Supermarket fridge cyberattacks expose refrigeration security risks
Supermarkets in seven European countries reported refrigeration problems on 2 November 2026, following October’s attacks in France. Danish industrial cybersecurity company Secomea says these latest suspected attacks highlight the need to control who can reach essential equipment remotely. Its experience includes retail refrigeration: according to its customer case study, Secomea technology supports monitoring specialist AK-Centralen’s service to more than 1,500 supermarkets.
That work involves the same operational challenge now confronting affected retailers: keeping cooling systems accessible to maintenance specialists while protecting them from unauthorised interference.
What happened in the European supermarket cyberattacks
At an ICA store in Stockholm, freezers reached 50°C after an attack at around 2am, its sales manager told Reuters. In Belgium, Carrefour reported disruption at 15 stores, while a butcher near Antwerp estimated that €15,000 worth of meat had been ruined.
In Ireland, Musgrave said systems in 13 SuperValu stores were affected, with the incident confined to a specific refrigeration model. Monitoring systems raised the alarm and chilled and frozen products were removed from sale as a precaution, the company told the Irish Times. The stores remained open, with other products available.
Smaller businesses were also affected. Danish refrigeration equipment and controls supplier Danfoss told Dutch broadcaster NOS that at least 17 businesses in the Netherlands had been hit, including butchers and neighbourhood shops. At one frozen-food storage site, the supplier said a system normally set to −20°C had been changed to −10°C and that it intervened quickly.
The earlier French attacks illustrate how normal refrigeration functions can be misused. Cooling Post reported that hundreds of supermarkets were affected when systems were forced into continuous defrost cycles, raising temperatures and causing food losses. Defrosting normally removes accumulated ice from cooling equipment; prolonging that process interferes with its ability to maintain storage temperatures.
How supermarket refrigeration controllers work
Such interference happens through operational technology, or OT: the hardware and software that monitor and control physical equipment. In refrigeration, management platforms bring information and operating controls from multiple devices into a single interface.
This allows a specialist to investigate an installation without travelling to the store. The same capabilities make protection of the interface important, since unauthorised access can provide a means of changing how the equipment operates.
Why supermarket refrigeration systems are vulnerable
France’s national computer emergency response team, CERT-FR, documented numerous compromises involving Danfoss AK-SM and AK-SC controllers, alongside Copeland and Dixell XWEB systems, in its October alert. It identified exposing management interfaces to the internet as contrary to good practice.
Research by American cybersecurity company Claroty helps explain that warning. Its dedicated research arm Team82 found thousands of publicly accessible management interfaces, giving potential attackers a route to refrigeration equipment without first compromising a retailer’s corporate network. It also identified authentication and command-execution vulnerabilities in the AK-SM 800A, which Danfoss addressed through a firmware release. These were research findings, not a confirmed account of the entry route used in November.
Danfoss’s account of the Dutch incidents points to basic access weaknesses too. A spokesperson told NOS that the affected systems were outside a protected network and still used default passwords. The supplier said it had advised customers after the French attacks to remove direct internet access and reconnect through a secured network.
Older equipment adds another difficulty. In a statement to Cooling Post about October’s French attacks, Danfoss said most affected units were legacy products or current products running outdated firmware. Some discontinued models no longer received security updates.
These findings show why poorly protected refrigeration can be an accessible target: an attacker may be able to reach powerful controls directly, while weak credentials or unpatched software leave an opportunity to interfere. The effect can reach the shop floor quickly because food depends on continuous temperature control.
Securing remote access to refrigeration systems
Remote access also helps prevent cooling failures. External specialists use it to monitor temperatures, respond to alarms, diagnose faults and maintain installations, Secomea explains in its press release.
Across a retailer’s stores, however, several suppliers may use different access methods. Coordinating those connections requires oversight of which technicians can reach which equipment.
“For retailers, the question isn't whether they need remote connectivity. They absolutely do,” says Michael Ferdinandsen, Secomea’s CEO, in their press release on the subject. “The question is whether they have sufficient control over who can access their equipment, what they can reach, and what they're allowed to do.”
CERT-FR’s guidance addresses both connectivity and equipment condition. It recommends removing direct internet exposure and restoring access through a secure virtual private network, or VPN, or another protected network. It also calls for checking configurations, particularly defrost schedules, updating firmware and changing default passwords.
Those checks are especially relevant after interference: reconnecting a controller securely must go together with ensuring its operating settings are correct.
Secomea focuses on managing access at the individual equipment level. According to the company, gateways near operational assets work with central access management, granular permissions and audit logs to govern connections.
A refrigeration technician can be given access to the equipment they maintain, with permissions determining what they can reach and when. Activity records then help the retailer oversee remote work. Secomea places this alongside network segmentation, vulnerability management, updates and monitoring.
Remote refrigeration monitoring in practice
Secomea's AK-Centralen deployment provides an example of protected connectivity supporting everyday operations. Secomea’s case study describes gateways linking store equipment to the monitoring company’s server through VPN connections.
Operators respond to alarms by coordinating action, from asking an employee to close a cabinet door to arranging specialist maintenance. The case study reports approximately 140,000 alarms annually, illustrating the scale of the monitoring task.
For retailers, that service has a direct purpose: identifying cooling problems early enough for someone to intervene. Controlling the connections through which specialists work helps preserve that capability while limiting opportunities for unauthorised access.
The practical benefit reaches back to the refrigerated aisle. With protected remote support, retailers can retain the monitoring and maintenance that help keep equipment running and food at the temperatures it needs.
Liked this article? You can support our independent journalism via our page on Buy Me a Coffee. It helps keep MoveTheNeedle.news focused on depth, not clicks.