At 2 a.m. on November 2, someone logged into the refrigeration controllers of an ICA franchise store in Stockholm and set every freezer to 50 °C. Staff noticed hours later. By then the stock was gone.
The same night, stores in Sweden, Belgium, Luxembourg, the Netherlands, Ireland, Italy and Estonia reported the same thing. It was the second supermarket fridge cyberattack in Europe in three weeks. Nobody needed a zero-day to do it. The attackers walked in through controllers that sat on the public internet with factory passwords and firmware that stopped getting patches years ago.
If you run IT outside retail, this is still your story. Every company has some version of the supermarket fridge.
What happened, wave by wave
The first wave hit France overnight on October 11 to 12. The French government put the count at about 700 supermarkets. Intermarché said 150 to 200 of its stores were affected, Coopérative U fewer than a hundred, and E.Leclerc said the breach came through one of its refrigeration equipment suppliers. Temperatures in some cabinets reached 50 °C, and several stores reported fires.
| Date | Where | Who was hit | Reported impact |
|---|---|---|---|
| Nov 2, 2026 | Sweden, Belgium, Luxembourg, Netherlands, Ireland, Italy, Estonia, Greece | ICA, Coop, Delhaize, Carrefour Belgium (about 15 of 700 stores), at least one Ikea, a butcher shop in Athens | Freezers set to 50 °C, food discarded, units taken offline |
| Oct 11 to 12, 2026 | France, then Belgium and the Netherlands | Intermarché, Coopérative U, E.Leclerc supplier, about 700 stores in total | Spoiled stock, fires in several stores, Paris cybercrime probe |
Coop said six of its stores in central Sweden had problems. In Greece, a butcher in the Athens suburb of Kifisia found a unit set to 150 °C when his 4 a.m. shift arrived; a technician needed two hours to take control back.
Nobody has claimed the attacks. Sweden’s national cybersecurity center said it would not speculate on attribution, and the European Commission called the incidents “not isolated” but left the investigation to national authorities.
Why the fridges were such easy targets
Short version: they were computers that nobody treated as computers.
France’s cyber agency ANSSI listed compromised remote controllers from the Danfoss AK-SM and AK-SC ranges, plus Copeland and Dixell xweb systems (INCIBE-CERT keeps a summary of the French alerts). Danfoss said most affected units were older products that no longer get security updates. Copeland pointed to a flaw in discontinued controllers.
Richard Horne, head of the UK’s National Cyber Security Centre, said the French units were connected straight to the internet with default passwords. Laurens Singier, a researcher at Howest University’s Cyber 3 Lab in Bruges, told Reuters the core mistake was putting the devices online at all.
Three failures stacked on top of each other:
- Direct internet exposure. Controllers reachable from anywhere, often so a refrigeration contractor could log in remotely.
- Factory credentials. Default usernames and passwords, sometimes printed in public manuals.
- End-of-life firmware. Known vulnerabilities on hardware that the vendor had stopped supporting.
None of this is new. Back in 2019, researchers found thousands of industrial refrigeration systems online that could be defrosted with a default password from the vendor’s own documentation. Within hours of the French wave, Claroty’s Team82 published an analysis of the internet-facing Danfoss systems behind it.
Darktrace’s Nicole Carignan put it bluntly: the systems keeping food cold often run on hardware that has had no budget since the day it was installed. That is technical debt with a temperature.
Every company has a fridge problem
The fridges were bought by facilities, installed by a contractor and monitored by a vendor portal. IT often never saw them. That ownership gap is the real vulnerability, and it exists in almost every enterprise. It is a textbook business-IT alignment failure: one team buys the device, another inherits the risk.
Think about what your organization runs that looks like an appliance but behaves like a server:
- HVAC and building management systems
- Badge readers, door controllers and CCTV
- Server room cooling, UPS units and generators
- Production line PLCs, lab freezers, pharmacy fridges
- Smart meters, EV chargers, digital signage
Supermarkets connected their fridges for good reasons. Remote monitoring cuts energy bills, catches failing compressors early and reduces food waste. The same logic is driving connectivity everywhere else. The cost shows up later, when nobody owns the patching.
There is also a regulatory angle. Under NIS2, food production and distribution is a covered sector in the EU, and management bodies carry responsibility for cyber risk. “The contractor handled it” will not hold up well with a national authority.
Was AI involved?
Probably not, at least not in any way that mattered. Experts at the UK cyber center and Darktrace said the techniques did not require it. Singier did warn that AI tools are lowering the bar for amateurs, which fits a wider trend. On the same day this story broke, Reuters reported that India’s cybercrime agency had warned financial firms about attacks run with the help of AI agents, and French bank Crédit Mutuel Arkéa disclosed a breach that enabled fraudulent transactions.
The fridge attacks are a reminder that the boring vulnerabilities still do most of the damage. Scanning the internet for exposed controllers with known default logins takes very little skill. Web stacks have the same problem, as our breakdown of the PHP2Shell vulnerability shows.
What to do this quarter
The fixes are cheap compared with a night of spoiled inventory. A practical order of work:
- Find every internet-facing OT and IoT device. Run an external attack surface scan against your own IP ranges and those of your contractors. Shodan-style search engines are exactly how attackers find these units.
- Pull them off the public internet. Put remote access behind a VPN or a zero-trust gateway with MFA. Singier also suggests private cellular links using SIM cards for remote monitoring, as solar and EV charger operators already do.
- Kill default credentials. Unique passwords per device, stored in a vault, rotated when a contractor leaves.
- Map end-of-life hardware. Ask each vendor which models still get patches. Anything unsupported gets isolated now and a replacement date in the budget.
- Segment. OT networks should not sit on the same flat network as point-of-sale or office systems.
- Rewrite contractor terms. Make remote access, patching and incident notification contractual obligations, with the right to audit.
- Alert on physics, not just logs. A freezer moving from -18 °C to 50 °C at 2 a.m. should page someone in minutes. In Stockholm it took hours.
If you already run a legacy system modernization program, add building and store systems to its scope. They are legacy too.
FAQ
How did hackers get into supermarket fridges in Europe? Through remote refrigeration controllers exposed to the internet. Investigators and vendors pointed to default passwords and old Danfoss, Copeland and Dixell units that no longer receive security patches. No zero-day vulnerability was needed.
Which supermarkets were affected? In October: about 700 stores in France, including Intermarché and Coopérative U. On November 2: ICA and Coop in Sweden, Delhaize and Carrefour in Belgium and Luxembourg, plus stores in the Netherlands, Ireland, Italy, Estonia and Greece.
Who is behind the fridge attacks? Unknown as of November 4, 2026. National agencies in France, Sweden, Italy and the UK are investigating, and no group has claimed responsibility.
Can the same attack hit other industries? Yes. Any internet-facing controller with default credentials is exposed, whether it runs a freezer, an HVAC system or a lab fridge. Pharmaceutical cold chains and data center cooling are obvious next candidates.
What is the fastest fix for exposed IoT devices? Take them off the public internet and change the default passwords. Both can usually be done in days. Firmware replacement and network segmentation take longer and need budget.
