Refrigeration Attacks Across Europe: What Retailers and Cold-Chain Operators in Germany Should Check Now

Status: 4 November 2026. Investigations are ongoing in several countries and some points remain open. We will update this post when reliable new information becomes available.

On the night to 12 October 2026, unknown attackers manipulated the refrigeration in several hundred French supermarkets: display cases and freezers heated instead of cooling, and stock had to be thrown away. Three weeks later, on the night to 2 November, a second wave followed in at least nine more European countries, Germany among them. The attackers did not go after data. They attacked physical equipment through its controllers. For anyone running refrigeration in Germany, the question is no longer theoretical: are our controllers just as reachable?

What happened

Wave 1, France (11–12 October): Stores of Intermarché and Netto (Groupement Mousquetaires), Coopérative U, Carrefour, Monoprix and E.Leclerc were affected. Counts vary: Reuters reported at least 350 stores, while finance minister Roland Lescure told Parliament on 13 October that about 700 of the country’s roughly 10,000 supermarkets were affected. According to media reports, display cases reached up to 50 °C; the Paris prosecutor is investigating.

Wave 2, several countries (1–2 November): Belgium was hit hardest, with about 75 stores, including “several dozen” stores of Delhaize, the Belgian brand of the Ahold Delhaize group, by the company’s own account, 15 Carrefour and about 15 Intermarché stores. Delhaize spoke of an “IT incident affecting the refrigeration systems”. Also reported: 13 SuperValu stores in Ireland, 7 Intermarché stores in Portugal, 6 to 7 Coop stores plus an uncounted number of ICA stores in Sweden, and one store in Estonia. In the Netherlands, a Danfoss spokesperson said at least 17 companies were hit. Finland and Luxembourg reported cases without figures. Belgium’s federal prosecutor has opened an investigation.

Losses: No official total exists, neither for France nor for Europe. Les Mousquetaires put its losses in France at “several million euros”. The often-quoted figure of about €40 million is an estimate by the newspaper Économie Matin, based on an assumed €100,000 per affected store. Single stores reported stock losses from about €50,000 (Intermarché Haguenau) to about €220,000 (Super U Wasselonne). Coopérative U’s CEO estimated €180,000 to €200,000 for a hypermarket.

Not to be confused with: On 12 October, Ahold Delhaize (group level, not the Belgian refrigeration cases above) reported a separate cybersecurity incident in its network. It took its brands’ websites and apps offline as a precaution; according to its 19 October update, all stores stayed open. The group draws no link to refrigeration.

Confirmed cases in Germany

The second wave also reached German stores on the night to 2 November. Two cases are confirmed:

• Edeka in Reisbach (Lower Bavaria): According to media reports, the refrigeration was heated to up to 50 °C. According to ZDF heute, an Edeka spokesperson confirmed “an IT incident in connection with a refrigeration system”; the store wrote that huge amounts of food had to be thrown away.
• AWO supermarket in Wetter-Volmarstein (North Rhine-Westphalia): The Arbeiterwohlfahrt confirmed the attack to dpa. It was aimed at the company that maintains the refrigeration remotely.

ZDF heute also reports a supermarket in Lilienthal near Bremen whose owner had to discard goods worth over €360,000, and, citing WDR, a manipulated system in Wuppertal. We do not count these until they are confirmed. After the French attack, Germany’s BSI had already urged operators to secure internet-reachable control systems to the state of the art.

The topic is most relevant for:

• Food retail: supermarkets, discounters and franchise stores with centrally controlled display cases.
• Food logistics: cold stores, distribution centres and cross-docks, often maintained remotely by the refrigeration contractor.
• Pharma cold chain: wholesalers, pharmacy logistics and warehouses, where a temperature excursion can write off whole batches.
• Hospitality and catering: commercial kitchens, canteens and restaurant chains where an installer put the system online “just for convenience”.

Operators often don’t know their system is reachable at all. Refrigeration contractors frequently set up this access to receive alarms or carry out maintenance.

How the attacks worked

Only part of it is public. According to reports, the attackers used the controllers to trigger the defrost cycle continuously, the built-in function that periodically de-ices evaporators. Left on permanently, it heats the case up. They needed no malware in the classic sense, just access to the operator interface.

On 12 October, CERT-FR (ANSSI) published alert CERTFR-2026-ALE-012. It names the Danfoss AK-SM and AK-SC series and, since 13 October, the Copeland XWEB and Dixell XWEB supervisors. Danfoss said many affected units had reached end of life or were running outdated firmware. In the second wave too, according to Reuters, at least some of the systems used Danfoss technology; a spokesperson located the weakness “primarily in outdated software”.

Two figures show the size of the attack surface: Reuters found at least 4,500 Danfoss interfaces still visible via the Shodan search engine on 13 October. In Belgium, the company Approach Cyber found about 700 openly reachable refrigeration controllers on 16 October, about 400 of them apparently running vulnerable software. Belgium’s Centre for Cybersecurity had already issued a warning on 13 October.

Vulnerabilities in the Danfoss AK-SM 8xxA series, found by Claroty Team82, are also known: an authentication bypass (CVE-2025-41450, fixed in R4.2) plus a command injection and a configuration manipulation flaw (CVE-2025-41451 and CVE-2025-41452, fixed in firmware R4.3.1, Danfoss advisory DSA-2025-08-01).

Still open:

• Who is behind the attacks. There has been no claim of responsibility and no ransom demand, and no attribution to any group is confirmed.
• Whether the two waves are linked. Reuters could not establish this.
• How exactly the attackers got in. Several of those affected point to the provider that maintains the refrigeration remotely. Exposed web interfaces or default passwords are also possible.
• Whether the CVEs above were exploited. A link is plausible but not confirmed.

Checklist: what to check now

1. Internet exposure: Is any controller, system manager or supervisor reachable on a public IP address? Check your own IP ranges, for example with Shodan or Censys, and ask your refrigeration contractor directly.
2. Remote maintenance access: Who connects, and how? Access should run only through a VPN or a secured jump host with multi-factor authentication. CERT-FR calls firewall IP filtering an emergency measure only.
3. Default passwords: Have all factory passwords and shared installer accounts been replaced?
4. Firmware and end of life: What firmware is running, and is the device still supported by the vendor? Units without updates must never be on the internet and should be replaced.
5. Web interface authentication: Is the vendor’s highest security mode enabled (for Danfoss, “Strict” according to CERT-FR)? Is HTTPS enforced?
6. Network segmentation: Do refrigeration controllers share a network with tills, office IT or guest Wi-Fi? They belong in a separate, filtered segment.
7. Alarms and parameter changes: Are changes to setpoints and defrost schedules logged and alerted on? Do temperature alarms work independently of the controller, for example via separate sensors?
8. Physical and serial interfaces: Who in the store can reach service ports, Modbus or RS-485 lines and gateways?

If a device has already been compromised, CERT-FR recommends a restart or factory reset, a clean reconfiguration and hardening before it goes back into service. A reset alone is not enough, because the device remains vulnerable afterwards. Also check your insurance contract before cutting data connections to your contractor.

When an IoT & hardware pentest helps

You can work through most of this checklist yourself. A pentest shows whether your measures actually hold, from the internet and from the store network. For systems in live operation, we agree the scope with you and your refrigeration contractor beforehand. Find out more on our IoT & hardware pentest page.

Sources

Wave 1 and advisories

• CERT-FR: CERTFR-2026-ALE-012 – Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (12 Oct 2026, updated 13 and 16 Oct 2026)
• Reuters via Business Insurance: Investigators hunt French supermarket fridge hackers (13 Oct 2026)
• AP via KSAT: Cyberattack targeting refrigeration systems hits 700 supermarkets, French government says (13 Oct 2026)
• Euronews: Hundreds of French supermarkets hit by cyberattack on refrigeration systems (12 Oct 2026)
• Al Jazeera: French fridge fright: why supermarkets have become a target for hackers (13 Oct 2026)
• Boursorama: Cyberattaque contre les frigos des supermarchés : une minorité de magasins touchés, tempère le PDG de Coopérative U (13 Oct 2026)
• Forbes Belgique: Cyberattaque contre des supermarchés en France (14 Oct 2026)
• Économie Matin: Frigos piratés : plusieurs millions d’euros de pertes pour la grande distribution (12 Oct 2026)
• Ahold Delhaize: Update on status of cybersecurity incident (19 Oct 2026)

Wave 2

• Euronews: Cyberattack hits Belgian supermarket fridges and freezers (2 Nov 2026)
• RetailDetail: Koelmeubels Delhaize-supermarkten gehackt (2 Nov 2026)
• Reuters via CNBC: Cyberattack on fridges hits supermarkets across Europe (2 Nov 2026)
• AP via ABC News: Freezers at supermarkets in European countries hit by apparent cyberattacks (2 Nov 2026)
• RTP: Sete lojas do Intermarché atingidas por ciberataque em Portugal and Observador (2 Nov 2026)
• ZDF heute: Kühlanlagen gehackt – auch Supermarkt in NRW muss Lebensmittel entsorgen (3 Nov 2026)
• Security-Insider: Cyberangriff auf Edeka-Kühlanlagen in Bayern (3 Nov 2026)
• The Brussels Times: Belgian supermarkets were warned of cyber risks (4 Nov 2026)

Technical background

• IT-Connect: Cyberattaque des supermarchés : le froid ciblé (12 Oct 2026)
• Danfoss: Security Advisory DSA-2025-08-01 (August 2025)
• NVD: CVE-2025-41452