Supermarket Freezer Cyberattacks Turned a Defrost Setting Into a Weapon in Seven Countries

The supermarket freezer cyberattacks that hit dozens of stores across seven European countries overnight into November 2, 2026 worked by switching refrigeration units into defrost mode, according to the contractor that runs the affected systems for Delhaize. Stores in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland threw away spoiled food, and one Delhaize branch in Hoeilaart, Belgium, put its loss of produce at €100,000.

The Supermarket Freezer Cyberattacks Used a Normal Maintenance Function

Sabcobel, the Belgian company that operates Delhaize’s refrigeration systems, said the units’ evaporators had been put into defrost mode, which made them warm up. Defrosting is a routine cycle that every commercial freezer runs to clear ice. Run on command and left running, it destroys stock. Some stores reported freezer temperatures reaching 50C, and an ICA branch in Sjöbo, Sweden, told customers on social media that its fridges had been set to 50 degrees overnight. Sabcobel’s chief executive, Stephan Moelans, told the Belga news agency that the company had spent the night disconnecting affected units from the network. The BBC reported that the method appears to match an attack in early October that hit hundreds of supermarkets in France.

Delhaize, Carrefour, Coop and SuperValu Stores All Reported Damage

The BBC counted around 40 affected Delhaize stores in Belgium and Luxembourg. Carrefour said 15 of its Belgian stores were hit and stayed open. A Colruyt Group spokesperson told Reuters that five franchised Spar shops had their fridge systems attacked, and Ikea said refrigeration at its store in Mons, Belgium, was affected. In Sweden, Coop said seven of its 800 stores were hit, and ICA said a small number of stores outside its central network were affected. Musgrave Group confirmed a cyber incident at 13 SuperValu stores in Ireland and said only a specific refrigerator model was involved. A Danfoss spokesperson told Dutch broadcaster NOS that cooling systems at no fewer than 17 Dutch businesses were attacked, mostly butchers and small neighbourhood shops. Kesko’s K-stores in Finland and a Selver supermarket in Estonia also reported problems.

The Weak Point Was Remote Access Run by Contractors

Supermarket refrigeration is usually monitored and adjusted remotely, so a technician can fix a fault without driving to the store. That convenience is the attack surface. Moelans said Sabcobel had been working since the French incident to protect customer fridges, and that the fix required physical changes to the units in addition to software updates. He said most of its customers had moved to managing their fridges over a secure connection after the French attack. The stores hit this time had not. Musgrave’s comment about one specific model and ICA’s comment about stores outside its central network point the same way: the damage landed where refrigeration equipment sat on a separate, contractor-managed path that the retailer’s own security team did not control.

Researchers Warned in August That These Controllers Were Reachable From the Internet

On August 9, 2026, Amir Zaltzman of Claroty’s Team82 published research on the Danfoss AK-SM 800A, a system manager that coordinates refrigeration controllers across a store. Team82 said it found thousands of the devices’ management interfaces exposed to the public internet. It described three flaws: a hidden “code of the day” mechanism that could bypass login (CVE-2025-41450), a command injection in the alarm email settings that allowed remote code execution after login (CVE-2025-41451), and a way to inject web server configuration that could knock the interface offline (CVE-2025-41452). The US National Vulnerability Database rates the code execution flaw 8.7 out of 10. Danfoss fixed the issues in firmware R4.3.1. TechCrunch’s Zack Whittaker reported that researchers tied the October attacks in France to Danfoss units that no longer received security updates. No investigator has publicly confirmed which product or which flaw was used in the November attacks, and no one has been named as responsible.

National Agencies Are Watching, and the US Is Checking Military Bases

Belgium’s and Sweden’s national cybersecurity agencies said they were monitoring the incident. The UK’s National Cyber Security Centre said it was working with international partners and had no reports of UK impact. In separate BBC reporting, researchers at UK Cyber Defence said they had found more than 800 refrigeration and building control interfaces linked to British retailers reachable over the public internet, which does not mean any of them can be hacked. The BBC also reported that US authorities are investigating refrigeration malfunctions at American military bases in August and working with French officials on whether those incidents are connected.

Why This Matters for Engineering Leadership

The freezers that failed this week belong to a category most engineering organizations never inventory: equipment owned by the business, installed by a vendor, and maintained over the internet by a contractor. Building management systems, badge readers, HVAC controllers, lab instruments and point-of-sale terminals all fit. Every one of them has a remote access path, and the person who signs off on it is often a facilities manager who has never met the security team. Tom Hegel of SentinelOne put the question plainly to the BBC: retailers need to know who owns the security of that equipment, beyond who repairs it. Start with an inventory of every device a third party can reach remotely, and put each one behind your own VPN or access broker with no web console open to the internet. Write firmware support dates into vendor contracts, so you know before an attacker does when a product stops getting patches. Treat dangerous maintenance commands, such as an indefinite defrost, as actions that need limits or a second confirmation, the same way you would treat a bulk delete in software. And put physical-world consequences in your incident plans. Sabcobel’s fix required hands on hardware in every store, and that work takes weeks, while the attack took one night.

FAQ