Supermarket refrigeration hack: a wake-up call for OT security

Supermarket refrigeration hack: how an APT-grade hacker sees your fridges and building systems, and what CEOs and CISOs should do this week.

Somewhere in the night between Sunday 1 and Monday 2 November, the thermometers in European supermarkets started to climb. Not by a degree or two. According to press reports, some fridges and freezers reached as high as 50 °C. The morning shift didn't find a broken compressor. They found shelves of fresh and frozen food that had to go straight into the bin. Attackers had remotely changed the settings on the refrigeration controllers. And anyone paying attention knew it was coming: three weeks earlier, exactly the same thing had happened in France.

A cyberattack on supermarkets that ends in melted ice cream sounds almost funny. It isn't. It is a textbook example of what goes wrong when operational technology (OT) is treated as something that just hums away in the plant room.

Two waves, one pattern

The first wave hit France overnight from 11 to 12 October. At around 700 supermarkets, including Intermarché, Carrefour, Coopérative U and Monoprix, refrigeration systems were switched into defrost mode. On 12 October, the French CERT-FR published alert CERTFR-2026-ALE-012, reporting "numerous compromises" (translated from French) of remote management controllers for refrigeration systems: the Danfoss AK-SM and AK-SC series, and the XWEB supervisors from Copeland and Dixell. CERT-FR explicitly warned that the campaigns were "probably still ongoing" (translated from French). In hindsight, that wasn't cautious phrasing. It was a forecast.

In mid-October, the Centre for Cybersecurity Belgium (CCB) issued advice that really should go without saying: don't connect refrigeration systems directly to the internet, and install the available updates. According to the CCB, the targeted management interfaces were most likely reachable from the public internet, "which goes against security best practices" (translated from Dutch). The most painful detail? For the affected Danfoss systems, patches for the exploited vulnerabilities had been available for a year and a half. Germany's BSI issued similar advice.

The second wave struck on 2 November, this time across much of Europe. SecurityWeek counted more than a hundred affected stores, from major chains to the local butcher, in countries including Belgium, Luxembourg, the Netherlands, Sweden, Estonia and Ireland. Problems were also reported in Finland, Italy and Portugal. Belgium appears to have been hit hardest. Delhaize described an IT incident affecting a few dozen stores, Carrefour counted 15 affected locations out of more than 700, Colruyt Group reported five Spar franchise stores, and an IKEA store in Mons was hit as well. According to press reports, the attackers again put refrigeration units into defrost mode, so they warmed up instead of cooling down. The Belgian Federal Prosecutor's Office has opened an investigation. Nobody knows yet who is behind it, and no group has claimed responsibility.

Danfoss confirmed that its products were involved. According to the company, most of them were older products it no longer updates. Remember that sentence, because it is the heart of the story.

This is not a retail problem

You could file this under bad luck for the grocery sector. I wouldn't. What went wrong here is something we at XPOSE Security see almost every week in office buildings, hospitals and production sites: refrigeration, heating and ventilation (HVAC), building management and access control that sit online, run old software and are managed by an outside installer.

The business impact is immediate: binned stock, empty shelves, closed departments and reputational damage. European Commissioner for Agriculture Christophe Hansen called it "a deliberate attempt to disrupt our food supply chain". And under NIS2, boards must be able to show they manage these risks, including supplier risk. "Refrigeration belongs to facilities" is no longer an acceptable answer.

Through the attacker's eyes

To understand this incident, you have to think like the other side. What follows is not a reconstruction of this attack: who is behind it and exactly how they operated is not known. These are possible scenarios, based on how experienced, state-level attackers (APTs, advanced persistent threats) generally work. It's exactly how our offensive specialists at XPOSE think.

They aren't looking for you. They're looking for a type of device. An attacker doesn't start with your company, but with a brand and model. Public search engines that scan the entire internet list thousands of reachable management screens in minutes. You're not a target because you're interesting, but because you're on that list.

The real front door is often your installer. Why break into one store when the maintenance contractor gets you into hundreds of clients? One shared password for every site, a remote access tool that's always on, a technician whose laptop gets infected: that's gold. In the Portuguese incidents, reports already pointed to an external party managing the refrigeration. That doesn't prove how this attack worked, but it shows where a smart attacker looks first.

The fridge is a stepping stone. A controller like this is essentially a small computer. If it sits on the same network as your tills or office PCs, an attacker can hop from it into your IT environment. That connection often exists without anyone ever having deliberately built it.

A factory reset fixes nothing if the door stays open. CERT-FR and the CCB warn about this themselves. Think the scenario through: you reset the device, but the attacker still has your installer's account or a hidden way back in. A day later, they're back.

Timing is a weapon. Sunday night, when nobody is in the store and nobody notices until Monday morning. Maximum damage, minimum chance of intervention. Notably, both waves struck at night over a weekend.

Maybe it was a dress rehearsal. An APT likes to test what works and how fast victims respond. A loud attack can also be a distraction: while everyone stares at warm freezers, the real work happens elsewhere in the network. Again, a scenario, not a finding.

Data is loot too. Temperature logs and cold-chain data reveal delivery rhythms, opening hours and which stores are critical. For an attacker with bigger ambitions, that's reconnaissance material.

What to do this week

1. Ask your installer which accounts they still have on your controllers, since when, and who knows the password. Is it the same one they use for other clients? Then you have your answer.
2. Look yourself up the way an attacker would. Have someone check whether a management screen for your building or store is publicly findable. Take it offline and route access through a secure VPN. According to CERT-FR, IP filtering is at best an emergency measure. Check your contract and insurance terms first.
3. Test whether your OT network can actually reach your office network. Not on paper, in practice. The answer often surprises.
4. Update and harden. Install updates, change default passwords, enable the strictest mode (on Danfoss devices that's Strict) and check defrost schedules and temperature limits.
5. Replace what no longer gets updates. According to CERT-FR, such a device will "very likely" be compromised again (translated from French).
6. Make sure an alarm goes off on Sunday night. Alerts for abnormal temperatures or configuration changes, with someone who actually sees them. Add OT scenarios to your incident response plan.
7. Pin suppliers down in writing: how remote access works, who patches, and how fast incidents must be reported.

Final thoughts

The supermarket refrigeration hack isn't an exotic edge case. It's what happens when an interface left online or a forgotten installer account gets exploited at European scale. The question isn't whether your building systems are interesting, but whether someone has already found them.

XPOSE Security tests your environment the way these attackers would: from internet-wide reconnaissance to your suppliers' access to the jump from OT into IT. Better we find it than they do. Get in touch and let us put your OT and IoT security to the test, or strengthen your security posture structurally with our CISO as a Service.