns are probably still active.
The Paris prosecutor's office puts the number of victims of that wave at around 700, according to The Record2. French retailers described exactly what's happening now: freezers set to 50 °C from the outside.
◢Which equipment was hit this time
There's no official list yet. A contractor in Estonia said the attackers accessed an old Danfoss system, and Dutch broadcaster NOS reports that Copeland equipment was also targeted in Belgium, according to The Record2. Copeland has now confirmed that some of its xweb controllers were targeted this time, through flaws that were already known, according to TechCentral6. After France, both manufacturers said most of the affected devices were discontinued products that no longer received security updates.
Danfoss had already told its customers on October 13 to take these systems off the internet. It told Dutch broadcaster NOS, as reported by SecurityWeek7, that most did, "but a small number did not". The analytics firm Censys counts just over 1,000 Danfoss StoreView panels still reachable from the internet worldwide. In France the number has dropped from 1,825 before the attacks to 220, and only 41% of those 220 run updated firmware (4.3.1 or later), according to its November 2 analysis10.
Moelans adds an important detail: on some units a software update isn't enough, they need physical changes, and that costs money. The simplest fix, he told Belga8, is to manage the fridges over a secure connection, which most of his customers switched to after the attack in France.
◢What we don't know
Nobody has claimed the attacks, either in October or now, and it's not known whether the same people are behind both. Belgium's Centre for Cybersecurity says it's aware of the incident, but that it's not known who is behind it and it may never be possible to find out, according to The Record2.
Belgium's federal prosecutor has opened an investigation, according to SecurityWeek7.
No cases have been confirmed in Spain or the UK. Spain's INCIBE told Infobae11 it cannot yet determine the entry point or the scope of the incident in Spain, given how recent it is. In the same article, analyst Marcelino Madrigal says he found more than 300 Spanish refrigeration and air-conditioning units reachable from the internet, and stresses that exposed doesn't mean vulnerable. With seven stores hit in Portugal, it makes sense to check your equipment now rather than wait for a local case. In October another researcher found 2,752 Danfoss systems reachable from the internet, 1,590 of them in France, according to BleepingComputer12.
◢Is it only supermarkets?
No. What's being attacked is a type of device, not a sector. Any business with cold rooms that the installer manages remotely can have the same problem: a butcher's, a restaurant, a bakery, a logistics warehouse or a farming cooperative.
The same goes for other equipment nobody thinks of as "IT": air conditioning, security cameras, access control or the control panels in a warehouse. They're often installed by an outside company that leaves them online so it can check them from its office, and nobody inside the business knows they exist. ICA is a good example: all of its affected stores had this equipment connected outside the network the chain manages itself, according to TechCentral6.
◢What to do if you have connected refrigeration
What follows comes from the recommendations in the French alert9 and the CISA and FBI fact sheet3, plus a couple of common-sense additions:
- ▹Ask your installer whether the fridge controller can be reached from the internet. If it can, have that changed.
- ▹Remote access should only go through a secure VPN or a protected network, never with the management screen open to anyone.
- ▹Change default passwords, update the firmware and, if the manufacturer offers it, turn on the strictest security level.
- ▹Review the whole configuration, including defrost ranges, in case someone has changed it.
- ▹Keep these devices on their own network, separate from the rest of the company, and only let in authorised addresses and devices.
- ▹Replace devices the vendor no longer updates.
- ▹If a unit has already been attacked, the alert says to reboot it or restore it to factory settings and reconfigure it before using it again. On unsupported units, it warns that a factory reset isn't enough, because the flaw is still there.
- ▹Add a temperature alarm that doesn't depend on the same system, such as a sensor that alerts your phone. If someone tampers with the controller, you'll know before you lose the stock.
In Spain, if your business suffers an incident like this or you have questions, you can call INCIBE's free helpline13 on 017. In other countries, contact your national cybersecurity agency.
◢What this attack leaves behind
When I talk about cybersecurity with companies, almost everyone thinks of email, computers and the server. Few think of the fridge. But a device that's online, never updated and still using its factory password is just as open a door, and in this case the damage happens without going through a single computer.
The first step is cheap: make a list of everything connected in the business, who installed it and who can get in from outside. I've written before that attacks rarely come in through the server. This time they came in through the cold room. If you want your team to be able to spot this kind of risk, it's part of what I cover in my cybersecurity training for companies.
Related documents
- News
Crédit Mutuel Arkéa cyberattack: attackers came in through a vendor
French bank Crédit Mutuel Arkéa suffered an attack that allowed fraudulent transfers from its own account. The attackers got in through a service provider's platform. What we know, what we don't and what to learn.
- Article
Device code phishing: what it is and how to stop it
Device code phishing tricks the victim into typing a code generated by the attacker into Microsoft’s real sign-in page. That gives the attacker access to their Microsoft 365 account without a password and without two-step verification getting in the way. Blocking that sign-in flow stops it.
- News
Claude Code leaks keys on GitHub: the settings.local.json problem
Claude Code's "don't ask again" option can save passwords and API keys in .claude/settings.local.json. Apiiro found 1,122 public copies on GitHub with secrets inside. What we know and what to do.