Skip to content
All posts

· by NetProtector Security Team

Hacked Refrigeration Systems: When Supermarket Freezers Turn into Heaters

Illustration: snowflake, shopping cart and rising thermometer, next to a remotely accessible refrigeration controller showing +7 °C

During the night of 12 October 2026, refrigerated cabinets in hundreds of French supermarkets heated up – to as much as 50 °C, and in one store in Normandy even to 80 °C. Attackers had switched the refrigeration controllers into defrost mode over the internet. On 2 November, a second wave followed in several European countries. The incident shows how vulnerable operational technology is – technology that rarely anyone thinks about.

What happened

France, 11/12 October: According to media reports, up to 700 stores were affected, including more than 300 Intermarché and Netto branches, around 80 stores each from Coopérative U and Carrefour, as well as Monoprix and E.Leclerc. Overnight, the attackers activated the defrost cycle of the refrigeration controllers: the heating elements on the evaporators ran continuously and temperatures rose. No alarms were triggered, and many stores were unstaffed. Tonnes of goods had to be disposed of, equipment melted, and sprinklers caused water damage. The damage is estimated at a minimum of ten million euros, with some reports citing several tens of millions. The French government tasked the cybersecurity agency ANSSI with the matter, and CERT-FR issued a warning.

Europe, 2 November: A similar wave hit more than 115 stores in Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia – including branches of Ahold Delhaize, Carrefour, Intermarché, ICA, Coop and SuperValu. Three blood banks of the French blood service EFS were also targeted; there, staff intervened in time after alarms went off.

Who is behind the attacks remains unclear. No one has claimed responsibility.

How the attackers got in

According to current findings, the attacks in France focused on Danfoss refrigeration controllers (AK-SM800, AK-SC355) and Copeland/Dixell XWEB controllers. Their web interfaces were directly accessible from the internet. On the affected Danfoss devices, the password for the administrator account consisted of a “daily code” derived from the current date. The vulnerabilities had been publicly known since March 2025 (Danfoss advisory DSA-2025-03-01); some of the models have been discontinued for years, and Danfoss recommended replacing them. Security researchers found several thousand such devices exposed online.

In other words, the attack required no special skills. The barrier was low – and that is precisely what makes the situation so serious.

What operators should do now

This applies not only to food retail but to anyone operating refrigeration, HVAC, building or production technology with remote access – from pharmacies to data centres:

  1. Inventory: Which controllers are connected to the network – and who manages them? Refrigeration technology is often installed and maintained by service providers without IT being aware of it.
  2. No controller directly on the internet. Remote maintenance belongs behind a VPN or a secured remote access solution with its own authentication and MFA.
  3. Separate networks. Place operational technology in a dedicated segment, with firewall rules that allow only the necessary connections.
  4. Replace or isolate outdated devices. Discontinued controllers no longer receive security updates.
  5. Monitor independently. A separate temperature sensor with its own alerting reports when the controller fails – or has been manipulated.
  6. Agree on security requirements with service providers – for example regarding updates, credentials and remote access.

Our assessment

The attacks on refrigeration systems are a wake-up call: devices that “only” regulate temperatures can cause damage running into the millions and disrupt the food supply. Richard Horne, head of the UK's NCSC, spoke of “the beginning” – because AI makes finding and exploiting legacy technology even easier. Those who segment their operational technology and monitor the network traffic to it will spot unusual access before the freezers warm up.

Sources