Refrigeration Controller Attacks Spread to More Than 115 Stores in Six European Countries

The attacks on internet-exposed refrigeration controllers that France's national Computer Emergency Response Team (CERT-FR) warned about in October have spread across Europe. Overnight from 1 to 2 November 2026, attackers remotely changed temperature settings, shut down units or triggered defrost cycles on refrigeration and freezer systems at more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, according to BleepingComputer. Several supermarket chains confirmed the problems in statements to BleepingComputer.

The Red Tiger team covered the French wave on 22 October. We are flagging this second wave for industrial owners because the same kind of controller runs cold rooms, freezers and cold storage far outside the grocery aisle.

The campaign so far

CERT-FR alert CERTFR-2026-ALE-012, issued 12 October and last updated 16 October, reported numerous compromises of internet-exposed Danfoss AK-SM and AK-SC refrigeration controllers and Copeland and Dixell XWEB supervisors in France, which were set to defrost mode. CERT-FR said attack campaigns were probably still ongoing. The Centre for Cybersecurity Belgium (CCB) repeated that warning on 13 October. No group has claimed either wave, and no government agency has said who is behind them. A CCB spokesperson told The Record: "It is not known who is behind this attack, and it may never be possible to identify them."

What is new

Chains that confirmed problems to BleepingComputer:

• ICA in Sweden, at least 4 stores.
• Coop Sweden, 7 of more than 800 stores.
• Ahold Delhaize in Belgium and Luxembourg, around 40 stores.
• Carrefour Belgium, 15 of 700 stores.
• Spar stores in Belgium run under Colruyt Group, 5 stores.
• Intermarché Belgium, around 15 stores.
• SuperValu Ireland, 13 stores.
• Selver Estonia, 1 store.

In the Netherlands, at least 17 butcher shops and neighborhood stores were hit.

An ICA store manager told Swedish broadcaster TV4 that freezer setpoints had been changed overnight to 50 degrees Celsius (122 degrees Fahrenheit) and could not be changed back, so the store had to throw out its frozen food. Belgian broadcaster RTL identified Sabcobel as the refrigeration vendor at several of the affected stores. Its director, Stephan Moelans, said the attacker used the same vulnerability as in last month's French attacks, that technicians began disconnecting installations from 1 in the morning, and that a software update alone is not enough because the units also need physical changes. His advice was to manage refrigeration only over a secure connection.

A Danfoss spokesperson told Dutch broadcaster NOS that the systems attacked in the Netherlands were not on a secured network and still had a default password, and that Danfoss had advised its Dutch customers on 13 October to disconnect them from the internet. At one frozen storage site, freezers that should run at minus 20 degrees Celsius were found at minus 10. Sweden's National Cybersecurity Center told SVT its incident team is in contact with the affected stores. Ireland's National Cyber Security Centre is closely monitoring, according to RTÉ, and SuperValu's owner Musgrave said the problem was limited to one specific refrigeration model and that its own monitoring alerted staff. In Estonia, refrigeration contractor Kitman Coldtech told ERR the attackers reached an older Danfoss system at the Selver store, and that the change was caught within ten minutes with no product lost.

What this means for OT owners

Networked refrigeration and building automation controllers sit in food and beverage plants and cold storage warehouses, pharmaceutical cold rooms, chemical storage that must stay below a set temperature, and refrigerated container yards at ports. They are usually installed and remotely supported by a refrigeration or building services contractor, often reached over a public internet address or a cellular modem, and they rarely appear in the operational technology (OT) asset inventory or the plant's remote access policy. This wave shows that a controller left exposed after a public warning will be found. It also shows the value of alarms: where monitoring caught the change quickly, stores lost little or nothing.

What to do now

1. Find and remove internet exposure. Ask facilities and every refrigeration and building automation contractor for a list of controllers and how each one is reached remotely, then check your public internet addresses for exposed management pages. Take them off the public internet, as CERT-FR and the CCB direct.
2. Put remote access behind a secured virtual private network (VPN) or a jump host with multi-factor authentication (MFA), meaning a second check such as a code from an app on top of the password, and log every session. This includes systems a contractor manages for you.
3. Change default and shared passwords and update firmware. For Danfoss controllers, CERT-FR also advises setting the security level to Strict. Plan to replace end-of-life units that can no longer be patched, because the vendor fix may need physical changes and not only a software update.
4. Set up temperature alarms that reach a person overnight, and write a manual fallback: who goes to site, how to run the system locally, and when to move product. After any alarm, compare setpoints, alarm limits and defrost schedules against known-good values.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources: BleepingComputer (2 November 2026) https://www.bleepingcomputer.com/news/security/hackers-disrupt-refrigeration-systems-at-european-supermarkets/ ; CERT-FR alert CERTFR-2026-ALE-012 (French) https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-012/ ; CCB warning (13 October 2026) https://ccb.belgium.be/advisories/warning-security-incidents-france-targeting-remote-controllers-refrigeration ; NOS (Dutch, 2 November 2026) https://nos.nl/artikel/2637734-ook-koelsystemen-in-nederland-aangevallen-bij-17-bedrijven-temperatuur-aangepast ; The Record (2 November 2026) https://therecord.media/cyberattack-grocery-freezers-europe ; RTÉ (2 November 2026) https://www.rte.ie/news/business/2026/1102/1597612-13-supervalu-stores-hit-by-suspected-cyber-attack/ ; SVT (Swedish, 2 November 2026) https://www.svt.se/nyheter/lokalt/skane/icas-kylar-och-frysar-i-sjobo-hackade-haller-ej-temperaturen ; ERR (2 November 2026) https://news.err.ee/1610183296/hackers-raised-freezer-temperature-at-selver-supermarket-to-50-c

‍