Supermarket fridges and freezers in France, Belgium, Sweden, Estonia, Luxembourg and Ireland were heated to around 50°C. Nobody broke in with malware or a phishing email. The refrigeration controllers had login pages open to the whole internet. Here is what is known, and a checklist any store manager or refrigeration contractor can work through today.
A supermarket's refrigeration runs on a supervisor box in the back room that controls every cabinet, cold room and freezer. Many of these boxes have a web page, so the refrigeration contractor can check temperatures and change settings from their own office. When that web page sits on a public internet address, anyone who finds it can try to log in.
Security firms had been warning about exactly this. In August, Claroty's Team82 research group published flaws in the Danfoss AK-SM 800A, including ways to bypass the login. Danfoss had already fixed them in software version 4.3.1. Coalition's internet scans from 7 September to 6 October counted at least 2,624 refrigeration controllers with a login page open to the internet, including 1,506 Danfoss StoreView admin panels, 54% of them on French networks. CISA, the US cyber agency, had published advisories on both product families earlier in the year.
Reports on the login itself differ. Some researchers describe a built-in "code of the day" that accepts the device's current date in place of the password. Danfoss says the affected units were running outdated firmware. Either way, the result was the same: once inside, the attackers put the evaporators into continuous defrost at a high setpoint, and the cabinets warmed for hours before anyone noticed.
This was not phishing and not ransomware. No one had to click anything. The only requirement was a controller reachable from the internet with weak or outdated login protection.
| Country | What has been reported |
|---|---|
| France (11–12 Oct) | About 700 supermarkets according to the government, including Intermarché, Netto, Carrefour, Coopérative U, Monoprix and E.Leclerc stores. ANSSI is coordinating the investigation. |
| Belgium (2 Nov) | Delhaize reported rising temperatures at dozens of stores, and its refrigeration contractor's CEO said the units were switched to defrost. Colruyt said five Spar franchise shops were hit, and Carrefour Belgium 15 of more than 700 stores. |
| Sweden (2 Nov) | ICA said a limited number of stores, which use an external supplier with connectivity outside ICA's network, were affected. Coop reported six stores. The national cybersecurity centre is handling several incidents. |
| Estonia (2 Nov) | A refrigeration technology supplier said attackers got into a computer controlling refrigeration at at least one chain and raised the temperature to 50°C. |
| Ireland (2 Nov) | Musgrave reported a cyber incident affecting 13 SuperValu stores. |
| Luxembourg, Netherlands | Named in reports of the second wave; fewer details so far. |
This follows CERT-FR's alert CERTFR-2026-ALE-012 (updated 16 October) and the vendors' own guidance.
Big incidents bring a second wave of phishing that borrows the headlines: fake "urgent firmware update" emails that look like they come from a refrigeration vendor, fake portals asking for controller logins, and fake insurance-claim pages for spoiled stock. The people who manage these systems are exactly who these emails will target.
That second wave is where PhishClean helps. It runs in the browser and checks every page you open for fake login forms, lookalike vendor domains and risky downloads, without sending your browsing anywhere. To be clear about the limits: PhishClean can't protect a refrigeration controller from someone logging in over the internet. Only the steps above do that. We are also adding a warning for staff and contractors: if you open a refrigeration or building-controller login page served from a public internet address, PhishClean will tell you that anyone on the internet can reach that page.
PhishClean catches fake vendor portals, lookalike domains and risky downloads in the browser. Nothing you browse is sent to us.
PhishClean for TeamsLast updated:
If this helped, share it with someone who would benefit from it, or subscribe for new browser-security guides from PhishClean.
Get practical phishing and browser-safety articles in your inbox. No salesy drip, just new guides and product updates when they are worth sending.