The Night Europe's Supermarket Fridges Turned Hot

Hackers took control of refrigeration systems in hundreds of European supermarkets, sending fridges and freezers into defrost and food into the bin. Much of the equipment had stopped receiving security updates years ago. Here is how an attack on the shop fridge happened, and why it was so hard to stop.

The first sign, in most shops, was the smell. Over the weekend of 11 and 12 October, staff at supermarkets across France arrived to find fridges and freezers running warm. In some units the temperature had climbed as high as 50°C. Chilled and frozen food had to be thrown away. Paris prosecutors confirmed a cyberattack and said overheating equipment had started fires.

Dominique Schelcher, chief executive of the Coopérative U chain, called the attack "unprecedented" and extremely serious. France's finance minister, Roland Lescure, told parliament that about 700 of the country's 10,000 supermarkets had been affected. About 300 Intermarché and Netto stores were among those hit, along with branches of Carrefour, Monoprix and E.Leclerc. Losses ran into tens of millions.

Three weeks later it happened again. Overnight into Monday, 2 November, refrigeration units were switched into defrost mode in dozens of stores across Belgium, Luxembourg, Sweden and Ireland. Delhaize and Colruyt confirmed the attacks, and in Sweden ICA and Coop also reported problems. Christophe Hansen, the EU commissioner for agriculture and food, called it a "deliberate attempt to disrupt" the bloc's food supply, while adding that food security was not at risk.

What was actually hacked

Not the shops' tills, nor their websites. The target was the refrigeration itself: the display fridges and freezers that customers take food from. They are run by electronic controllers. Some are small boxes fitted to a single cabinet; others are larger system managers that oversee a whole store. They watch the temperatures, and switch compressors and defrost cycles on and off. In many of the affected stores, these controllers were made by Danfoss, the Danish engineering group. France's national cybersecurity agency, ANSSI, later added controllers from two other manufacturers, Copeland and Dixell, to its warning.

These devices are useful precisely because they can be reached remotely. A service company can check a freezer in Lyon from an office in Paris, get an alarm at three in the morning and fix a setting without sending an engineer. The problem is that many of them were reachable not just by the service company but by anyone on the internet who knew where to look. "Many of these devices are directly exposed to the internet," said Amir Preminger, chief technology officer of the security firm Claroty, which had researched Danfoss's controllers.

The scale is measurable. Before the October attack, the internet-scanning company Censys counted more than 1,800 such Danfoss controllers openly visible online in France alone. Within three days the number had fallen to 537, as owners hurriedly disconnected them.

Old machines, known weaknesses

This is where the story becomes uncomfortable. Much of the equipment that was hit could not have been fixed with an update, because there was no update left to install.

Danfoss told AFP that most of the affected systems were older products that no longer received software or security updates, and said it had long advised supermarkets to upgrade. Two of the models it named are long past their supported life: Danfoss declared the AK-SM 800 end-of-life in May 2021, and phased out the AK-SC 355 in 2016. For their owners, the only real remedies are to take them off the internet or replace them.

Newer equipment was not entirely spared. In August 2025, researchers from the security firm Claroty presented flaws in Danfoss's current AK-SM 800A system managers at DEF CON, the hacking conference in Las Vegas. Danfoss had been told in advance and released firmware that fixed them. But according to Danfoss, some AK-SM 800A units hit in the attack were still running outdated firmware.

Investigators have not said how the attackers got in, and no specific flaw has been confirmed as the route. What is known is that the openings were there: old controllers that could no longer be updated, newer ones that had not been, and thousands of both visible on the open internet.

A freezer controller is not a phone. Nobody replaces it every two years, and as long as the milk stays cold, nobody thinks about it at all. Many of these systems are installed and maintained by third-party service firms rather than by the supermarkets themselves, which blurs who is responsible for updating them. Awais Rashid, a professor of cybersecurity at the University of Bristol, told Al Jazeera that some were also protected by passwords that were "easily guessable".

The fastest remedy is also the bluntest: cut the controllers off from the internet. In Belgium, technicians at Sabcobel, which runs refrigeration systems for Delhaize and others, worked through the night to disconnect affected units. Its chief executive, Stephan Moelans, said many would need physical modification, which "requires investment".

Who did it

Nobody knows, or at least nobody has said. No group has claimed responsibility for either wave. Belgian prosecutors have opened a criminal investigation, and ANSSI's warning contains no information about the attackers.

That has not stopped speculation. European intelligence officials have repeatedly warned of a Russian campaign of sabotage and cyberattacks across the continent, and Al Jazeera reports that in the United States the Pentagon is investigating refrigeration failures at military bases earlier this year as a suspected hack. None of that is evidence of who attacked Europe's supermarkets, and the investigators have not pointed at anyone.

What is clear is the method's appeal. It required no explosives and no break-in, and it was not aimed at a bank or a power station. It went for food, which everyone notices, and it exploited equipment that almost nobody had thought of as a target.

Why it matters beyond the shop floor

The supermarket attacks are a neat illustration of a much larger problem. Buildings are now full of small connected devices that run the heating, the lifts, the ventilation and the cold rooms, and many of them are years past their last security update. A report by the security firm Armis in October found that 73 per cent of organisations had at least one known, actively exploited vulnerability in their building systems.

It is also a reminder of why governments across Europe, Iceland among them, are now asking households to keep a few days of food and water at home. The scenario is not abstract. For a few days in October and November, in hundreds of shops across Europe, the frozen food simply was not there.

The lesson for anyone running a building is unglamorous: know what is connected, take it off the open internet, and replace what can no longer be updated. The lesson for everyone else is older. Keep something in the cupboard that does not need a fridge.

Sources

• CBS News (AFP) — Cyberattacks on grocery store refrigerators and freezers across Europe, 2 November 2026 – Both waves, the 50°C temperatures, the fires reported by Paris prosecutors and Danfoss's statement on legacy equipment.
• TechCrunch — A fresh wave of cyberattacks has hit Europe's supermarket refrigerators, 2 November 2026 – The second wave and the chains that confirmed it.
• Cybersecurity Dive — Refrigeration flaws disclosed before the attacks in France, October 2026 – Claroty's research, ANSSI's warning and the role of internet exposure.
• Facilities Dive — Hack of Danfoss refrigeration controllers in Europe causes tens of millions in losses, October 2026 – The controllers involved and the scale of the losses.
• Censys — European refrigerator controller redux: a new wave of refrigeration attacks, November 2026 – The number of Danfoss controllers visible online in France before and after the attack.
• Al Jazeera — Very cold war: who's attacking Europe's supermarket freezers?, 3 November 2026 – Christophe Hansen's and Awais Rashid's comments, the Belgian investigation and the Pentagon inquiry.
• AP (via NY1) — Cyberattack targeting refrigeration systems hits 700 supermarkets, French government says, 13 October 2026 – Roland Lescure's figures and the chains affected in France.
• The Hacker News — Attackers heat French supermarket refrigeration systems, October 2026 – The Danfoss models named, their end-of-life dates and the outdated AK-SM 800A firmware.
• The Register — CERT-FR on the Danfoss controller compromises, October 2026 – That investigators have not identified how the attackers got in.
• Facilities Dive — Legacy BACnet leaves HVAC and other building systems vulnerable to hacks, 2 October 2026 – Armis's finding that 73 per cent of organisations have a known exploited vulnerability in their building systems.

Reporting note: This explainer is based on statements from Danfoss, French and Belgian authorities and the European Commission, research by Claroty and Censys, and reporting by news agencies and specialist security media. It deliberately contains no technical detail that could help anyone repeat the attacks. Investigators have not established how the attackers got in or who they are. The illustrations are AI-generated.

Tips, corrections or questions: ritstjorn@frettir247.news

More from Technology

TECHNOLOGY · AICan AI Think Like a Supreme Court Justice? University Experiment Tests the Limits of Artificial Intelligence in Law31 October 2026TECHNOLOGY · AIThe New Economy Forum: How AI Is Reshaping Money, Work and Government31 October 2026TECHNOLOGY · AIArtificial Intelligence and Icelandic Society: Iceland Sets Out Its Priorities30 October 2026