Supermarket freezer cyberattacks: how refrigeration systems can be manipulated over the internet
In November 2026, supermarkets across Europe removed food from sale after connected refrigeration systems were reportedly manipulated. These cases show why protecting industrial controllers matters just as much as securing computers.
Published: · Based on official alerts, manufacturer information and corroborated reporting. Incident totals may change.
Freezer temperatures are not always adjusted with a physical dial. In many supermarkets, computerised systems monitor cold rooms, schedule defrost cycles and allow maintenance teams to make changes remotely. That can make operations more efficient, but an unauthorised person who gains access to a controller may also change how physical equipment operates.
Businesses and authorities are investigating incidents across Europe involving precisely these kinds of systems. It has not been established that all the events were caused by the same attackers or the same vulnerability. It is important to distinguish confirmed compromises, incidents reported by businesses and cases that remain under investigation.
2 November: freezer and refrigeration incidents across Europe
During the night of 1–2 November 2026, shops in several countries reported abnormal refrigeration settings and had to remove chilled or frozen products. Settings as high as 50°C were reported on some controllers; that does not mean every affected freezer physically reached that temperature.
- Belgium and Luxembourg: Delhaize reported problems at several dozen locations. Carrefour said 15 of its more than 700 Belgian stores were affected, and incidents were also reported at Spar outlets.
- Sweden: ICA reported a limited number of affected stores. One ICA location in Sjöbo said its equipment had been set to 50°C. Coop reported problems at six stores in central Sweden, according to information available that day.
- Ireland: Musgrave reported refrigeration incidents at 13 SuperValu supermarkets. Products were withdrawn as a precaution, and the company said the issue had been resolved that day.
- Estonia: a refrigeration service provider reported unauthorised access to a controller at one shop. The Selver chain confirmed a store had been affected; according to the provider, a rapid intervention prevented significant damage.
- The Netherlands: Dutch reporting identified 17 affected businesses, mainly smaller shops and butcher's stores, rather than a nationwide outage across major chains.
Reuters and Associated Press reported these statements from businesses and service providers. The final scale of the incidents and any connection between them remain under investigation.
October 2026: an earlier wave in France
On 12 October, France's national cybersecurity response team published alert CERTFR-2026-ALE-012 following numerous compromises of remotely accessible refrigeration controllers. The alert named Danfoss AK-SM and AK-SC devices, along with Copeland xweb and Dixell xweb systems. It was updated on 16 October.
Reports from the French investigation referred to hundreds of affected sites. Initial accounts mentioned more than 350 supermarkets; the Paris prosecutor's office later gave The Record an estimate approaching 700 victims. These figures refer to different reporting stages and should not be added together.
Manipulation of settings and defrost cycles led many businesses to discard food. Damage to equipment was also reported. The official alert emphasised the risk of exposing control interfaces directly to the internet, particularly where equipment is no longer supported.
Other documented cases: the United States, Russia and Israel
United States, August 2026. At least six military base commissaries experienced refrigeration failures. Reuters reported on 29 October that the Pentagon was investigating whether the incidents could have been cyberattacks. At one location, a freezer was reportedly found in defrost mode. This was an investigation, not a publicly confirmed cyberattack; a connection to the French incidents had not been demonstrated.
Russia and Israel, 2022. In an October 2025 technical bulletin, manufacturer Danfoss described attacks affecting sixteen Russian supermarkets and forty Israeli locations using AK-SM 800 controllers. In Israel, Danfoss said the affected stores did not have adequate firewall or VPN protection. These historical cases are documented by the manufacturer, but they do not establish a link to the people responsible for the incidents in 2026.
The underlying lesson predates November 2026: connected industrial systems have required maintenance and secure remote access for years.
How does this relate to the Internet of Things (IoT)?
The Internet of Things (IoT) refers to physical devices that exchange data over networks, including cameras, thermostats, smart plugs, sensors and connected appliances. Commercial refrigeration controllers belong more specifically to operational technology (OT) and industrial IoT. They can do more than report data: they also control machinery and real-world processes.
The distinction matters. A compromised home camera may threaten privacy. Unauthorised remote control of a refrigeration installation may lead to spoiled food, damaged equipment and interruptions to service. Not every IoT device is vulnerable, and not every connected refrigerator is remotely accessible. The risks depend on the design, configuration, exposed interfaces and available security updates.
To understand what can be checked at home, see our connected-home security guide. Its advice about accounts, updates and Wi-Fi can help household users, but it is not a substitute for industrial security controls.
How exposure happens: remote access, credentials and ageing equipment
A maintenance company may need remote access to a controller to change settings or troubleshoot problems. That interface should not be openly accessible to anyone on the internet. France's CERT considers public exposure of refrigeration administration interfaces contrary to accepted security practice.
Unsupported equipment, default passwords and insufficiently protected remote-access connections can enlarge the attack surface. Danfoss has acknowledged that certain legacy controllers reached end of support and has recommended migration to maintained models. Investigators have not established that the same specific vulnerability was exploited in every incident.
Practical steps that can reduce the risk
For supermarkets and refrigeration facility operators
- Inventory controllers and check their exposure: identify devices, maintenance providers and management connections. Do not expose administrative panels directly to the public internet.
- Secure remote access: use a properly configured VPN or protected network, individual accounts and strong authentication where supported. A VPN alone cannot fix an unpatched device.
- Replace default credentials and audit permissions: remove unnecessary accounts and document who is allowed to change temperatures or defrost schedules.
- Update or replace unsupported equipment: follow manufacturer guidance. A factory reset cannot by itself make an unsupported, exposed controller safe.
- Segment networks and monitor the cold chain: keep customer Wi-Fi and general office devices from reaching industrial controllers unnecessarily; use independent alarms and verification where appropriate.
- Prepare an incident response plan: document events, protect perishable stock and coordinate with qualified technicians. Do not shut down, restart or reset essential equipment without first assessing operational risks.
CERT-FR recommends removing public exposure and restoring administrative access only through protected networks. Its alert also differentiates between devices already compromised and exposed devices where a compromise has not yet been observed.
For home routers and connected devices
You do not have to run a supermarket to benefit from better network security. At home, check for router firmware updates, use distinct passwords for the router's administration interface and connected services, enable WPA2-AES or WPA3 where compatible, and review which devices actually need remote access.
If your router supports a properly isolated guest network, separating some connected devices from your primary computers and phones may help. However, router isolation features vary, and some smart-home automations can stop working across separate networks. Consult your internet provider or the manufacturer's instructions before opening ports, enabling UPnP or changing advanced settings.
Our step-by-step guide to cameras, IoT devices and Wi-Fi security and free connected-home and router checklist provide practical starting points. The checklist is manual: it does not scan your network, ask for passwords or promise complete protection.
Who is behind these incidents?
As of the publication date, no conclusive public attribution identified the people behind all of these events. Nor had it been established that the November incidents in Europe and the October wave in France were part of a single campaign. There was also insufficient public evidence to claim that artificial intelligence played a role. The available reporting supports discussion of suspected or reported unauthorised manipulation and access, but not an attribution to a specific country or group.
When a cyber incident has physical consequences
These stories should not be taken to mean that every connected device is about to be attacked. They do show a tangible consequence of poor configuration: digital access can affect physical processes that businesses and people depend on.
Connectivity can improve maintenance and monitoring, but it needs to be paired with supported equipment, protected networks and a clear response process. A useful starting point is knowing what is connected, who can control it and what would happen if it stopped working as expected.
Frequently asked questions
Could my home freezer be hacked?
There is no blanket answer. The incidents discussed here mainly involved commercial and industrial controllers. If you own a connected appliance, review its support status, official app and remote-access permissions. Its connectivity alone does not mean it has the same weakness.
Is installing a VPN enough?
No. A properly configured VPN can reduce exposure of remote administration systems, but it cannot replace security updates, access controls, network segmentation and monitoring. It cannot make an unsupported controller secure on its own.
Should I disconnect all my IoT devices?
Not as a general rule. Review which features require connectivity and follow the manufacturer's guidance. On essential installations, coordinate any disconnection with technical staff.
Sources and editorial verification
Information checked against material available by 2 November 2026. Business statements, official technical alerts, manufacturer-documented precedents and ongoing investigations are distinguished throughout. The reported number of affected stores may change.
- Associated Press, 2 November 2026 — European supermarket refrigeration incidents.
- Reuters, 2 November 2026 — Reports of altered freezer temperatures across Europe.
- CERT-FR/ANSSI, alert CERTFR-2026-ALE-012 (12–16 October) — Affected controllers and mitigations.
- The Record, 2 November — Paris prosecutor's figures and additional incidents.
- Reuters, 29 October — Pentagon investigation into military commissary freezer failures.
- Danfoss, October 2025 technical bulletin — Legacy support and cases in Russia and Israel.
- INCIBE (Spain) — Router security, configuration and guest networks (Spanish).
Back to the Security Centre · Protect your connected devices