# Supermarket fridge cyberattacks in Europe: how they happened and how to check your stores

> How attackers heated supermarket fridges in France, Belgium, Sweden, Estonia and Ireland through internet-exposed controllers, and a checklist to secure yours.

Canonical: https://www.phishclean.com/blog/supermarket-fridge-cyberattacks-europe
Last updated: 2026-11-02

November 2, 2026 · 8 min read

By [PhishClean Research Team](https://www.phishclean.com/about) - browser security guidance based on phishing analysis, defensive research, and product work.

Supermarket fridges and freezers in France, Belgium, Sweden, Estonia, Luxembourg and Ireland were heated to around 50°C. Nobody broke in with malware or a phishing email. The refrigeration controllers had login pages open to the whole internet. Here is what is known, and a checklist any store manager or refrigeration contractor can work through today.

## The short version

- **What happened:** attackers logged in to refrigeration controllers over the internet and switched the cooling units to defrost, so they heated instead of cooled. Food was thrown away, and the Paris prosecutor reported fires at some French stores.
- **When:** overnight on 11–12 October 2026 in France, where the government said about 700 of the country's 10,000 supermarkets were affected. A second wave hit Belgium, Luxembourg, Sweden, Estonia and Ireland on 2 November.
- **How:** controllers from Danfoss (AK-SM and AK-SC series) and Copeland/Dixell (XWEB) were reachable from the internet. Many ran old firmware, and some models no longer get security updates. CERT-FR, France's national computer emergency team, says exposing these interfaces to the internet goes against good practice and that the campaign is probably still going on.
- **Who did it:** unknown. No group has claimed it, and no government has named anyone.

## How the attack worked

A supermarket's refrigeration runs on a supervisor box in the back room that controls every cabinet, cold room and freezer. Many of these boxes have a web page, so the refrigeration contractor can check temperatures and change settings from their own office. When that web page sits on a public internet address, anyone who finds it can try to log in.

Security firms had been warning about exactly this. In August, Claroty's Team82 research group published flaws in the Danfoss AK-SM 800A, including ways to bypass the login. Danfoss had already fixed them in software version 4.3.1. Coalition's internet scans from 7 September to 6 October counted at least 2,624 refrigeration controllers with a login page open to the internet, including 1,506 Danfoss StoreView admin panels, 54% of them on French networks. CISA, the US cyber agency, had published advisories on both product families earlier in the year.

Reports on the login itself differ. Some researchers describe a built-in "code of the day" that accepts the device's current date in place of the password. Danfoss says the affected units were running outdated firmware. Either way, the result was the same: once inside, the attackers put the evaporators into continuous defrost at a high setpoint, and the cabinets warmed for hours before anyone noticed.

This was not phishing and not ransomware. No one had to click anything. The only requirement was a controller reachable from the internet with weak or outdated login protection.

## Who has been hit so far

| Country | What has been reported |
| --- | --- |
| France (11–12 Oct) | About 700 supermarkets according to the government, including Intermarché, Netto, Carrefour, Coopérative U, Monoprix and E.Leclerc stores. ANSSI is coordinating the investigation. |
| Belgium (2 Nov) | Delhaize reported rising temperatures at dozens of stores, and its refrigeration contractor's CEO said the units were switched to defrost. Colruyt said five Spar franchise shops were hit, and Carrefour Belgium 15 of more than 700 stores. |
| Sweden (2 Nov) | ICA said a limited number of stores, which use an external supplier with connectivity outside ICA's network, were affected. Coop reported six stores. The national cybersecurity centre is handling several incidents. |
| Estonia (2 Nov) | A refrigeration technology supplier said attackers got into a computer controlling refrigeration at at least one chain and raised the temperature to 50°C. |
| Ireland (2 Nov) | Musgrave reported a cyber incident affecting 13 SuperValu stores. |
| Luxembourg, Netherlands | Named in reports of the second wave; fewer details so far. |

## Is your store's controller exposed? Three quick ways to tell

1. **Ask how the contractor connects.** If the answer is "we open a web page with an IP address" or "we type in the store's address from our office", the controller is probably on the internet. A safe setup goes through a VPN or the contractor's private network.
2. **Try it from outside.** On a phone using mobile data (not the store Wi-Fi), open the address the contractor uses. If you see a Danfoss, StoreView, XWEB or Dixell login page, anyone on the internet can see it too.
3. **Ask IT to check the store's public IP addresses** for open web ports. A login page for building or refrigeration equipment should never show up.

## Checklist: what to do today

This follows CERT-FR's alert CERTFR-2026-ALE-012 (updated 16 October) and the vendors' own guidance.

### If the controller has not been touched

- **Take it off the internet.** Remove the port forward or public IP address. Check your insurance contract first if it requires the contractor's data link.
- **Check the whole configuration**, especially defrost schedules and setpoints, against what the contractor installed.
- **Bring remote access back only through a VPN or a protected network.** Allowing only the contractor's IP addresses on the firewall is an emergency stopgap, not a fix.
- **Update the firmware** (for the Danfoss AK-SM 800A, version 4.3.1 or later), set the security level to Strict, and change every default password.
- **Plan to replace end-of-life units.** Controllers that no longer get updates stay vulnerable whatever you do to the password.
- **Add an independent temperature alarm**, such as a probe that texts the manager, so a hijacked controller can't also hide the problem.

### If it was tampered with

- Take it off the internet, then restart the Danfoss unit or restore it to factory settings.
- Reconfigure it before putting it back into service. CERT-FR warns that a factory reset removes the attacker's foothold but does not fix the weakness, so the steps above still apply.
- Report it to your national team: CERT-FR in France, the CCB in Belgium, CERT-SE in Sweden, CERT-EE in Estonia, the NCSC in Ireland and the Netherlands, or CIRCL in Luxembourg.

## Expect the scam emails that follow

Big incidents bring a second wave of phishing that borrows the headlines: fake "urgent firmware update" emails that look like they come from a refrigeration vendor, fake portals asking for controller logins, and fake insurance-claim pages for spoiled stock. The people who manage these systems are exactly who these emails will target.

That second wave is where PhishClean helps. It runs in the browser and checks every page you open for fake login forms, lookalike vendor domains and risky downloads, without sending your browsing anywhere. To be clear about the limits: PhishClean can't protect a refrigeration controller from someone logging in over the internet. Only the steps above do that. We are also adding a warning for staff and contractors: if you open a refrigeration or building-controller login page served from a public internet address, PhishClean will tell you that anyone on the internet can reach that page.

## Sources

- [CERT-FR alert CERTFR-2026-ALE-012](https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/) (in French): affected products and recommendations
- [The Register](https://www.theregister.com/security/2026/10/15/researchers-warned-attackers-could-defrost-the-food-months-before-french-supermarkets-got-hit/5303425): Claroty Team82 research, Coalition scan figures, CISA advisories
- [Security Affairs](https://securityaffairs.com/202260/security/another-fridge-cyberattack-hits-european-supermarkets-this-time-in-belgium-luxembourg-sweden-and-estonia.html): the 2 November wave and the defrost-mode mechanism
- [NBC News](https://www.nbcnews.com/world/europe/european-supermarkets-hit-new-fridge-cyberattack-rcna606972): retailer statements from Belgium, Sweden and Ireland
- [Al Jazeera](https://www.aljazeera.com/news/2026/11/2/freezers-in-sweden-belgium-overheat-following-possible-cyberattacks): Sweden, Belgium and Estonia reports
- [CNN](https://edition.cnn.com/2026/10/12/europe/france-supermarket-cyberattack-fridges-intl): the French attack and fires

- [How to spot a phishing email that looks legitUseful when scammers borrow trust from breach news.](https://www.phishclean.com/blog/how-to-spot-phishing-email-that-looks-legit)
- [What to do after a phishing attackThe first hour, step by step.](https://www.phishclean.com/blog/what-to-do-after-phishing-attack)
- [PhishClean for TeamsPhishing protection for store and office staff, $5 per user per month.](https://www.phishclean.com/business)
- [Phishing attacks guideHow attackers turn public incidents into credential theft.](https://www.phishclean.com/threats/phishing-attacks)

## Protect the people who manage your stores

PhishClean catches fake vendor portals, lookalike domains and risky downloads in the browser. Nothing you browse is sent to us.

[PhishClean for Teams](https://www.phishclean.com/business)

Last updated: 2 November 2026

## Share this guide

If this helped, share it with someone who would benefit from it, or subscribe for new browser-security guides from PhishClean.

Share on X Share on LinkedIn

Get practical phishing and browser-safety articles in your inbox. No salesy drip, just new guides and product updates when they are worth sending.