European refrigeration attacks, Oct–Nov 2026

What happened. Overnight on October 11 to 12, 2026, someone reached the refrigeration controllers of about 700 French supermarkets and switched their display cases, cold rooms and freezers into a heating defrost[1]. On November 2, the same happened at retailers in Belgium, Luxembourg, the Netherlands, Sweden, Estonia, Ireland and Finland[2][3].

Why it matters. The attacks reached the equipment that keeps food cold directly from the internet, with no corporate IT network in between, and hit hundreds of sites in a single night[4]. Three weeks of warnings did not close the gap: the stores hit in November were those whose controllers were still exposed[5][3].

About this analysis. This analysis covers both waves together, because they share the method, the equipment and the effect; no one has shown that they share an attacker. It sets out what is known, stage by stage, and reflects the best available information as of November 2, 2026; new information could confirm, change or discredit parts of it.

Highlights

• Overnight on October 11 to 12, refrigeration controllers at about 700 French supermarkets were driven into a forced defrost at 50°C, and fresh and frozen stock was thrown away[1][6].
• On November 2, stores in seven more European countries were hit the same way, from more than 40 Delhaize stores in Belgium to 13 SuperValu stores in Ireland[3][2].
• In both waves the controllers were reachable from the internet and no IT network was involved. Danfoss says the systems hit in November still used default passwords; how the attacker got in in France is not established[4][5].
• No one has claimed either wave or been blamed for it, and no one has shown that the same attacker is behind both[7][2].

Attack flow

• Updated: 2026-11-02
• Intent: Malicious [confirmed]
• Threat actors: Not attributed [unknown | No public attribution]
• Access vector: Internet Accessible Device [confirmed]; Default / Weak Credentials [confirmed | November wave, per Danfoss]
• IT impact: Not in path [not in path | No IT network involved]
• OT targeting: Direct OT Compromise [confirmed]
• OT sophistication: Crude [confirmed]
• OT impact: Manipulate Control [confirmed | T0836, T0831]; Suppress Alarms [reported | T0878]
• Perils: Overheating [primary]; Fire [reported]
• Financial losses: Products & Materials [confirmed]; Business Interruption [confirmed]; Cyber-Physical Incident Response [confirmed]; Assets & Equipment [confirmed]; Cyber Incident Response [confirmed]; Data Loss [implied]; Reputation Damage [implied]

What happened

The first wave began around 23:00 on Sunday, October 11, in France, and was noticed around 04:00[8]. Controllers at Intermarché and Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc stores were set to defrost continuously with a 50°C setpoint; Les Mousquetaires said its cabinets ran at 50°C for six hours[9][6]. Its count rose from about 150 stores on October 12 to 300; Carrefour reported 80 supermarkets, Monoprix about 5% of its roughly 490 stores and Coopérative U 80 of its 2,000[6][1][10]. On October 13, the Minister of the Economy and Finance told Parliament that about 700 of France’s roughly 10,000 supermarkets had been affected[1].

CERT-FR, France’s national computer emergency response team, named Danfoss controllers and then Copeland and Dixell XWEB units, and told operators to take them off the internet[4]. The Paris prosecutor opened an investigation, and the Prime Minister ordered ANSSI, the national cybersecurity agency, to take up the case[6][11]. Censys counted 1,825 internet-exposed Danfoss panels in France on October 11 and 537 by October 14[12], and on October 13 Danfoss advised customers, at least in the Netherlands, to disconnect and reconnect only through a secured network[5]. The security firm Sekoia said stores in Spain, Portugal, Poland, Germany and Belgium had also been affected[6].

The second wave came in the early hours of Monday, November 2. Controllers were switched into defrost or set to 50°C at more than 40 Delhaize stores, 15 Carrefour, about 15 Intermarché and about five Spar stores and an IKEA in Belgium; several Delhaize stores in Luxembourg; at least 17 businesses, mainly butchers and small shops, in the Netherlands; a limited number of ICA stores and six Coop stores in Sweden; one large chain in Estonia; 13 SuperValu stores in Ireland; and several stores in Finland[3][2][5][13]. The Belgian federal prosecutor opened a criminal investigation the same day[3]. The installer that runs Delhaize’s refrigeration said “It seems to be the same scenario as three weeks ago in France”[3].

Intent: malicious

In both waves, setpoints were driven to 50°C on hundreds of units in a single night. That is not an error. Neither wave came with a ransom demand or a claim of responsibility. In October that absence puzzled investigators, according to a source with knowledge of the probe[7]; in November, SentinelOne told Reuters that the lack of any financial demand points to sabotage[2]. The purpose is unknown. The malice is not.

Threat actors: not attributed

No one has claimed either wave, and as of November 2 no authority had named an actor or reported an arrest[7][2]. Reuters could not establish who was behind the November attacks, or whether they were linked to France[2]. The link the installers and Danfoss describe is the method and the equipment, not a forensic finding[3][5]. In October, a consultant told ISMG that the attack “screams Russian APT”, while saying it was too early to speculate; nothing official supports that reading, and Moscow has repeatedly denied involvement in sabotage[11][2].

The pattern may reach beyond Europe. The Pentagon is treating freezer failures at stores on at least six US military bases in late August 2026 as a suspected cyberattack, and US Army criminal investigators are working with French law enforcement[14]. No threat actor is highlighted on the map.

Access vector: controllers exposed to the internet

Exposure is confirmed in both waves. CERT-FR says the compromised French controllers were exposed on public IP addresses[4]. In November, Danfoss said the systems hit were not on a secured network and still used default passwords, three weeks after its advice to disconnect: “Most stores took action at that time, but a small number did not”[5]. An Estonian supplier said the attackers reached the remote-management computer of an older Danfoss installation[13]. The map shows default credentials as confirmed for the November wave, on Danfoss’s statement.

How the attacker got in in France is not established. Claroty’s Team82 found three flaws in the newer AK-SM 800A, all fixed by Danfoss in 2025, among them a hidden “code-of-the-day” authentication bypass, CVE-2025-41450[15][16][17]; CISA said in May 2025 that no exploitation of it had been reported[18]. Most French victims ran the older AK-SM800 and AK-SC355, which those advisories do not cover[11], and a Synacktiv consultant said an audit had found one interface with no password at all[8]. No authority has named a vulnerability for either wave; researchers say the October weaknesses were reused in November[19].

IT impact: not in this attack’s path

No source reports phishing, a compromised corporate network or any movement from IT systems, in either wave. The controllers that run the cabinets were themselves reachable from the internet for remote maintenance, and the attacker went straight to them[4][13]. This stage is marked Not in path, and the flow on the map passes through it without touching any IT technique.

OT targeting: a direct compromise

In every store, in both waves, the refrigeration controllers were the first and only systems touched. That makes this a direct OT compromise: the attack acted on the equipment that runs the process, not on IT systems the stores depend on. The service companies that maintain the installations say their own systems were not the target[3][13].

OT sophistication: crude

The attacker used the equipment’s own defrost function, through its own management interface, on older devices that no longer receive updates[1][4]. A Synacktiv consultant said the method need be no more than an internet search for exposed units and a check for known weaknesses[8]. November needed nothing more: the same mechanism reached the stores that had not acted on October’s warnings, and no source describes a change of technique[3][5]. Scale is not the same as sophistication: one working method, repeated against every reachable unit, is enough to reach hundreds of sites in a night.

OT impact: settings changed, alarms quiet

What the attacker did on the devices is confirmed by the victims. In France, setpoints were raised to 50°C and defrost cycles that normally last 30 to 45 minutes ran for six hours or more[9][6]. In November, evaporators were switched into defrost, and displays were set to 50°C in Sweden and Estonia[3][13]. In MITRE ATT&CK for ICS terms that is Modify Parameter and Manipulation of Control, shown on the map as Manipulate Control.

The alarms are less clear. In France, staff at several stores reported on-call alerts that did not fire or fired late[20][8]; no authority has confirmed that they were deliberately disabled, so Suppress Alarms is shown as reported. No source describes the alarms in November.

Perils: overheating, and fires of unknown cause

The primary peril is overheating: cabinets heated their evaporators instead of cooling, and the stock spoiled[6][3].

Fire is reported, not established, and only in France. The Paris prosecutor reports fires among the damage and says its investigation should establish their link to the attack[6][11]; InformatiqueNews reports that their technical origin is still to be determined[8]. No retailer, installer or authority reported a fire in November. Fire is shown as reported, and the link from overheating to fire is dashed.

Every peril on the map traces back to a setting changed on a refrigeration controller.

Financial losses: what it cost

Losses were reported store by store, in euros, and no total exists for either wave. In France, the president of Les Mousquetaires put losses at tens of millions of euros nationwide in a single day, and the group told CNBC its own could reach several million euros[6][21]. In November, two victims gave their own figures, and Musgrave and an Estonian supplier, whose monitoring caught the attack at night, reported little or no loss[2][13]. Each figure below is one store’s, not a total.

Loss evidence

• Confirmed: Materials and product loss; Lost revenue and productivity; Manual operations and workarounds; Cyber-physical event response (cleaning, restocking); Property damage (fires reported, France); Network event response and recovery; Voluntary improvements; Third-party physical and societal impact; Cyber insurance (cover absent)
• Reported amounts: €60,000 Food thrown away at a Proxy Delhaize in Belgium, according to its owner[3]; €50,000 Stock lost at the Intermarché in Haguenau, according to its manager[22]; €15,000 Meat lost at a butcher’s in Hove, near Antwerp, according to its owner[2]
• Implied: Equipment repair and replacement; Production data integrity; Property insurance response; Business interruption liability (potential claim); Public relations response
• Not supported: Contingent business interruption; Ransom extortion; Bodily injury; Embedded device replacement; Legally mandated improvements; Regulatory action or liability; Contract violation obligation; Information privacy liability; Unauthorized resource consumption

Who pays is an open question. Intermarché told AFP that its insurance did not cover this type of incident, and the president of Les Mousquetaires said supermarkets would begin a legal battle over who is responsible for the losses. Brokers told Reuters that cyber insurance typically excludes physical losses[23]. As of November 2, no claim, lawsuit or insurer decision had been reported for either wave.

What this incident shows

Neither wave needed a phishing email, a corporate network or any malware that anyone has described. The equipment that keeps food cold was reachable from the internet and ran software that no longer received updates[4][1].

The three weeks between the waves are the lesson. After France, most operators took their controllers off the open internet, and the ones still exposed in November were the ones hit[5][3]. Both waves also show what limits the loss once a controller is reached: in October, the stores that lost nothing had someone awake who acted within hours[9]; in November, monitoring that woke a person decided the outcome[2][13]. For anyone assessing this kind of risk, the useful question to ask of a site is what would notice if the controller itself were turned against the process.

References

1. “Cyberattack targeting refrigeration systems hits 700 supermarkets, French government says.” Associated Press, 13 Oct. 2026, as carried by NY1. ny1.com/nyc/all-boroughs/ap-top-news/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says
2. Mannes, Marie, Helen Reid and Louise Rasmussen. “Cyberattack on fridges hits supermarkets across Europe.” Reuters, 2 Nov. 2026. reuters.com/business/retail-consumer/temperature-soars-swedish-grocery-store-freezers-one-store-blames-hackers-2026-11-02/
3. VRT NWS. “LIVE Federaal parket opent strafonderzoek na cyberaanval bij verschillende Belgische supermarkten [Federal prosecutor opens criminal investigation after cyberattack on several Belgian supermarkets].” Liveblog, 2 Nov. 2026. vrt.be/vrtnws/nl/liveblog/federaal-parket-opent-strafonderzoek-na-cyberaanval-bij-verschil~1793610043244/
4. CERT-FR (ANSSI). “CERTFR-2026-ALE-012 -- Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération [Security incident targeting remote controllers of refrigeration installations].” 12 Oct. 2026, updated 13 Oct. (other targeted equipment added) and 16 Oct. 2026 (recommendations revised). cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012
5. “Fridges, freezers of 17 Dutch businesses attacked; large supermarkets unaffected.” NL Times, 2 Nov. 2026. nltimes.nl/2026/11/02/fridges-freezers-17-dutch-businesses-attacked-large-supermarkets-unaffected
6. “Hackers heat French supermarket fridges, sparking fires and spoiling food.” Reuters, 12 Oct. 2026, as carried by Daily Maverick. dailymaverick.co.za/article/2026-10-12-hackers-heat-french-supermarket-fridges-sparking-fires-and-spoiling-food/
7. “Investigators hunt French supermarket fridge hackers; no claim of responsibility.” Reuters, 13 Oct. 2026, as carried by Business Insurance. businessinsurance.com/investigators-hunt-french-supermarket-fridge-hackers-no-claim-of-responsibility/
8. “Supermarchés : l’attaque des frigos Danfoss expose l’angle mort de l’OT [Supermarkets: the Danfoss fridge attack exposes OT’s blind spot].” InformatiqueNews, 13 Oct. 2026. informatiquenews.fr/magasins-systeme-intermarche-leclerc-et-monoprix-touches-par-cyberattaque-250707
9. “Cyberattaque Danfoss : combien va coûter la benne, magasin par magasin ? [Danfoss cyberattack: what will the skip cost, store by store?]” Je Bosse en Grande Distribution, 13 Oct. 2026. jebosseengrandedistribution.fr/2026/10/13/cyberattaque-danfoss-combien-va-couter-la-benne-magasin-par-magasin/
10. Khandelwal, Swati. “Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers.” The Hacker News, 13 Oct. 2026. thehackernews.com/2026/10/attackers-heat-french-supermarket.html
11. Schwartz, Mathew J. (ISMG). “Hackers Attack French Supermarket Freezers Causing Food Loss.” DataBreachToday, 12 Oct. 2026 (updated 13 Oct.). databreachtoday.com/hackers-attack-french-supermarket-freezers-causing-food-loss-a-33084
12. Poireault, Kevin. “France: Internet-Exposed Danfoss Controllers Drop 71% After Cyber-Attack.” Infosecurity Magazine, 15 Oct. 2026. infosecurity-magazine.com/news/france-expose-danfoss-controllers/
13. “Küberründaja tõstis Eesti suurpoe külmleti temperatuuri 50 soojakraadini [Cyber attacker raised an Estonian superstore’s refrigerated display to 50 degrees].” ERR, 2 Nov. 2026. err.ee/1610183272/kuberrundaja-tostis-eesti-suurpoe-kulmleti-temperatuuri-50-soojakraadini
14. “Reuters: Pentagon käsitleb sõjaväebaaside külmikute rikkeid küberrünnakuna [Reuters: Pentagon treats refrigerator failures at military bases as a cyberattack].” ERR, 29 Oct. 2026, relaying Reuters. err.ee/1610180536/reuters-pentagon-kasitleb-sojavaebaaside-kulmikute-rikkeid-kuberrunnakuna
15. Claroty Team82. “Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers.” Research, 9 Aug. 2026. claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
16. Danfoss. “DSA-2025-03-01: Improper Authentication vulnerability in Danfoss AK-SM8xxA Series, resulting in an authentication bypass.” Security advisory, 24 Mar. 2025. danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-03-01/
17. Danfoss. “DSA-2025-08-01.” Security advisory, 1 Aug. 2025. danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-08-01/
18. CISA. “ICSA-25-140-03: Danfoss AK-SM 8xxA Series.” ICS advisory, 20 May 2025. cisa.gov/news-events/ics-advisories/icsa-25-140-03
19. “Koelsystemen supermarkten via standaard wachtwoord gehackt [Supermarket cooling systems hacked through default password].” Security.NL, 2 Nov. 2026. security.nl/posting/959992/Koelsystemen+supermarkten+via+standaard+wachtwoord+gehackt
20. “Intermarché, U, Market, Monoprix, Leclerc : une cyberattaque coupe le froid dans les supermarchés [a cyberattack cuts the cold in the supermarkets].” Je Bosse en Grande Distribution, 12 Oct. 2026. jebosseengrandedistribution.fr/2026/10/12/intermarche-u-market-monoprix-leclerc-une-cyberattaque-coupe-le-froid-dans-les-supermarches/
21. Murray, Conor. “French Investigators Probe Supermarket Cyberattack That Could Cost ‘Millions Of Euros’.” Forbes, 13 Oct. 2026. forbes.com/sites/conormurray/2026/10/13/french-investigators-probe-supermarket-cyberattack-that-could-cost-millions-of-euros/
22. Garoscio, Paolo. “Cyberattaque sur les systèmes frigorifiques : des millions perdus dans les supermarchés français [Cyberattack on refrigeration systems: millions lost in French supermarkets].” Journal de l’Économie, 12 Oct. 2026. journaldeleconomie.fr/cyberattaque-frigo-octobre-explications/
23. Abbott, George, and Elizabeth Howcroft (Reuters). “Insurers Say French Supermarkets’ Cyber Insurance Unlikely to Cover Food Losses.” Carrier Management, 20 Oct. 2026. carriermanagement.com/news/2026/10/20/292812.htm