SecurityNov 4, 2026, 10:31 AM UTC·2 min read

Hacked fridges: supermarket cooling systems hit across Europe

Three weeks after attacks on French supermarkets, new incidents hit commercial refrigeration across Europe, exposing the limits of centralised protection at retail chains.

Rows of supermarket refrigerated display cases with a remote controller screen showing a temperature alert. — Image: FRENCHWEB.FR

SUMO

Dialo

ediviewer

Three weeks after the attacks on French supermarkets, new incidents have struck commercial refrigeration in several European countries. On 2 November, Swedish retailer COOP reported disruption to the cooling systems of seven stores. Some equipment shut down, some ran partially, and in one store the system began producing heat. Several ICA stores were also affected.

The same night, incidents were reported in Belgium, the Netherlands, Luxembourg, Ireland and Estonia. In Finland, a few stores noticed temperature anomalies. The similarity with the French attacks of October is striking.

From France to the rest of Europe

On the night of 11 to 12 October, refrigeration units in several hundred French shops were disrupted. Stores had to throw away fresh and frozen goods. Press estimates go as high as 700 sites, with losses in the tens of millions of euros. CERT-FR issued an alert on 12 October about compromised remote controllers and widened the list of affected equipment the next day, including Danfoss AK-SM and AK-SC series and Copeland and Dixell XWEB systems.

These controllers let operators monitor installations, adjust settings and schedule maintenance remotely. That convenience becomes a weakness when access is poorly protected. A setpoint changed to 50 °C does not mean products reach that temperature, but restoring the system does not make spoiled goods sellable again.

Who is responsible?

The core problem is shared responsibility. The manufacturer supplies updates, the refrigeration contractor installs and maintains the hardware, and the shopkeeper bears the losses. The chain's IT department may have no access to each store's equipment. In Belgium, Colruyt said the five affected SPAR stores are run by independent operators with their own systems, while Carrefour reported fifteen stores hit.

Censys data shows the number of Danfoss StoreView interfaces visible online in France fell from 1,825 on 11 October to 220 on 2 November, a drop of 88%. Just over 1,000 instances remain exposed worldwide, including 138 in Belgium, 51 in the Netherlands and 50 in Sweden. CERT-FR stresses that resetting a device does not fix the flaw: direct internet access must be removed, patches applied and configuration secured.

Speed and attribution

Response time shaped outcomes. In Estonia, Kitman Coldtech said it intervened within minutes with no significant damage, and Musgrave said the incident at thirteen SuperValu stores in Ireland was resolved Monday afternoon.

No ransom demand has been reported, which makes sabotage plausible, but it proves neither a state operation nor a single campaign. Investigators have not publicly linked the incidents. Belgium's federal prosecutor has opened an investigation, and Finland's Kesko is still investigating, without ruling out remote intervention.