Supermarket Refrigeration Cyberattack Hits Six Countries in Europe

Attackers tampered with refrigeration controllers at more than 100 supermarkets across six European countries overnight into Monday. They forced fridges and freezers into continuous defrost cycles and drove temperature setpoints as high as 50°C. Staff arriving for the early shift found warm cabinets, melted frozen goods and chilled products already past safe limits. This supermarket refrigeration cyberattack hit the same equipment families as an almost identical campaign in France three weeks earlier.

Belgium absorbed the heaviest damage, with several dozen Delhaize stores reporting failures alongside 15 Carrefour locations and five independently operated Spar outlets. Sweden, Ireland, Estonia, Luxembourg and the Netherlands all saw disruption on the same night. Nobody has claimed the supermarket refrigeration cyberattack so far, and investigators have not tied the incidents to one coordinating actor.

How the Attack Unfolded Overnight

Belgian stores registered the first failures shortly after midnight on Sunday. Defrost cycles that run for around two hours a day switched to continuous operation. The controllers also accepted setpoints far above any legitimate operating range, and no alarm reached anyone during the night.

Swedish grocer Coop confirmed that seven of its 800 stores suffered unauthorised tampering with refrigeration settings. ICA reported a limited number of affected locations, including one store in Sjöbo where staff found units set to 50°C and discarded stock before opening. In Ireland, Musgrave recorded problems at 13 of its 223 SuperValu stores, all linked to a single refrigeration model.

The damage lands on perishable inventory rather than on data. No chain has published a loss figure yet, but the French wave in October produced food losses across hundreds of stores along with fires at several sites. Every store caught in this cyberattack on supermarket refrigeration faced the same call at opening time. Managers had to bin anything that crossed a temperature threshold, or risk a food safety incident.

Internet-Facing Controllers and Documented Default Passwords

The equipment targeted in the supermarket refrigeration cyberattack comes from three vendors. Danfoss AK-SM and AK-SC series controllers account for most confirmed cases, while Copeland XWEB and Dixell XWEB units also appeared in the French alert. These devices act as centralised system managers. They coordinate every refrigerated case in a store and offer a web interface so technicians can change settings remotely.

Remote convenience created the exposure behind the supermarket refrigeration cyberattack. Security researcher Kevin Beaumont reported that every freezer hit on Monday sat behind a management interface reachable from the open internet. Most login attempts relied on factory-default credentials that the vendor documents publicly. Others appeared to fingerprint specific controller components.

Scan data puts numbers on the problem. France still leads the world for exposed Danfoss StoreView instances, followed by Belgium and the United States. Belgium showed 138 exposed instances, the Netherlands 51 and Sweden 50. Patch rates across those three stood at 68%, 37% and 58% respectively.

The Research Landed More Than a Year Ago

Claroty’s Team 82 documented three flaws in the Danfoss AK-SM800A platform in 2025 and demonstrated two of them at DEF CON. The most unusual finding, CVE-2025-41450, exposed a hidden “code-of-the-day” authentication mechanism. The controller generated a daily password from its own system date, and researchers reconstructed the algorithm behind it. Two further flaws covered command injection and external control of device configuration.

Danfoss fixed all three in firmware R4.3.1 and urged customers to upgrade. Censys counted 2,765 publicly reachable AK-SM 800A instances during that research, so the fix had a very large population to reach.

Why the Second Supermarket Cyberattack Landed

France took the first supermarket refrigeration cyberattack on 12 October. CERT-FR published alert CERTFR-2026-ALE-012 that same day and named the exact product families involved. Danfoss told customers on 13 October to disconnect affected systems from the internet. The vendor advised reconnecting only through a secure network.

Three weeks later, the same controllers in six other countries still answered on public addresses with default credentials intact. The distance between that warning and the second supermarket refrigeration cyberattack measures how slowly remediation moves through a distributed retail estate. Patch rates say the same thing, with barely a third of Dutch instances updated.

Ownership explains much of the delay. Supermarkets outsource refrigeration to third-party installers, so a store operator often cannot name the controller in the plant room or the party holding its credentials. Belgian investigators found that attackers reached individual store systems rather than contractor platforms. That detail rules out a single supply-chain compromise, and it multiplies the number of parties who need to act.

Hardware That Will Never Receive a Patch

Danfoss has said the affected units were either end-of-life or running outdated firmware. The AK-SM 800 and AK-SC 355 no longer receive security updates at all. No CVE exists to fix on those models and no firmware will arrive, so operators running them have no software remedy available.

Defending against a supermarket refrigeration cyberattack therefore moves entirely to the network layer. An outside-in scan shows which controller interfaces answer from the public internet. Every exposed interface should come offline immediately and reconnect only through a VPN or a protected network. Teams should also change any default, shared or weak password on the controllers themselves.

Segmentation of the store network closes the remaining gap. Refrigeration controllers belong on an isolated segment with no route to corporate systems and no inbound path from the internet, including through cellular modems that quietly hold a public address. An independent temperature alarm, wired separately from the controller, catches a tampered setpoint before a night shift turns into a write-off.

A Physical Attack With No Ransom Note

Two waves in three weeks have established supermarket refrigeration as a soft target with real-world consequences. No data left these stores and no extortion demand followed, which puts this supermarket refrigeration cyberattack outside the pattern most retail security programmes anticipate. The loss arrives as spoiled stock, wasted staff hours and, in the French cases, fire damage.

European authorities have started treating food retail as part of the critical infrastructure conversation, and ANSSI is coordinating with counterparts across the region. For individual operators, the practical work sits closer to home. Any business running connected refrigeration, cold storage or building management hardware should establish this week which devices answer from the public internet. The second supermarket refrigeration cyberattack proved that attackers already know the answer.