Hackers Heated Supermarket Freezers Across Europe. What Happens When They Target Your Connected Infrastructure?

Nobody stole a customer record. Nobody locked a screen. The attackers simply made the cold go away.

Overnight on October 11 and 12, someone reached into the refrigeration systems of hundreds of French supermarkets and warmed them up. Three weeks later, on November 2, it happened again, this time across Belgium, Ireland, the Netherlands, and beyond. Stores threw away spoiled food, brought in refrigerated trucks, and in some cases closed their doors for the morning.

The headline is about freezers, but the lesson is wider: the machines that sit quietly on a network, run by a contractor, and never appear on anyone's security dashboard.

What Happened, and What Is Still Unproven

In France, attackers took remote control of the Danfoss controllers that run store refrigeration, which maintenance firms manage remotely. Les Mousquetaires, the group behind Intermarché and Netto, said some units were heated to as much as 50°C. Store counts vary by source: Carrefour reported 80 stores, Coopérative U reported 80 of 2,000, and Intermarché and Netto counts ranged from about 150 to at least 300. The Paris prosecutor opened an inquiry, and Les Mousquetaires' CEO estimated that losses would reach tens of millions of euros. That is an estimate, not a confirmed total.

On November 2, a second wave appeared overnight. Reported cases included Delhaize, Carrefour, Intermarché, Spar, and IKEA in Belgium, ICA and Coop in Sweden, 13 SuperValu stores in Ireland, a Selver store in Estonia, Kesko in Finland, stores in Portugal and Italy, and at least 17 small businesses in the Netherlands. Belgium's federal prosecutor opened a criminal investigation, and a Belgian media tally counted at least 76 outlets with refrigeration problems.

Now the careful part, because the facts are uneven. Danfoss said its products were involved in the Dutch and Swedish cases, and that the Dutch attacks used the same method as the French ones. But the Swedish picture is murkier. The "hacked and set to 50°C" claim came from one ICA store's Facebook post, and Coop said it had no information pointing to a cyberattack. No group has claimed responsibility, and Belgium's Centre for Cybersecurity said the perpetrators may never be identified. Shared methods do not prove shared attackers. Reports of equipment catching fire in France remain unconfirmed.

The tactic is not new. Danfoss's own October 2025 newsletter records 2022 attacks on AK-SM 800 systems at 16 supermarkets in Russia and 40 in Israel, and says the Israeli stores lacked proper firewall or VPN protection. The Pentagon is also investigating freezer failures at stores on US military bases from August, though reporting says there is no evidence linking them to the European incidents.

How a Thermostat Becomes a Weapon

To see why this works, picture what a refrigeration controller does. It is a small computer that decides when cooling units run and when they defrost. Defrosting is normal: the unit warms briefly to melt ice off the coils. In Belgium, according to refrigeration contractor Sabcobel, attackers switched cooling units into defrost mode, so the machines kept heating instead of cooling. In other cases, reports describe temperature setpoints being raised instead. The two methods are not the same, and the sources do not say which applied at every site.

The attackers did not need to break the freezer. They only needed to give it the wrong instructions.

How did they reach the controllers? Nobody knows yet. Neither French authorities nor Danfoss has said how the initial access happened, and no official source has tied the attacks to a specific vulnerability. What is documented is that the door was not hard to find. In 2025, researchers at Claroty's Team82 reported three flaws in Danfoss AK-SM 800A controllers. One, CVE-2025-41450, is an authentication bypass built around a hidden "code of the day" that is derived from the device's current date, so anyone who knows the pattern can generate a valid login. A second allows command execution once logged in. Claroty's scan counted 2,765 management interfaces reachable from the internet, and a researcher counted 2,752 Danfoss systems exposed online after the French attack, 1,590 of them in France. Exposure counts measure reachable interfaces, not confirmed compromises. A fix, firmware R4.3.1, was released in 2025, and CISA noted at the time that it had no reports of public exploitation of the bypass.

Danfoss has said that most units hit in France were older models it no longer supports, the AK-SM 800 and the AK-SC 355, and that some current AK-SM 800A units were running outdated firmware. For the Dutch cases, it told NOS the systems were not on a secure network and still used default passwords. The pattern points to old software, exposed interfaces, and weak access controls, though investigators have not published a confirmed attack path.

The timing makes this harder to shrug off. Danfoss advised Dutch customers on October 13, two days after the French attack, to disconnect their systems from the internet, and told NOS that the shops hit were the ones that had not taken measures afterward. The warning existed. It simply did not reach, or was not acted on by, every site that needed it.

The Damage Was Physical, and the Bill Is Real

A ransomware attack asks, "Will you pay to get your data back?" This attack asked a more immediate question: what happens to a store when its cold chain breaks overnight?

The costs are concrete, though reported as estimates. A butcher in Hove, Belgium, reported fridges pushed to 18°C and about €15,000 in ruined meat. Sabcobel's CEO said losses could reach tens of thousands of euros per store if the cold chain stays disrupted too long, and that some systems need hardware changes, since a software update alone is not enough. That detail matters for planning: a fix that requires replacing equipment takes budget and lead time, not a quiet maintenance window.

The incidents also varied in severity. At the Selver store in Estonia, a freezer was set to 50°C but rose only about 2 to 3 degrees and was fixed in roughly ten minutes. A setpoint is an instruction, not a measurement, and quick detection separated a nuisance from a write-off.

Sabcobel also said the attackers entered individual supermarkets' systems, not the contractors' own. The exposure sat at the store level, a controller at each site, which is harder to see from headquarters because every location may be set up slightly differently.

Why This Is Not Only a Supermarket Problem

Read the story as a retailer and it sounds distant. Read it as an operator of any connected equipment and it becomes familiar. Claroty warned that compromising this kind of management interface could have serious operational consequences in supermarkets, cold storage, and warehouses alike. The same shape appears wherever a device with a web login is connected for convenience: building climate systems, access controls, cameras, and the management pages of appliances.

Three features made these systems attractive. They were managed by third parties, so the retailer may not have known what was reachable. They were out of sight, so nobody was watching their logs. And some were end-of-life, so no patch was coming. CERT-FR says end-of-life devices left online are very likely to be compromised, and that a factory reset alone leaves them vulnerable.

What to Do Now

The guidance from CERT-FR, Danfoss, and Sweden's National Cybersecurity Centre converges on a handful of steps, and they apply well beyond refrigeration.

• Know what is connected. Sweden's cybersecurity centre advises listing every internet-connected device and deciding whether each one truly needs that connection. Include equipment run by contractors and landlords.
• Remove direct internet exposure. CERT-FR and Claroty both say management interfaces should not face the internet. Where remote access is needed, place it behind a VPN or a protected network, keep that VPN updated, and use filtering as an emergency measure only.
• Update, and change the credentials. Apply current firmware, switch to the strictest security setting the product offers, and replace default passwords. Check configuration for tampering, such as unexpected defrost schedules.
• Prepare for the case where a device is already compromised. CERT-FR's steps for a suspect controller are to restrict access to service providers only, restart or factory reset it, apply all available fixes, change every secret, check the accounts on the device, and reconfigure it fully before returning it to service. Rehearse it on paper before you need it.
• Replace what cannot be updated. Older models receive no new fixes, and Danfoss urges replacement.
• Ask your vendors direct questions. Which of our devices can you reach remotely, how, and with what credentials? Vague answers are the finding.

For business leaders, three more questions are worth raising this week. Who owns each connected device, so that a patch has a name attached? Is there a written plan for when cooling, heating, or any physical system is manipulated for a night? And do vendor contracts require proof of current firmware and secure remote access? Test the plan like a fire drill, with the people who would actually be on shift.

See What an Outsider Can Reach

Organizations may know what equipment they own, but not necessarily what an attacker can reach from the internet. Legacy devices, forgotten interfaces, and remote connections opened for convenience can create exposure that purchase records and traditional asset inventories miss.

Secuna Pentest helps organizations identify and validate security weaknesses across their networks, web applications, APIs, cloud infrastructure, and mobile applications through manual, scoped penetration testing. Secuna is a DICT-recognized VAPT provider under the D-TAP program.

Penetration testing does not replace firmware updates, equipment replacement, or network segmentation, and it does not guarantee that every connected device is found. Coverage depends on the scope agreed with the client, so a standard engagement should not be assumed to include every refrigeration controller or operational technology device. What testing can do is help an organization understand its exposure and prioritize remediation.

The freezers failed because someone could reach them, not because someone broke them. The organizations that stay ahead will be the ones that know which of their machines face the internet, and who decided that they should.

To learn more, reach out to our team at sales@secuna.io or explore our services at secuna.io.

Sources: Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers, The Hacker News · New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food, The Hacker News · Cyberattack Shuts Down Refrigerators at French Supermarkets, BleepingComputer · Belgian Prosecutors Probe Cyberattack on Supermarket Fridges, The Star · Hacker Attack Fears After Swedish Supermarkets See Fridges Heat Up to 50C, The Local Sweden · Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers, Claroty Team82 · Danfoss AK-SM 8xxA Series (ICSA-25-140-03), CISA · Supermarket Freezers in Sweden, Belgium, and Ireland Hit by Suspected Hack, The Next Web