Overnight from November 1 to 2, hackers turned supermarket freezers across Europe into ovens. Refrigeration and freezer units in at least seven countries were remotely forced into defrost mode, pushing internal temperatures as high as 50°C (122°F) and forcing stores to throw out chilled and frozen food. It was the second such attack in three weeks — and it exploited the same weakness that puts millions of smart home devices at risk: internet-connected equipment running outdated, unsupported software.
What happened on the night of November 1–2
Between the night of Sunday, November 1, and the early hours of Monday, November 2, refrigeration systems malfunctioned at supermarkets in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands, and Sweden. Attackers remotely switched the equipment into defrost mode or raised temperature setpoints, in some cases pushing freezers to 50°C. At one Swedish store, a manager arrived on Monday morning to find a puddle of water and freezers set to 55°C.
The damage was widespread. In Belgium, around 40 Delhaize stores were affected, along with four more in Luxembourg, after parent company Ahold Delhaize confirmed an IT incident affecting refrigeration in dozens of its stores. Around 15 Carrefour stores in Belgium were also hit, as were sites operated by Intermarché, Spar, and Shop & Go stores at Q8 service stations. In Sweden, grocery chains ICA and Coop reported damage, with Coop confirming a cyber incident at six locations in central Sweden. In Ireland, at least 13 SuperValu stores were affected, with fresh and frozen food thrown out, according to parent company Musgrave.
Stores scrambled to respond, discarding spoiled food, closing cold aisles, and in some cases bringing in refrigerated trucks. Ahold Delhaize said its stores had resumed normal operations and deliveries by November 3.
A second wave — and a known vulnerability
The November attack was not the first. Less than three weeks earlier, on October 11 and 12, French supermarket chains including Carrefour, Coopérative U, Intermarché, Monoprix, and E.Leclerc reported the same problem: hundreds of stores found refrigerators running above 120°F after a cyberattack.
France’s cybersecurity agency, ANSSI, issued an alert on October 12 (CERT-FR CERTFR-2026-ALE-012) naming the targeted equipment: remote supervisory controllers for commercial refrigeration, specifically Danfoss AK-SM and AK-SC series units and Copeland and Dixell XWEB controllers. The same systems were implicated again in the November wave, with Belgian refrigeration company Sabcobel — which operates Delhaize’s systems — identified as a common technology supplier across affected sites.
Danfoss said most of the affected systems were legacy AK-SM 800 and AK-SC 355 units running end-of-life software that no longer receives security updates. The company had already published an advisory for the AK-SM 8xxA series (DSA-2025-08-01, covering CVE-2025-41451 and CVE-2025-41452). According to CERT-FR, exposing a refrigeration management interface directly to the internet goes against good practice — yet that is exactly what happened.
Christophe Hansen, the European Union’s commissioner for agriculture and food, called the repeated attacks deeply concerning and described the latest episode as a deliberate attempt to disrupt the food supply chain. No group has claimed responsibility, and no one has been formally identified as behind the attacks. Swedish authorities are still examining several cases and have not formally confirmed them as cyberattacks.
Why supermarkets were an easy target
The attack did not require sophisticated malware or a zero-day exploit. The attackers used a known vulnerability in controllers that were reachable from the internet and running software their manufacturer no longer supports. Once inside the management interface, they could change setpoints and trigger defrost cycles from anywhere in the world.
It is a familiar pattern in industrial and building systems: equipment installed years ago, connected for remote monitoring, and then forgotten. The controllers keep working, so nobody updates them — until an attacker finds them with an automated scan and walks in through a vulnerability that was disclosed and patched long ago for supported models.
What this means for your smart home
A supermarket freezer and a smart thermostat may seem worlds apart, but they fail in exactly the same ways. Cameras, locks, thermostats, and hubs in homes are also small computers with network connections, admin interfaces, and firmware that needs updating. The freezer attacks are a reminder to apply the same hardening at home:
- Keep firmware updated — and retire unsupported gear. If a manufacturer has ended security updates for a device, it is living on borrowed time. The Danfoss units at the center of these attacks were end-of-life models. Check whether your cameras, locks, and hubs are still supported, and replace anything that is not.
- Do not expose device admin panels to the internet. The refrigeration controllers were reachable online, which is what made a remote attack possible. Avoid port forwarding to smart home devices, and use a VPN or your platform’s cloud service instead of opening admin interfaces to the world.
- Put smart home gear on its own network. A separate Wi-Fi network or VLAN for IoT devices limits the damage if one device is compromised, keeping an attacker away from your computers and phones.
- Change default credentials and use two-factor authentication. Many connected devices ship with known default passwords. Unique passwords and two-factor authentication on your smart home accounts close the easiest doors.
- Choose vendors with a security track record. Before buying, check whether a brand publishes security advisories and ships patches for older models — not just new ones.
The bottom line
The freezer attacks caused real disruption — wasted food, closed aisles, and emergency logistics across seven countries — but they were preventable. The vulnerability was known, the fix was published, and the exposure was avoidable. Investigations into who was behind the attacks are ongoing, and the EU is treating the incident as a deliberate strike on the food supply chain.
For smart home owners, the lesson is simpler and closer to home: the devices that make a house convenient are computers, and computers that are reachable from the internet and running old software will eventually be found. Update them, isolate them, and don’t leave the digital front door open.