What is happening to Europe's supermarket fridges?

Overnight into Monday 2 November, refrigeration in more than 115 supermarkets across six European countries, from Belgium to Estonia, was changed remotely. Freezers were switched to defrost, and store managers stepped in early in the morning. It sounds like a film plot, but the mechanism behind it is simple and the way to close it is well known: refrigeration management panels left open to the internet. France’s cyber agency CERT-FR has spelled out which devices were targeted and how to lock them down step by step. This article explains what happened, how the attack works and what both businesses and people with smart devices at home can do.

What happened on the night of 2 November

According to company statements gathered by BleepingComputer, more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia were affected. Chains that confirmed the issue:

• Ahold Delhaize (Belgium and Luxembourg): around 40 stores
• Intermarché (Belgium): around 15 stores
• Carrefour (Belgium): 15 of 700 stores
• SuperValu (Ireland): 13 stores
• Coop (Sweden): 7 of more than 800 stores
• Spar Colruyt (Belgium): around 5 stores
• ICA (Sweden): at least 4 stores
• Selver (Estonia): 1 store

At least 17 butchers and neighbourhood shops in the Netherlands had the same problem. The most striking scene came from Sweden. An ICA store manager told TV4 the temperature had been set to +50°C overnight and could not be changed, and according to CNBC, ICA’s store in Sjöbo wrote on Facebook that its fridges and freezers were taken over at 2 a.m. and set to 50°C, which was noticed only hours later. Coop said Danfoss was among its suppliers. Coop said the issues ranged from fully shut-down units to partly working ones and that the situation was under control. Carrefour said the impact was very limited, no hypermarket was affected and all stores stayed open. Ahold Delhaize said it immediately took the necessary measures to keep its stores running, and some stores used refrigerated trucks to protect stock.

The head of Sabcobel, which installed refrigeration at several of the affected Belgian stores, says the attacker used the same weakness exploited in France last month and triggered the defrost function remotely. He adds that most of the firm’s clients had already moved to managing their fridges over a secure connection after the French incident.

What happened in France

A similar wave hit France on the night of 11 to 12 October. CERT-FR issued an alert on 12 October, added more devices on 13 October and updated its advice on 16 October. The targeted devices were controllers from Danish firm Danfoss (AK-SM and AK-SC series) and Copeland and Dixell xweb controllers. Based on reported incidents, around 500 stores in France were affected, according to Cooling Post.

Danfoss says most of the affected units were models that stopped receiving updates years ago: the AK-SM800 reached end-of-life in 2021 and the AK-SC355 was phased out in 2016. Newer AK-SM800A units that were hit were running outdated firmware. Danfoss says it is working with affected customers on firmware updates, stronger network protection and removing direct internet exposure, that it continues to update supported products, and that it has long advised moving legacy systems to current ones.

How the attack works

In a supermarket, dozens of display cases connect to a single “system manager” that controls each unit’s temperature, alarms and defrost schedule from one screen. So the refrigeration service company can check faults remotely, that screen is often put on the internet. Think of a building’s boiler room whose door opens onto the street so the technician can get in, still locked with the key it had on day one. Anyone who finds the door can change the settings, and keeping defrost on slowly warms the cases.

CERT-FR’s alert does not name a specific vulnerability. The common factor is clear: management interfaces exposed to the internet, which the alert calls contrary to good practice. If a device no longer receives updates, known weaknesses stay open, which is why hiding it from the internet is the most effective step.

How to close the door: CERT-FR’s steps

CERT-FR gives separate guidance for two cases. If a device has not been compromised:

• Remove internet access for the affected units and for every unit reachable on a public IP address.
• Check your insurance contract before cutting the data link to the service company.
• Review all settings, including defrost schedules.
• Restore remote access only through a secure VPN or protected network. In an emergency, allowing only the service company’s IP addresses on a firewall can serve as a temporary measure.
• Apply the manufacturer’s advice: on Danfoss units, update the firmware, set the security level to Strict and make sure default passwords have been changed.

If a device has been compromised, the same steps apply, plus restarting it and, if needed, a factory reset and reconfiguration. CERT-FR adds an important note: a factory reset removes what the attacker left behind but does not close the weakness. An unpatched device that stays on the internet is very likely to be taken over again. Dixell has also published secure-use recommendations for xweb supervisors.

What it means for smart devices at home

This wave targeted commercial refrigeration controllers in shops; no incidents involving home fridges have been reported. The same principle still works at home. Changing the default password on smart fridges, cameras and thermostats, keeping automatic updates on, not opening ports on your router to expose a device’s admin page, and putting such devices on a guest network keep the same door closed at home.

No group has claimed the attacks so far and investigations continue. The good news is that the fix needs no breakthrough. Taking the management panel off the internet, moving access to a VPN and updating firmware are steps many businesses can take today with their service company, and according to Sabcobel, many of its clients did exactly that after the French incident.

Cover photo: AG20044018, Wikimedia Commons, CC BY-SA 4.0.

Sources: CERT-FR alert CERTFR-2026-ALE-012, BleepingComputer, CNBC, Cooling Post (Danfoss statement), Dixell xweb recommendations