On the night of October 11, attackers reached into hundreds of French supermarkets and changed how their refrigeration equipment behaved. By morning, cases that should have held food at a few degrees above freezing were running as hot as 50°C. Three weeks later, on the night of November 1, it happened again, this time in Belgium, Luxembourg, Sweden, Ireland, Estonia, the Netherlands and Finland. 

This supermarket cyberattack in 2026 is one of the clearest recent examples of a refrigeration system cyberattack with direct physical consequences. It involved no ransomware, no ransom demand and, so far, no public claim of responsibility. It also exposes a hard truth about OT security in retail: some of the most consequential control systems in a store sit on equipment that nobody in IT has ever inventoried. 

This blog separates what is confirmed from what is reported and what remains unknown. It then explains how refrigeration control systems work, why they are exposed, how an attacker could abuse them, and what operators should do now. 

Executive summary 

• What happened. Attackers remotely changed settings on refrigeration controllers, forcing defrost cycles and raising temperatures. CERT-FR confirmed “numerous compromises” of Danfoss AK-SM and AK-SC controllers and Copeland/Dixell XWEB supervisors. [S8] 

• Two waves. Wave 1 hit France on October 11–12. Wave 2 hit at least seven countries on November 1–2. [S6, S1, S4] 

• How they got in is not public. CERT-FR points to management interfaces exposed to the internet. Danfoss says the Dutch systems hit in wave 2 were on an insecure network and used a default password. No official source has named an exploited vulnerability. [S8, S12, S13] 

• Many devices were unsupported. Danfoss said many affected units were end of life or on outdated firmware. [S15] 

• No attribution. No group has claimed the attacks, no ransom has been reported, and investigators in France and Belgium are working. [S15, S6] 

• The core lesson. A controller that sets food-safety temperatures and sits reachable from the internet is a critical OT asset. It needs the same discipline as a plant-floor PLC. 

What happened: the verified overview 

Wave 1: France, October 11–12 

Leclerc, Intermarché and Coopérative U confirmed a cyberattack to AFP. Leclerc said the attack affected one of its refrigeration equipment suppliers. The Paris prosecutor opened an investigation into a “large-scale cyberattack” on connected refrigerators at several chains. [S6] Reporting from French broadcaster BFM said the attackers remotely triggered forced defrosting. [S6] Reuters reported at least 350 supermarkets caught up in the attack. [S15] Fires were reported at several stores, though no source we found has established that the attack caused them. [S7] 

Wave 2: seven countries, November 1–2 

Delhaize reported an “IT incident” affecting refrigeration at several dozen stores in Belgium and Luxembourg. Carrefour Belgium said a cyberattack targeting refrigeration installations had an “extremely limited impact” on 15 of more than 700 stores. [S4] Colruyt Group said about five Spar stores run by independent operators were affected. [S2] In Sweden, a store in Sjöbo said its fridges and freezers had been set to 50°C. [S4] Coop reported 7 of its 800 stores. [S1] In Ireland, SuperValu’s parent said 13 of 223 stores were affected, limited to one model of refrigeration system. [S3] Estonia’s Kitman Coldtech said one client was hit after attackers accessed a computer controlling refrigeration. [S3, S4] 

In the Netherlands, Danfoss told broadcaster NOS that at least 17 businesses were hit, mostly butchers and neighborhood shops, plus one frozen-food storage site whose setpoint had moved from −20°C to −10°C. No large Dutch supermarket was affected. [S12, S13] 

Confirmed, reported, and unknown at a glance 

Understanding supermarket refrigeration infrastructure 

A supermarket refrigeration plant is a distributed control system, even if nobody calls it one. 

The thermodynamic side. Compressors, usually grouped into a rack or “pack” on a shared suction header, pull refrigerant from the cases and compress it. A condenser, typically on the roof, rejects the heat. Refrigerant then flows to evaporators in display cases and walk-in rooms through expansion valves, which meter the flow. Fans move air across the evaporators. Temperature and pressure sensors report conditions back to controllers. 

Defrost. Evaporator coils collect frost and must be cleared periodically. Depending on the design, that uses electric heaters, hot refrigerant gas or simply stopping refrigerant flow. Defrost is a normal, scheduled function. That is exactly why it is useful to an attacker: a controller told to defrost continuously is doing something it was designed to do. 

The control side. The layers, from the field up: 

1. Field devices: sensors, valves, fans, heaters. 

2. Case and pack controllers: dedicated refrigeration controllers that regulate individual cases and compressor packs. Some sites use PLCs for the plant. 

3. System managers or supervisors: devices such as the Danfoss AK-SM and AK-SC series and the Copeland/Dixell XWEB family. They aggregate dozens of controllers over vendor field buses, store setpoints and defrost schedules, raise alarms and provide a web interface for operators. [S8, S10] 

4. Store and building networks: the supervisor connects to the store LAN, often alongside a building management system (BMS) that handles HVAC and lighting through protocols such as BACnet. 

5. Remote monitoring and maintenance: contractors, equipment makers or headquarters teams reach the supervisor remotely to monitor temperatures, receive alarms and adjust settings. Claroty notes this convenience cuts the cost of maintenance visits. [S10] 

Why this matters for security. The supervisor is the concentration point. It holds the authority to change parameters across everything beneath it, and it is the layer with a web interface and a network address. Compromise one supervisor and you can reach every case in the store. 

Architectures differ. Some retailers run their own refrigeration. Many outsource it. Leclerc described an equipment supplier as the affected party, and reporting on Intermarché describes an external provider managing its refrigeration. [S6, S25] The exact architecture in the stores that were hit has not been published, and it likely varies by chain, contractor and store age. 

Why refrigeration belongs in the OT attack surface 

Refrigeration controllers meet every definition of operational technology. They sense and actuate a physical process, they run embedded firmware with long lifecycles, and they cannot simply be rebooted while food depends on them. 

They also have several traits that make them attractive: 

• Direct physical effect. A setting change translates into heat within minutes. 

• Internet reachability. Claroty counted 2,765 AK-SM 800A interfaces visible to a public internet scan during its August research. [S9] That count covers one model, and it measures reachability, not vulnerability. 

• Long lifecycles. The AK-SM 800 reached end of life in May 2021, and the AK-SC 355 was phased out in 2016. Neither receives security fixes. [S20, S21] 

• Ambiguous ownership. Facilities buys the equipment, a contractor runs the remote access, and IT never sees it on an inventory. That pattern, described by hard2bit, is an assessment from one consultancy rather than a finding by investigators, but it matches how the incident has been described by retailers. [S21] 

• Low suspicion. A temperature rise looks like equipment failure, which delays detection. Reports indicate some stores noticed hours after the change. [S1] 

How attackers could manipulate refrigeration controllers 

The table lists actions that unauthorized access to a supervisor could enable, with the consequence of each. Only the first two are reported in this incident. The rest are analytical possibilities, included so defenders know what to monitor. This is not an attack guide. 

A note on the last row. According to secondary reporting on the CERT-FR alert, resetting an exposed, unsupported unit to factory state is not enough, because the same exposure remains. The principle is sound regardless of the exact wording: restoring a device without removing its exposure restores the vulnerability. 

Investigating the attack chain 

What the evidence supports 

Only some stages can be documented. 

1. Target discovery. Method not disclosed. Internet scanners such as Censys and Shodan make exposed devices easy to enumerate, as Claroty notes. [S9] That shows feasibility, not what the attackers did. 

2. Access. Method not disclosed. For one subset (Dutch systems in wave 2), Danfoss says a default password and an insecure network were in play. [S12, S13] 

3. Configuration change. Reported: forced defrost and raised setpoints. [S2, S6, S8] 

4. Impact. Confirmed: temperature rise, spoiled food, store disruption. [S1, S6] 

5. Detection and response. Delhaize says it disconnected its refrigeration systems from the internet immediately. Sabcobel technicians worked overnight to disconnect affected installations. [S12, S18] 

No source we reviewed reports malware on the controllers. A former ANSSI official told CNN the perpetrators did not appear to have used malicious code. [S16] No source reports lateral movement into store IT or data theft. Absence of reporting is not proof of absence. 

Illustrative attack paths (hypothetical, for defensive planning) 

Because the real vector is unknown, here are three plausible paths. None is confirmed. They show defenders where to look. 

The fact that three Danfoss AK-SM 800A flaws were patched in 2025 (CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452) is useful context, but it is not a finding. Claroty published research on them in August 2026, and no official source has said they were used. [S10, S27, S28] Treat any article that states otherwise as unsupported. 

MITRE ATT&CK for ICS mapping 

The mapping below is deliberately conservative. Technique names and IDs were cross-checked against MITRE ATT&CK for ICS pages and MITRE-based references. MITRE has been restructuring parts of the ICS matrix, so confirm IDs against the current release before publication. 

We have not mapped Unauthorized Command Message (T0855). It describes commands sent to a control system, and the available reporting does not show whether changes were made through a web interface or a field protocol. 

Possible initial access vectors, ranked by evidence 

1. Direct internet exposure with weak credentials. Most strongly supported for part of wave 2. [S12, S13] 

2. Direct internet exposure with unpatched or unsupported firmware. Supported by Danfoss’s end-of-life and outdated-firmware statements, but not tied to a flaw. [S15, S20] 

3. Third-party remote access or provider compromise. Possible, not demonstrated. 

4. IT-network pivot into store OT. No reporting supports it. 

This ranking will change as investigators publish. Sabcobel’s CEO told Belga that roughly 10% of its installations remained unsecured after the French attack, and that some of those were in stores hit on November 2. [S2, S19] If accurate, that suggests wave 2 largely exploited the gap between warning and remediation rather than a new technique. That reading is our assessment, not an established fact. 

IT/OT convergence and remote access exposure 

The textbook IT/OT story starts with a phishing email, moves through the corporate network and ends at a plant-floor controller. This incident does not appear to follow that script. 

The pathway reported here is shorter. The internet reaches the OT supervisor directly. There is no evidence that attackers needed to cross a corporate network first. Convergence in this case means convenience-driven exposure: operators and contractors wanted to reach controllers remotely, so the controllers were made reachable. 

That still creates IT/OT risk in both directions: 

• Store networks: the supervisor typically sits on the same LAN as the BMS and sometimes point-of-sale or office systems. A compromised, exposed controller can become a foothold. Claroty warns that exposed assets can offer a path deeper into operational and enterprise networks. [S9] No such movement has been reported. 

• Centralized monitoring: one portal or credential set covering hundreds of sites turns a single compromise into a fleet event. 

• Contractor connectivity: outsourcing refrigeration moves a critical OT trust relationship outside the retailer’s visibility and control. 

• Shared identity: reused or shared administrator credentials across stores multiply the impact of one leak. 

• Cloud connectivity: cloud-based monitoring adds another authenticated path to the same controller. 

The defensive point: do not assume your IT security program covers a device that IT does not know exists. 

Operational and financial consequences 

Operational impact 

The visible effect was empty refrigerated cases. Photos from a Delhaize Shop & Go in Linkebeek show notices that fridges were out of service. [S1] Stores discarded chilled and frozen stock, and some used refrigerated trucks to hold what they could save. [S2] Technicians disconnected affected installations overnight in Belgium. [S18] Delhaize says it disconnected its refrigeration systems from the internet immediately. [S12] 

The harder work comes afterward. Teams must confirm that every controller is under legitimate control, restore parameters (defrost ranges and setpoints in particular), inspect equipment that ran far outside normal conditions, and decide whether to reconnect remotely at all. Danfoss and the Dutch NCSC both advise reconnecting only through a secure network or protected channel. [S12, S14] 

Financial impact 

No credible consolidated figure exists. Reports on the French wave cite losses of hundreds of thousands of euros. [S9] Individual stores reported disposing of several tons of product. We have not seen verified totals for either wave, and we will not estimate them. The cost categories are clear, though: 

• Spoiled inventory and disposal. 

• Inspection, repair or replacement of equipment, including end-of-life controllers that can no longer be secured. 

• Lost sales while cases are empty. 

• Incident response, forensics and contractor call-outs. 

• Insurance claims, and in some cases dispute over whether a cyber policy or a property policy responds. 

Food safety and cold-chain implications 

Temperature control is a legal and practical foundation of food safety. EU food hygiene rules, including Regulation (EC) No 852/2004, require food businesses to maintain cold-chain conditions and operate procedures based on HACCP principles. Specific limits depend on the product and the member state. As a general reference, frozen food is typically held at −18°C or colder and chilled food at roughly 5°C or below, but operators should confirm requirements with their national authority. 

When controllers are driven to 50°C, the operator’s decision is not whether product quality dropped. It is whether the product can be sold safely at all. Several retailers withdrew chilled and frozen goods as a precaution. [S25] That is a defensible response, and it is why recovery plans need food safety staff in the room. 

We found no reports of contaminated food reaching consumers or of related illness, and this article makes no such claim. 

Supply chain impact 

The reported damage sits mostly at retail level. Still, the exposure pattern matters upstream and downstream: 

• Distribution centers and cold stores use similar supervisors. Claroty notes that AK-SM controllers manage refrigeration in supermarkets, warehouses and cold-storage facilities. [S10] A frozen-food storage site in the Netherlands was among the wave 2 victims. [S13] 

• Suppliers bear the cost of rejected or spoiled deliveries if stock arrived during an incident. 

• Multi-site operators face simultaneous failures that overwhelm contractor call-out capacity, which is why Sabcobel’s overnight response mattered. [S18] 

• Unconfirmed reports mention a Danish food producer among the targets. We could not corroborate this. [S25] 

Was this OT sabotage? 

The effects fit the common meaning of OT sabotage: deliberate manipulation of a control system to damage or disrupt a physical process. Someone changed settings that caused destruction. Nothing in the public record suggests an accident. 

Intent is another matter. No ransom was demanded, no data theft was reported and nobody has claimed credit. [S15] A former ANSSI official told CNN that a lone hacker or a hacktivist group cannot be ruled out, and a UK-based analyst suggested the aim may have been to unsettle the public rather than to profit. [S16] Reuters reported that the lack of a claim or ransom has puzzled investigators. [S15] Whether this is sabotage with a strategic goal, vandalism or opportunism is not established. 

Threat actor attribution and motivation 

There is no attribution. No ransomware group, hacktivist collective or state-linked actor has claimed or been credibly linked to either wave. Prosecutors in France had not named suspects as of late October, and Belgium’s federal prosecutor has opened a case. [S6, S22] A Belgian Centre for Cybersecurity official reportedly said the perpetrators may never be identified. [S22] 

One security vendor noted that pro-Russian hacktivist activity against French targets was ongoing that same week, while stating that nothing connects it to the refrigeration attacks. [S17] We mention it only to caution readers: proximity in time is not evidence. 

Treat attribution claims from social media or vendor marketing with caution until prosecutors or national agencies publish findings. 

Root cause and contributing security weaknesses 

No investigation has published a root cause. The table separates what the public evidence supports from what remains general industry risk. 

What we can and cannot say. The evidence supports exposure and, for some systems, default credentials and unsupported firmware as contributing factors. It does not support a single root cause for either wave. 

What supermarket operators should do immediately 

These steps follow guidance from CERT-FR, Danfoss, the Dutch NCSC and Claroty. [S8, S9, S12, S14] Coordinate every change with your refrigeration contractor so you do not interrupt cooling. 

1. Find every supervisor and remote controller. List all Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb units, with model and firmware version, in every store and cold store. Include units a contractor installed. 

2. Test from outside. Check whether each management interface answers from the public internet. Do this from an external vantage point, not from the store LAN. 

3. Remove direct internet exposure. CERT-FR advises this for compromised units and for any unit on a public IP address. Reconnect only via VPN or another protected network. [S8] 

4. Change default and shared passwords. Danfoss specifically points to default passwords in wave 2. Set the vendor’s strict security mode where available. [S8, S12] 

5. Verify configuration. Review setpoints, defrost schedules and alarm limits against a known-good baseline. CERT-FR advises checking configuration, including defrost ranges. [S8] 

6. Update supported firmware after testing, and schedule replacement for end-of-life units. Note that some AK-SM 800A upgrade paths are staged, so follow the vendor’s sequence. [S21] 

7. Review remote access records. Identify who has reached these devices, from where and when. Revoke accounts that are unused or unattributed. 

8. Add independent temperature logging in critical cabinets and cold rooms so you have readings that do not depend on the controller. 

9. Ask your contractor, in writing, how they connect, who holds credentials and whether your estate was in the exposed population. 

Long-term OT cybersecurity recommendations 

Asset discovery 

Maintain a continuously updated inventory of refrigeration controllers, PLCs, gateways, BMS components, switches, remote-access devices and engineering workstations. Passive OT network monitoring can build this inventory from traffic without sending probes to fragile devices. Pair it with periodic external attack-surface scans so you see what the internet sees. 

Network segmentation 

Separate corporate IT, store operations, BMS, refrigeration control and vendor access into distinct zones, with controlled conduits between them. Use industrial DMZs, firewalls and explicit allow-lists for the few flows that are required. The Purdue Model is a helpful reference for layering, but it does not secure anything by itself. Segmentation only works when rules are enforced, reviewed and tested. 

Secure vendor remote access 

Use individual named accounts, MFA, approval-based and time-limited sessions, a jump host or privileged access management platform, and session recording. Review access regularly and revoke accounts immediately when a contract or technician changes. Avoid shared credentials and standing, always-on tunnels. 

OT threat detection and response 

Monitor for parameter changes, new or unexpected remote sessions, communications from unfamiliar addresses, and changes in defrost behavior. Protocol-aware monitoring can flag commands and configuration writes that generic IT tools miss. For multi-site estates, route alerts to a security operations capability that understands operational context, and define who can authorize isolation. 

Vulnerability management 

Prioritize by exposure and consequence, not only by CVSS score. An internet-exposed supervisor with a modest score can matter more than an internal device with a high one. Where patching is slow or impossible, apply compensating controls: remove exposure, restrict source addresses, enforce strong credentials and monitor closely. Maintain secure configuration baselines and test updates in a maintenance window. 

Incident response for refrigeration events 

1. Detect and triage: temperature alarms, unexpected defrost, or alerts from remote access monitoring. 

2. Isolate affected systems only where it is operationally safe. Cutting a controller off may leave it in a bad state. 

3. Bring IT, OT, facilities, refrigeration contractors and food safety teams together immediately. 

4. Verify the integrity of each controller’s configuration, not just its temperature display. 

5. Activate manual fallbacks: local control, manual monitoring, temporary refrigeration. 

6. Decide product disposition with food safety staff and, where required, authorities. 

7. Restore from known-good configurations and re-validate. 

8. Preserve logs and device state for forensics before wiping anything. 

9. Rotate credentials and review all remote access. 

10. Feed lessons into asset inventory, segmentation and monitoring. 

Isolation and recovery decisions must involve qualified refrigeration personnel. A well-meant disconnect or reset can create additional product loss or equipment damage. 

Relevant frameworks and standards 

The frameworks below are most useful when applied to specific decisions rather than cited as lists. Confirm current editions before relying on them. 

NIS2 in context. The NIS2 Directive (EU) 2022/2555 covers “production, processing and distribution of food” among its other critical sectors, but its wording concentrates on food businesses engaged in wholesale distribution and industrial production and processing. Retail on its own is not named. Whether a given supermarket group is in scope depends on its activities, size and national transposition, and many small independents will not be. Operators should check with their national authority rather than assume coverage. GDPR is not implicated on current evidence, since no personal-data compromise has been reported. Equipment makers may also face obligations under the EU Cyber Resilience Act as its reporting duties phase in; confirm dates and scope with counsel. 

Seven insights from the Shieldworkz analysis 

The points below are our own technical reasoning, built on the verified facts above. They are not findings from the investigation. 

1. Forced defrost needs no malware, so malware defenses will not see it. Reports indicate attackers changed legitimate settings rather than deploying malicious code. [S16] A defrost command is a normal function. Endpoint protection has nothing to flag. Detection has to rest on behavior: who changed which parameter, from where, and whether it matches a maintenance window. 

2. Temperature monitoring is not control-system integrity. If the controller that sets the temperature also reports it, a compromised controller can no longer vouch for itself. Independent, battery-backed loggers in critical cabinets give operators readings that do not depend on the device under attack. This is a cheap control with an outsized payoff. 

3. Three parties own the risk and none of them owns the asset. Facilities buys the equipment, a contractor operates remote access, and IT does not inventory it. Each can reasonably assume another is handling security. Security governance for refrigeration OT needs a named, accountable owner and contract language that says who patches, who monitors and who can change access. 

4. Advisories do not remediate; inventories do. CERT-FR published its alert on October 12, and Danfoss told Dutch customers on October 13 to disconnect. [S8, S12] Twenty days later, at least 17 Dutch businesses still ran default passwords on unsecured networks, and a Belgian contractor said about 10% of its installations were still not fixed. [S2, S13] Distributed estates have a long tail of unpatched sites. The measurable risk is the time between a warning and the last remediated device. 

5. Small operators and franchise structures widen the gap. The Dutch victims were butchers and neighborhood shops. [S12, S13] Colruyt said the affected Spar stores are run by independent entrepreneurs with their own refrigeration systems. [S2] A group-level security program does not reach equipment it does not own. Retail groups should extend minimum OT security standards to franchisees and affiliates, and manufacturers should ship products with unique credentials and no default exposure. 

6. The barrier to entry appears low, and that changes the threat model. Three experts told Reuters the French attack appeared easy to pull off. [S15] Low-complexity attacks against exposed OT, like the water-utility incidents Claroty cites, rely on exposure rather than sophistication. [S9] Defenders should assume that any internet-reachable controller will be found. 

7. OT incident response for retail is a food-safety exercise as much as a cyber exercise. Decisions such as whether to isolate a controller, run trucks as temporary storage or discard stock mix technical, operational and regulatory judgment. Playbooks that omit refrigeration engineers and food-safety staff will fail when they are needed. 

Lessons for CISOs and OT security leaders 

• Widen the definition of critical OT. Controllers that set food-safety conditions belong in the same inventory and risk register as plant-floor systems. 

• Ask the board-level question. Can we list every device in our stores that can be reached from outside our network, and who is accountable for each? 

• Treat end-of-life as a risk with a date. Units that no longer receive fixes need an isolation plan now and a replacement budget in the next cycle. 

• Hold third parties to measurable standards. Require evidence of MFA, named accounts, access logging and credential rotation from refrigeration contractors. 

• Rehearse the scenario. Run a tabletop that starts with temperature alarms in 200 stores at 3 a.m. and includes the contractor, facilities and food safety. 

• Measure time-to-remediate. Track the interval from advisory to confirmed fix across every site, not just the first ones patched. 

Shieldworkz perspective 

Shieldworkz is an industrial OT cybersecurity company that works from assessment to security operations. We were not involved in investigating or responding to these attacks, and everything above is drawn from public sources and our own technical analysis. 

From an OT security standpoint, this incident shows how a small set of ordinary weaknesses combine into a physical outcome: an exposed management interface, weak or default credentials, equipment past end of life, and no clear owner. None of those requires advanced tradecraft to exploit or advanced technology to fix. 

The controls that address them map to a familiar sequence: 

• OT asset discovery and network visibility to find supervisors and controllers, including the ones nobody remembers installing. 

• OT risk assessments and vulnerability assessments to rank exposure by consequence rather than by score alone. 

• Segmentation and security architecture reviews to separate refrigeration control, store networks, building systems and vendor access. 

• OT penetration testing to confirm that a device is unreachable from the internet, not merely believed to be. 

• Secure file transfer and inspection for firmware and configuration files moving into store environments. 

• Industrial threat detection and OT SOC services that watch for parameter changes and unusual remote sessions in operational context. 

• Incident response readiness that brings refrigeration and food-safety teams into the plan before the night it is needed. 

No single product closes this gap. Visibility, access control, monitoring and response work together. 

Conclusion 

The European supermarket refrigeration attacks show how a cyber incident becomes an operations incident. A few changes to controller settings turned storage units into heaters and forced thousands of shoppers to find empty cases. Much remains unknown, including how attackers gained access, whether one actor was behind both waves, and what the investigation will show. What is already clear is that exposed controllers, default credentials and unsupported hardware gave attackers room to work, and that fixes were available weeks before the second wave. 

Connected refrigeration systems, building automation platforms and remote maintenance infrastructure are expanding the industrial attack surface. Organizations need visibility into their OT assets, tighter control over remote access, and security monitoring designed for operational environments. 

Shieldworkz helps organizations assess, monitor and strengthen their industrial OT cybersecurity posture through end-to-end products, services and solutions.

Additional resources  

A downloadable report on the Stryker cyber incident here  
Removable media scan solution vendor evaluation and selection checklist here  
IEC 62443-based OT/ICS risk assessment checklist for the food and beverage manufacturing sector here 
IEC 62443-based remediation guides here