A Wake-Up Call for Retail OT: Hackers Weaponize Supermarket Cooling Systems Across Nine Countries
Tue, Nov 03 2026 /Mpelembe Media/ — In October and November 2026, a coordinated wave of cyber-physical attacks compromised commercial refrigeration systems across hundreds of supermarkets in France and at least eight other European countries, including Belgium, Sweden, Luxembourg, Ireland, the Netherlands, Estonia, and Finland. Threat actors remotely hijacked internet-exposed supervisory controllers—chiefly Danfoss AK-SM and AK-SC series, as well as Copeland and Dixell XWEB units—manipulating operational parameters to force evaporators into continuous manual defrost modes. Cabinet and freezer temperatures soared to between 50°C and 55°C (122°F–131°F) for hours overnight, spoiling thousands of metric tons of perishable inventory across major chains such as Intermarché, Carrefour, Delhaize, Coopérative U, Coop, and ICA. The sabotage caused tens of millions of euros in direct stock and business losses, triggered temporary store closures, and led to localized electrical fires from thermal runaway in compressor units.
Supermarket cooling infrastructure is connected to the internet to enable third-party maintenance contractors and technicians to remotely troubleshoot hardware, tune temperature setpoints, and log mandatory health-compliance records without incurring travel costs for manual on-site visits. However, these systems were routinely deployed directly on public IP addresses, unfiltered cellular links, or flat networks lacking firewall and VPN protections. Rather than deploying destructive malware binaries, attackers carried out a classic “living-off-the-land” exploit by authenticating to supervisory web interfaces—frequently leveraging date-based “code-of-the-day” authentication bypasses, command injection flaws, or legacy default credentials—and issuing normal administrative defrost commands. To evade detection, attackers suppressed local acoustic alarms and altered notification pathways, ensuring staff remained unaware of the warming until stores opened the following morning.
No group has claimed responsibility, and the absence of extortion notes or encryption payloads points toward deliberate industrial sabotage aimed at testing asymmetric capabilities and destabilizing critical food supply chains. The campaign exposed an acute operational technology (OT) security gap: thousands of vulnerable controllers had remained publicly accessible for years, many past vendor end-of-life, even as AI coding tools demonstrated that disclosed vulnerabilities could be weaponized into working exploit chains in under half an hour. In response, European agencies such as CERT-FR and ANSSI urged operators to physically decouple exposed controllers, mandate multi-factor VPN remote access, apply critical firmware patches, and install independent, out-of-band temperature sensors to meet emerging regulatory standards under the EU NIS2 Directive, Cyber Resilience Act, and Machinery Regulation.
Why Are Supermarket Fridges Hacked? 4 Mind-Bending Takeaways From Europe’s Modern Cyber Risk
1. Introduction: The Weird Reality of Internet-Connected Ice Cream
Imagine walking into your local supermarket on a routine grocery run, only to find empty shelves, spoiled milk, and rows of freezers filled with melted ice cream. Now imagine learning that this destruction was caused not by a localized power outage or a faulty mechanical compressor, but by a remote hacker operating thousands of miles away.
This surreal scenario recently played out across Europe. In Belgium, a coordinated cyber incident struck refrigeration systems across roughly 40 Delhaize supermarkets, at least 15 Carrefour stores, 5 Spar shops, and the specialty butchery group De Laet en Van Haver. Internal freezer temperatures spiked as high as 70°C, destroying approximately €100,000 worth of food in a matter of hours. The disruption followed an October 12 attack that tampered with cooling systems in hundreds of French supermarkets, as well as separate incidents impacting stores in Sweden’s ICA chain.
This wave of attacks raises an obvious, uncomfortable question: Why are supermarket freezers connected to the internet in the first place, and what does this bizarre vulnerability reveal about the delicate digital infrastructure supporting our physical world?
2. Takeaway 1: Conveniences Cut Costs, But They Open Digital Backdoors
Modern commercial refrigeration units are far more complex than domestic appliances. They rely on central management units that regulate defrost cycles, adjust internal cooling temperatures, and monitor safety alarms for every cabinet in a store.
Supermarket chains connect these central controllers directly to the public internet to prioritize financial efficiency and operational convenience. According to data from Danfoss, a major refrigeration equipment supplier in Europe, remote connectivity reduces unnecessary engineer callouts by 15% to 30%. When an anomaly occurs, technicians can diagnose faults and adjust operational parameters remotely, eliminating the expense of dispatching a service van for routine troubleshooting.
Remote connectivity also automates regulatory food safety compliance. Mandatory safety standards require continuous, strict logging of storage temperatures. Historically, store employees had to manually check and log the temperature of every display cabinet by hand up to four times a day. Automated digital monitoring eliminates this labor-intensive task. To facilitate these conveniences, manufacturers’ own installation guides explicitly instruct technicians on how to configure store routers to forward incoming internet traffic directly to internal refrigeration controllers.
However, this drive for marginal financial efficiency creates a fundamental friction between traditional Operational Technology (OT) and Information Technology (IT). Physical industrial hardware is built for a 10- to 15-year lifecycle. Conversely, digital IT infrastructure operates on fast-moving patch cycles measured in weeks or months. In chasing minor operational savings, companies systematically attach long-lived, slow-to-update physical infrastructure directly to an aggressive, fast-evolving global cyber threat landscape.
3. Takeaway 2: The “Not My Job” Dilemma and Abandoned Software
The security failures exposing physical cooling systems stem from a combination of contractual outsourcing and outdated hardware. Cybersecurity firm Forescout identified a critical organizational blind spot across the industry: fragmented operational responsibility.
In a typical retail setup, an external contractor manages the refrigeration software, the store owner owns the physical freezer hardware, and the store’s internal IT department manages the local internet connection and router settings. Because operational authority is split across three isolated entities, security becomes an orphan responsibility.
“no single party may have complete visibility into the exposed service”
This visibility gap is exacerbated by the lifespan discrepancy of industrial assets. Because physical cooling gear remains functional for over a decade, store owners rarely replace equipment simply because its software has reached end-of-life. For example, one of the Danfoss controller models involved in the recent European breaches has been out of vendor support since May 2021. Receiving zero security patches or firmware updates, these legacy controllers remain online, running indefinitely without security maintenance until a physical breakdown—or a cyber breach—occurs.
4. Takeaway 3: The Scale Is Global—Nearly 13,000 Systems Are Exposed Right Now
The incidents in Belgium, France, and Sweden are not isolated anomalies; they represent a global exposure footprint. To understand the scope of this risk is to realize that search engines aren’t just indexing web servers—they are mapping out the unmonitored digital backdoors of our global food supply.
Utilizing Shodan—a search engine that indexes devices connected to the public internet—Forescout identified 12,976 exposed refrigeration management services operating across 6,017 distinct IP addresses in 99 countries and territories .
The vast majority of these publicly reachable systems belong to two dominant industrial product families:
- Copeland and Dixell’s XWEB systems: 7,075 exposed services
- Danfoss’s StoreView systems: 4,697 exposed services
The vulnerability of these connected systems is severe: 80% of the exposed Danfoss systems were running outdated firmware versions that lacked basic fixes for known security flaws.
While a critical distinction exists between a system being “exposed” and one being “hacked”—exposure indicates direct reachability rather than an active breach—having nearly 13,000 industrial refrigeration controls accessible via the open internet represents a massive, unmonitored attack surface.
5. Takeaway 4: Hackers Don’t Need Complex Malware—And It Goes Far Beyond Grocery Stores
A striking aspect of these refrigeration breaches is their sheer simplicity. Threat actors do not need to develop custom, highly sophisticated malware to ruin a store’s inventory. Once an exposed management interface is located on the internet, attackers simply gain entry using default settings or known, unpatched software flaws.
Once logged in, attackers do not install malicious payloads; they simply leverage the software’s standard, built-in administrative features against itself. By issuing legitimate system commands, an attacker can adjust target temperatures, force continuous defrost cycles, or deactivate internal temperature alarms. Because these actions use native system functions, the malicious commands look identical to routine operator adjustments, making detection nearly impossible for local store staff until physical food spoilage occurs.
Furthermore, this operational risk extends far beyond retail grocery aisles. Identical industrial refrigeration management units are actively deployed across critical supply chain sectors, including:
- Food processing plants
- Wineries and fruit storage facilities
- Agricultural farms
- Hospital medical cooling systems
This reliance on direct internet connections highlights the systemic fragility of the global “cold chain,” where critical food supplies and essential medical storage rely on basic, unmonitored network pathways.
6. Conclusion: Closing the Digital Fridge Door
Securing industrial cooling infrastructure requires immediate operational changes to isolate physical assets from public networks. Cold-chain connectivity has become an invisible, systemic risk underpinning modern urban life, requiring strict technical remedies to close off exposure:
- Complete Network Isolation: Disconnect refrigeration management systems entirely from the open internet, forcing third-party contractors to log in strictly through secure remote access tools.
- Hardware Lifecycles: Replace legacy, end-of-life equipment that no longer receives security patches and firmware updates from manufacturers.
- Granular Identity & Access Controls: Eliminate shared contractor passwords in favor of individual user accounts, enforce multi-factor authentication (MFA), and retain detailed audit trails of who modifies secure system settings.
As modern society increasingly digitizes everyday physical infrastructure, the cyberattacks across European supermarkets serve as a clear warning. They leave us with a compelling question: What other mundane physical objects in our daily lives are quietly connected to the open internet, waiting to be turned off?