Menu
Breach Value Calculator

Apparent Supermarket Fridge Cyberattacks in Europe: What to Check

Apparent cyberattacks on store fridge controllers were reported in six European countries on 2 Nov 2026, after France's wave in Oct 2026. What to check.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Identified: 2 November 2026Published 11 min read

What happened in the supermarket fridge cyberattacks? On 2 November 2026, retailers in Sweden, the Netherlands, Belgium, Ireland, Luxembourg and Estonia reported refrigeration in some stores disrupted by apparent cyberattacks. The target was the remote controller that runs fridges and freezers, not tills or customer data. It followed a larger wave in France, first flagged on 12 October 2026 by CERT-FR, the French government's cyber emergency team.

No source we read reports data being taken, and no one has said who is behind either wave. Below: what each organisation said, what is only press-reported, and what operators can check this week. More case files are in Breaches: Europe.

Case file

Field Value
Organisation Supermarket and retail chains, not one company, including ICA, Coop, Ahold Delhaize, Delhaize, Carrefour, Musgrave/SuperValu and Selver (full list below)
Region Reported in six countries on 2 November 2026 (AP lists five; NBC News adds the Netherlands). France in October 2026
Equipment named Copeland xweb, Danfoss AK-SC, Danfoss AK-SM and Dixell xweb remote controllers, in CERT-FR's French alert (CERT-FR). No versions given
When it happened ICA said its stores were affected "overnight", reported on 2 November 2026 (AP via TechXplore)
Identified 2 November 2026 for the six-country incidents, when retailers and suppliers reported them. The French wave was first alerted by CERT-FR on 12 October 2026
Stores affected No total for 2 November; per-company counts are below. About 700 in France in October
Data taken None reported in the sources we read
Attribution None. "No one has claimed responsibility" (NBC News)
Authorities France: the Paris prosecutor's cybercrime unit is investigating, as reported by AP. Sweden: the national cybersecurity center is "working on several grocery incidents", per NBC News. No national CERT notice on the 2 November incidents found by 3 November 2026
Status Musgrave later said its incident was resolved (AP). Coop says its situation is "contained and under control" (ABC News). CERT-FR says attack campaigns are probably still under way

Where did the supermarket fridge cyberattacks hit on 2 November 2026?

Retailers in six countries described fridge and freezer problems on the same day. None of these statements has been found on a retailer's own website yet, so treat them as press-reported.

Country Company What it said Reported by
Sweden ICA A "limited number" of stores, overnight; its own systems were not affected, but a small number of stores using an external supplier were AP, NBC News
Sweden ICA Kvantum Sjöbo (one store) Fridges and freezers "had been hacked and set to 50 degrees Celsius"; staff discarded products (store's Facebook post) AP, NBC News
Sweden Coop Six stores (AP citing TT; NBC News citing Aftonbladet). ABC News says "seven out of more than 800 stores" AP, NBC News, ABC News
Netherlands Ahold Delhaize An "IT incident" affecting refrigeration in several stores NBC News
Netherlands Danfoss 17 facilities using its systems, such as frozen product storage and butcher shops ABC News, citing the broadcaster NOS
Belgium and Luxembourg Delhaize An "IT incident" affecting refrigeration in "several dozen" stores, mostly in Belgium, a few in Luxembourg AP
Belgium Carrefour 15 of its more than 700 Belgian stores; impact "extremely limited" AP, NBC News
Belgium Colruyt Group Five Spar stores it runs under franchise NBC News
Belgium IKEA Mons A "cyber incident" hit its fridge and freezer units; the store stayed open NBC News
Ireland Musgrave (SuperValu) 13 stores; chilled and frozen products removed from sale as a precaution; later said the incident was resolved AP
Estonia Selver One outlet AP

Two more details came from the companies that run the equipment:

  • Belgium. Stephan Moelans, chief executive of Sabcobel, which operates Delhaize's refrigeration systems, told the Belga news agency that the units' evaporators were switched to defrost mode, as reported by NBC News.
  • Estonia. A refrigeration technology company said attackers had accessed a computer controlling a client's refrigeration and raised the temperature to 50 °C, the broadcaster ERR reported. Jann Mutso, chief executive of Kitman Coldtech, said the attack "was addressed within minutes" and caused no significant damage, as reported by AP.

Danfoss is a Danish company (CISA lists its headquarters as Denmark). One outlet calls it Dutch; that is not correct.

What happened in France in October 2026?

CERT-FR published alert CERTFR-2026-ALE-012 on 12 October 2026, added more targeted equipment on 13 October and updated its advice on 16 October. It reports "de nombreuses compromissions" (many compromises) of remote refrigeration controllers, but gives no store count, cites no CVE and names no other country.

The scale comes from AP's report of 13 October 2026 (AP via NY1):

  • Finance Minister Roland Lescure told Parliament that about 700 of France's roughly 10,000 supermarkets were hit, with no risk to the country's food supply;
  • Groupement Mousquetaires said 300 of its Intermarché and Netto stores were affected;
  • Coopérative U's chief executive, Dominique Schelcher, said 80 of its 2,000 stores were affected and some had to throw food away;
  • Carrefour and Monoprix were also affected;
  • the Paris prosecutor's cybercrime unit opened an investigation covering spoiled food and reports of fires;
  • Danfoss said most affected systems were older products no longer receiving updates, and that it has long advised keeping supported systems on the latest firmware and behind a firewall.

These are counts as of 13 October, not a final toll. AP's 2 November report adds that the French attacks "appeared to target old systems".

Are the two waves the same attack? Unknown. No source we read links them or names a single actor; they hit the same kind of equipment a month apart. CERT-FR's French alert points to controllers reachable from the internet. How the 2 November systems were reached has not been published.

Why can someone reach a supermarket fridge from the internet?

Many stores have a supervisory controller: a small computer that sets temperatures, schedules defrost cycles and raises alarms for every case and cold room. Refrigeration contractors often manage it remotely, so they can fix faults without a site visit.

That convenience is the risk. CERT-FR reminds operators that exposing a management interface on the internet "est contraire aux bonnes pratiques" (goes against good practice). An exposed end-of-life unit, one that no longer gets security fixes, faces "une très forte probabilité de compromission" (a very high probability of compromise).

The same pattern runs through firewalls and VPN appliances: internet-facing boxes with a lot of control and little watching, as our edge device vulnerabilities guide explains. A fridge controller belongs on that list.

What should store and facility operators do now?

These are CERT-FR's measures from its 16 October 2026 update, in plain terms:

  1. Take the controllers off the internet. Remove direct exposure for the named units and for any unit with a public IP address. Check your insurance terms before you cut the data feed to your service provider.
  2. Check the whole configuration, not just temperatures. CERT-FR singles out defrost schedules. A setting changed quietly can do damage hours later.
  3. Allow remote access only through a secure VPN (an encrypted private connection) or a protected network. Filtering by your contractor's IP address is an emergency stopgap, not a fix.
  4. Update the firmware following the manufacturer's guidance.
  5. On Danfoss units, set the security level to Strict mode and change default passwords, the examples CERT-FR gives.
  6. If a unit was compromised, CERT-FR says to restart the Danfoss unit or otherwise restore it to factory settings ("Redémarrer l'équipement Danfoss, sinon restaurer l'équipement"), then reconfigure it before it goes back into service.
  7. Plan to replace end-of-life units. For these, CERT-FR says a factory reset alone is not enough ("insuffisant"): the unit stays vulnerable.

What to ask your refrigeration contractor

Ask whoever manages your controllers:

  • Which of our sites have a controller reachable from the internet today, and how did you check?
  • How do your engineers connect remotely: VPN, protected network, or a direct web login?
  • Which model and firmware is each site running, and is any of it end-of-life?
  • Have default passwords been changed on every unit, and are Danfoss units set to Strict?
  • Do you keep a known-good copy of each site's settings, including defrost schedules?
  • If temperatures rise overnight, who gets the alarm, and does it still arrive if the controller has been tampered with?

What is known so far, and what is still open?

As of 3 November 2026:

Point Known, with source Still unanswered
Equipment Four product lines, for France (CERT-FR) Models and versions on 2 November
Scale About 700 stores in France (French government, via AP); per-company counts for 2 November A 2 November total. Coop's count (six or seven)
Effects Defrost mode (Sabcobel, via NBC News); 50 °C (ICA Kvantum Sjöbo and Kitman Coldtech, via AP) How access was gained on 2 November
Linked waves Same class of equipment Whether October and November are connected

Going deeper: for security and IT teams

The sources describe outcomes, not intrusion methods, so what follows is defensive guidance, not a reconstruction.

Threat model. The asset is a store-level supervisory controller with a web management interface. CERT-FR names four product lines and frames the French problem as exposure: an interface reachable from the internet, sometimes on end-of-life hardware. Its measures point to the likely gaps: default passwords, out-of-date firmware, and a Danfoss security level below Strict.

The documented effects, a forced defrost and temperatures set to 50 °C, make this an integrity attack on operational technology (OT), the systems that control physical equipment. Your data-loss controls will not see it.

Background: known flaws in this product class. CISA advisory ICSA-25-140-03 (first published 20 May 2025, Update A 26 August 2025) covers the Danfoss AK-SM 8xxA series, reported by Claroty Team82:

CVE Weakness (CWE) CVSS v3.1 Fixed in
CVE-2025-41450 CWE-287 Improper Authentication 8.2 R4.2
CVE-2025-41451 CWE-77 Command Injection 7.6 R4.3.1
CVE-2025-41452 CWE-15 External Control of System or Configuration Setting 5.4 R4.3.1

No source we read ties these CVEs to the 2026 incidents; CERT-FR cites none, and CISA says no known public exploitation specifically targeting them had been reported to it. They show this product class has carried serious authentication and command-injection flaws, so firmware level matters as much as exposure. How to weigh a CVSS score against exploitation evidence is covered in our guide to CVSS, EPSS and KEV.

Controls, in order.

  • Exposure first. CISA's recommended practices in the same advisory: "Minimize network exposure for all control system devices and/or systems", place them behind firewalls isolated from business networks, and "When remote access is required, use more secure methods, such as virtual private networks (VPNs)". CISA adds that a VPN "is only as secure as the connected devices".
  • Vendor access. VPN or protected network only. CERT-FR says source-IP filtering on a firewall "ne doit pas être considérée comme pérenne" (should not be treated as lasting).
  • Hardening. Current firmware, Strict security level on Danfoss units, no default passwords. For Dixell, CERT-FR points to the vendor's "Recommandations pour une utilisation sécurisée des superviseurs XWEB".
  • Lifecycle. Budget the replacement of end-of-life units; until then, keep them off any network an outsider can reach.

Detection and evidence.

  • Configuration drift. Export each site's settings, including defrost schedules and setpoints, while the site is healthy. Compare against that baseline after any alert and on a schedule. CERT-FR's instruction to review the whole configuration, "notamment les plages de dégivrage" (especially the defrost schedules), assumes you have something to compare against.
  • Independent temperature monitoring. If alarms come only from the controller that was tampered with, they may not arrive. A separate logger with its own alerting path is a general safeguard, not a CERT-FR requirement.
  • Network evidence and testing. At the store firewall, any inbound session to a controller from outside your contractor's VPN is a finding, as is a controller with a public IP. Have your firewall provider confirm from outside that no controller interface answers, after every contractor change.

In practice: exposure is a national question. John Billow, head of Sweden's national cybersecurity center, told NBC News on 2 November 2026 that it had "in recent weeks ... identified that we have quite a lot of exposed operational technology devices in Sweden that we have been clear about the necessity to update or patch". Danfoss's statement on France, that most affected systems were older products without updates (AP via NY1, 13 October 2026), points the same way: equipment that works fine as refrigeration but was never managed as a networked computer.

What to verify with your own team. Who owns these controllers in your asset inventory, are they in your vulnerability scanning scope, and who can order a site's controllers offline?

Key takeaways

  • On 2 November 2026, retailers in six European countries reported refrigeration disrupted by apparent cyberattacks, from one store (Selver) to several dozen (Delhaize).
  • In France, about 700 of roughly 10,000 supermarkets were hit in October, the government said, as reported by AP.
  • Store operators: controllers off the internet, VPN-only contractor access, current firmware, no default passwords, Danfoss Strict mode, defrost schedules checked.
  • Security teams: treat refrigeration controllers as OT assets with an owner, a baseline configuration and an exposure test.

Sources

Read on 3 November 2026. The four press items are news reports quoting companies and officials; none of the retailer statements has been found on the retailers' own sites.

Spotted a mistake? Report a correction.