---
title: "Refrigeration Controller Attacks in Europe: What to Check"
url: https://mr-cyber.com/blog/refrigeration-controller-attacks-europe
language: en
description: "First France, then Belgium, Ireland, Germany and more: attacks on refrigeration controllers in autumn 2026. What is known and what operators should check."
---

-   [Analysis](https://mr-cyber.com/blog/tags/analysis)

# Refrigeration Attacks Across Europe: What Retailers and Cold-Chain Operators in Germany Should Check Now

In two waves in autumn 2026, unknown attackers manipulated internet-reachable refrigeration controllers in European supermarkets: in October in hundreds of French stores, in early November in Belgium, Ireland, Sweden, Portugal, the Netherlands and other countries, Germany included. We summarise what is public and what operators should check now.

By [Moez Bouzayani](https://mr-cyber.com/about) · 4 November 2026 · 8 min read

Defrost without end: how a hijacked controller heats the display case

_Status: 4 November 2026. Investigations are ongoing in several countries and some points remain open. We will update this post when reliable new information becomes available._

On the night to 12 October 2026, unknown attackers manipulated the refrigeration in several hundred French supermarkets: display cases and freezers heated instead of cooling, and stock had to be thrown away. Three weeks later, on the night to 2 November, a second wave followed in at least nine more European countries, Germany among them. The attackers did not go after data. They attacked physical equipment through its controllers. For anyone running refrigeration in Germany, the question is no longer theoretical: are our controllers just as reachable?

## What happened

**Wave 1, France (11–12 October):** Stores of Intermarché and Netto (Groupement Mousquetaires), Coopérative U, Carrefour, Monoprix and E.Leclerc were affected. Counts vary: Reuters reported at least 350 stores, while finance minister Roland Lescure told Parliament on 13 October that about 700 of the country’s roughly 10,000 supermarkets were affected. According to media reports, display cases reached up to 50 °C; the Paris prosecutor is investigating.

**Wave 2, several countries (1–2 November):** Belgium was hit hardest, with about 75 stores, including “several dozen” stores of Delhaize, the Belgian brand of the Ahold Delhaize group, by the company’s own account, 15 Carrefour and about 15 Intermarché stores. Delhaize spoke of an “IT incident affecting the refrigeration systems”. Also reported: 13 SuperValu stores in Ireland, 7 Intermarché stores in Portugal, 6 to 7 Coop stores plus an uncounted number of ICA stores in Sweden, and one store in Estonia. In the Netherlands, a Danfoss spokesperson said at least 17 companies were hit. Finland and Luxembourg reported cases without figures. Belgium’s federal prosecutor has opened an investigation.

Attacks on refrigeration controllers in Europe, autumn 2026

350–700

supermarkets affected in France, of about 10,000

Reuters: at least 350; finance minister Roland Lescure: about 700 · [Reuters (via Business Insurance)](https://www.businessinsurance.com/investigators-hunt-french-supermarket-fridge-hackers-no-claim-of-responsibility/), [AP](https://www.ksat.com/business/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says/)

~75

stores affected in Belgium, the largest count in wave 2

Euronews tally, 2 Nov · [Euronews](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers)

~€40m

Estimate by Économie Matin (assumes ~€100k per store), [12 Oct](https://www.economiematin.fr/?p=233732)

estimated stock losses in France

No official total exists.

### Affected stores per country

Bars show the lowest published count, labels the full range. We add nothing up: the figures come from different sources and days.

Sources: [Reuters (via Business Insurance)](https://www.businessinsurance.com/investigators-hunt-french-supermarket-fridge-hackers-no-claim-of-responsibility/), [AP](https://www.ksat.com/business/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says/), [Euronews/AFP](https://www.euronews.com/2026/10/12/hundreds-of-french-supermarkets-hit-by-cyberattack-on-refrigeration-systems), [Boursorama](https://www.boursorama.com/actualites/cyberattaque-contre-les-frigos-des-supermarches-une-minorite-de-magasin-touches-tempere-le-pdg-de-cooperative-u-1e0bfe57ed2db98c027e44ac8ae8aea9), [Al Jazeera](https://www.aljazeera.com/economy/2026/10/13/french-fridge-fright-why-supermarkets-have-become-target-for-hackers), [Euronews](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers), [RetailDetail](https://www.retaildetail.be/nl/news/food/koelmeubels-delhaize-supermarkten-gehackt/), [Reuters (via CNBC)](https://www.cnbc.com/2026/11/02/cyberattack-on-fridges-hits-supermarkets-across-europe.html), [AP (via ABC News)](https://abcnews.com/International/wireStory/freezers-supermarkets-european-countries-hit-apparent-cyberattacks-137765494), [RTP](https://www.rtp.pt/noticias/pais/sete-lojas-do-intermarche-atingidas-por-ciberataque-em-portugal_n1776375), [Observador](https://observador.pt/2026/11/02/ataque-informatico-atinge-frigorificos-e-congeladores-de-supermercados-na-belgica-luxemburgo-e-suecia/), [ZDF heute](https://www.zdfheute.de/politik/deutschland/cyberangriff-supermaerkte-nrw-bayern-temperatur-100.html), [Security-Insider](https://www.security-insider.de/cyberangriff-edeka-kuehlanlagen-reisbach-niederbayern-a-4115718eba6a6c73e6b05b846024e2d9/). Per-row details under “Data and sources”.

### Affected stores per company

Both waves, all of Europe, largest first.

Sources: [Reuters (via Business Insurance)](https://www.businessinsurance.com/investigators-hunt-french-supermarket-fridge-hackers-no-claim-of-responsibility/), [AP](https://www.ksat.com/business/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says/), [Euronews/AFP](https://www.euronews.com/2026/10/12/hundreds-of-french-supermarkets-hit-by-cyberattack-on-refrigeration-systems), [Boursorama](https://www.boursorama.com/actualites/cyberattaque-contre-les-frigos-des-supermarches-une-minorite-de-magasin-touches-tempere-le-pdg-de-cooperative-u-1e0bfe57ed2db98c027e44ac8ae8aea9), [Al Jazeera](https://www.aljazeera.com/economy/2026/10/13/french-fridge-fright-why-supermarkets-have-become-target-for-hackers), [Euronews](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers), [RetailDetail](https://www.retaildetail.be/nl/news/food/koelmeubels-delhaize-supermarkten-gehackt/), [Reuters (via CNBC)](https://www.cnbc.com/2026/11/02/cyberattack-on-fridges-hits-supermarkets-across-europe.html), [AP (via ABC News)](https://abcnews.com/International/wireStory/freezers-supermarkets-european-countries-hit-apparent-cyberattacks-137765494), [RTP](https://www.rtp.pt/noticias/pais/sete-lojas-do-intermarche-atingidas-por-ciberataque-em-portugal_n1776375), [Observador](https://observador.pt/2026/11/02/ataque-informatico-atinge-frigorificos-e-congeladores-de-supermercados-na-belgica-luxemburgo-e-suecia/), [ZDF heute](https://www.zdfheute.de/politik/deutschland/cyberangriff-supermaerkte-nrw-bayern-temperatur-100.html), [Security-Insider](https://www.security-insider.de/cyberangriff-edeka-kuehlanlagen-reisbach-niederbayern-a-4115718eba6a6c73e6b05b846024e2d9/).

No official total for Europe exists. For Germany we count only the cases confirmed by their operators; for the Netherlands, Danfoss gave businesses, not stores.

Data and sources

| Country and chain | Count | Figure and source |
| --- | --- | --- |
| Wave 1 · night to 12 October 2026 |
| France | 350–700 | Reuters: at least 350; finance minister Roland Lescure to Parliament: about 700 of about 10,000 supermarkets (13 Oct) ([Reuters (via Business Insurance), 13 Oct](https://www.businessinsurance.com/investigators-hunt-french-supermarket-fridge-hackers-no-claim-of-responsibility/); [AP, 13 Oct](https://www.ksat.com/business/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says/); [Euronews/AFP, 12 Oct](https://www.euronews.com/2026/10/12/hundreds-of-french-supermarkets-hit-by-cyberattack-on-refrigeration-systems); [Boursorama, 13 Oct](https://www.boursorama.com/actualites/cyberattaque-contre-les-frigos-des-supermarches-une-minorite-de-magasin-touches-tempere-le-pdg-de-cooperative-u-1e0bfe57ed2db98c027e44ac8ae8aea9); [Al Jazeera, 13 Oct](https://www.aljazeera.com/economy/2026/10/13/french-fridge-fright-why-supermarkets-have-become-target-for-hackers)) |
| Les Mousquetaires – Intermarché & Netto | 150–300 | see sources above |
| Coopérative U | 80–100 | see sources above |
| Carrefour | 80 | see sources above |
| Monoprix | ~30 | see sources above |
| E.Leclerc | several | see sources above |
| Wave 2 · night to 2 November 2026 |
| Belgium | ~75 | about 75 stores in Euronews’ tally; Delhaize: “several dozen”, at least 40 (2 Nov) ([Euronews, 2 Nov](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers); [RetailDetail, 2 Nov](https://www.retaildetail.be/nl/news/food/koelmeubels-delhaize-supermarkten-gehackt/); [Reuters (via CNBC), 2 Nov](https://www.cnbc.com/2026/11/02/cyberattack-on-fridges-hits-supermarkets-across-europe.html)) |
| Ahold Delhaize – Delhaize | ≥40 (“several dozen”) | see sources above |
| Carrefour | 15 of ~700 | see sources above |
| Intermarché | ~15 | see sources above |
| Spar (Colruyt) | 5 | see sources above |
| IKEA Mons | 1 | see sources above |
| De Laet & Van Haver | 1 | see sources above |
| Netherlands | ≥17 businesses | “at least seventeen companies”, Danfoss spokesperson; companies not named (2 Nov) ([Euronews, 2 Nov](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers)) |
| Ireland | 13 | 13 SuperValu stores, Musgrave (2 Nov) ([AP (via ABC News), 2 Nov](https://abcnews.com/International/wireStory/freezers-supermarkets-european-countries-hit-apparent-cyberattacks-137765494); [Reuters (via CNBC), 2 Nov](https://www.cnbc.com/2026/11/02/cyberattack-on-fridges-hits-supermarkets-across-europe.html)) |
| Portugal | 7 | 7 Intermarché stores, Grupo Mosqueteiros (2 Nov) ([RTP, 2 Nov](https://www.rtp.pt/noticias/pais/sete-lojas-do-intermarche-atingidas-por-ciberataque-em-portugal_n1776375); [Observador, 2 Nov](https://observador.pt/2026/11/02/ataque-informatico-atinge-frigorificos-e-congeladores-de-supermercados-na-belgica-luxemburgo-e-suecia/)) |
| Sweden | 6–7+ | Coop: 6 (AP) or 7 of 800 (Reuters); plus ICA: “a limited number”, no count (2 Nov) ([AP (via ABC News), 2 Nov](https://abcnews.com/International/wireStory/freezers-supermarkets-european-countries-hit-apparent-cyberattacks-137765494); [Reuters (via CNBC), 2 Nov](https://www.cnbc.com/2026/11/02/cyberattack-on-fridges-hits-supermarkets-across-europe.html)) |
| Germany | ≥2 | confirmed by the operators: Edeka in Reisbach (Bavaria), an AWO-run supermarket in Wetter-Volmarstein (NRW); further reports not confirmed (3 Nov) ([ZDF heute, 3 Nov](https://www.zdfheute.de/politik/deutschland/cyberangriff-supermaerkte-nrw-bayern-temperatur-100.html); [Security-Insider, 3 Nov](https://www.security-insider.de/cyberangriff-edeka-kuehlanlagen-reisbach-niederbayern-a-4115718eba6a6c73e6b05b846024e2d9/)) |
| Estonia | 1 | one Selver store (2 Nov) ([Euronews, 2 Nov](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers); [AP (via ABC News), 2 Nov](https://abcnews.com/International/wireStory/freezers-supermarkets-european-countries-hit-apparent-cyberattacks-137765494)) |
| Finland | – | “several” K Group supermarkets, according to Finnish media (2 Nov) ([Euronews, 2 Nov](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers)) |
| Luxembourg | – | “a few” Delhaize stores (2 Nov) ([AP (via ABC News), 2 Nov](https://abcnews.com/International/wireStory/freezers-supermarkets-european-countries-hit-apparent-cyberattacks-137765494); [Reuters (via CNBC), 2 Nov](https://www.cnbc.com/2026/11/02/cyberattack-on-fridges-hits-supermarkets-across-europe.html)) |
| Affected stores per company |
| Les Mousquetaires – Intermarché & Netto (FR) | 150–300 | [Reuters (via Business Insurance), 13 Oct](https://www.businessinsurance.com/investigators-hunt-french-supermarket-fridge-hackers-no-claim-of-responsibility/); [AP, 13 Oct](https://www.ksat.com/business/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says/); [Euronews/AFP, 12 Oct](https://www.euronews.com/2026/10/12/hundreds-of-french-supermarkets-hit-by-cyberattack-on-refrigeration-systems); [Boursorama, 13 Oct](https://www.boursorama.com/actualites/cyberattaque-contre-les-frigos-des-supermarches-une-minorite-de-magasin-touches-tempere-le-pdg-de-cooperative-u-1e0bfe57ed2db98c027e44ac8ae8aea9); [Al Jazeera, 13 Oct](https://www.aljazeera.com/economy/2026/10/13/french-fridge-fright-why-supermarkets-have-become-target-for-hackers) |
| Coopérative U (FR) | 80–100 | [Reuters (via Business Insurance), 13 Oct](https://www.businessinsurance.com/investigators-hunt-french-supermarket-fridge-hackers-no-claim-of-responsibility/); [AP, 13 Oct](https://www.ksat.com/business/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says/); [Euronews/AFP, 12 Oct](https://www.euronews.com/2026/10/12/hundreds-of-french-supermarkets-hit-by-cyberattack-on-refrigeration-systems); [Boursorama, 13 Oct](https://www.boursorama.com/actualites/cyberattaque-contre-les-frigos-des-supermarches-une-minorite-de-magasin-touches-tempere-le-pdg-de-cooperative-u-1e0bfe57ed2db98c027e44ac8ae8aea9); [Al Jazeera, 13 Oct](https://www.aljazeera.com/economy/2026/10/13/french-fridge-fright-why-supermarkets-have-become-target-for-hackers) |
| Carrefour (FR) | 80 | [Reuters (via Business Insurance), 13 Oct](https://www.businessinsurance.com/investigators-hunt-french-supermarket-fridge-hackers-no-claim-of-responsibility/); [AP, 13 Oct](https://www.ksat.com/business/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says/); [Euronews/AFP, 12 Oct](https://www.euronews.com/2026/10/12/hundreds-of-french-supermarkets-hit-by-cyberattack-on-refrigeration-systems); [Boursorama, 13 Oct](https://www.boursorama.com/actualites/cyberattaque-contre-les-frigos-des-supermarches-une-minorite-de-magasin-touches-tempere-le-pdg-de-cooperative-u-1e0bfe57ed2db98c027e44ac8ae8aea9); [Al Jazeera, 13 Oct](https://www.aljazeera.com/economy/2026/10/13/french-fridge-fright-why-supermarkets-have-become-target-for-hackers) |
| Ahold Delhaize – Delhaize (BE) | ≥40 | [Euronews, 2 Nov](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers); [RetailDetail, 2 Nov](https://www.retaildetail.be/nl/news/food/koelmeubels-delhaize-supermarkten-gehackt/); [Reuters (via CNBC), 2 Nov](https://www.cnbc.com/2026/11/02/cyberattack-on-fridges-hits-supermarkets-across-europe.html) |
| Monoprix (FR) | ~30 | [Reuters (via Business Insurance), 13 Oct](https://www.businessinsurance.com/investigators-hunt-french-supermarket-fridge-hackers-no-claim-of-responsibility/); [AP, 13 Oct](https://www.ksat.com/business/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says/); [Euronews/AFP, 12 Oct](https://www.euronews.com/2026/10/12/hundreds-of-french-supermarkets-hit-by-cyberattack-on-refrigeration-systems); [Boursorama, 13 Oct](https://www.boursorama.com/actualites/cyberattaque-contre-les-frigos-des-supermarches-une-minorite-de-magasin-touches-tempere-le-pdg-de-cooperative-u-1e0bfe57ed2db98c027e44ac8ae8aea9); [Al Jazeera, 13 Oct](https://www.aljazeera.com/economy/2026/10/13/french-fridge-fright-why-supermarkets-have-become-target-for-hackers) |
| Carrefour (BE) | 15 | [Euronews, 2 Nov](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers); [RetailDetail, 2 Nov](https://www.retaildetail.be/nl/news/food/koelmeubels-delhaize-supermarkten-gehackt/); [Reuters (via CNBC), 2 Nov](https://www.cnbc.com/2026/11/02/cyberattack-on-fridges-hits-supermarkets-across-europe.html) |
| Intermarché (BE) | ~15 | [Euronews, 2 Nov](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers); [RetailDetail, 2 Nov](https://www.retaildetail.be/nl/news/food/koelmeubels-delhaize-supermarkten-gehackt/); [Reuters (via CNBC), 2 Nov](https://www.cnbc.com/2026/11/02/cyberattack-on-fridges-hits-supermarkets-across-europe.html) |
| SuperValu (IE) | 13 | [AP (via ABC News), 2 Nov](https://abcnews.com/International/wireStory/freezers-supermarkets-european-countries-hit-apparent-cyberattacks-137765494); [Reuters (via CNBC), 2 Nov](https://www.cnbc.com/2026/11/02/cyberattack-on-fridges-hits-supermarkets-across-europe.html) |
| Intermarché (PT) | 7 | [RTP, 2 Nov](https://www.rtp.pt/noticias/pais/sete-lojas-do-intermarche-atingidas-por-ciberataque-em-portugal_n1776375); [Observador, 2 Nov](https://observador.pt/2026/11/02/ataque-informatico-atinge-frigorificos-e-congeladores-de-supermercados-na-belgica-luxemburgo-e-suecia/) |
| Coop (SE) | 6–7 | [AP (via ABC News), 2 Nov](https://abcnews.com/International/wireStory/freezers-supermarkets-european-countries-hit-apparent-cyberattacks-137765494); [Reuters (via CNBC), 2 Nov](https://www.cnbc.com/2026/11/02/cyberattack-on-fridges-hits-supermarkets-across-europe.html) |
| Spar (Colruyt) (BE) | 5 | [Euronews, 2 Nov](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers); [RetailDetail, 2 Nov](https://www.retaildetail.be/nl/news/food/koelmeubels-delhaize-supermarkten-gehackt/); [Reuters (via CNBC), 2 Nov](https://www.cnbc.com/2026/11/02/cyberattack-on-fridges-hits-supermarkets-across-europe.html) |
| Edeka (DE) | 1 | [ZDF heute, 3 Nov](https://www.zdfheute.de/politik/deutschland/cyberangriff-supermaerkte-nrw-bayern-temperatur-100.html); [Security-Insider, 3 Nov](https://www.security-insider.de/cyberangriff-edeka-kuehlanlagen-reisbach-niederbayern-a-4115718eba6a6c73e6b05b846024e2d9/) |
| Selver (EE) | 1 | [Euronews, 2 Nov](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers); [AP (via ABC News), 2 Nov](https://abcnews.com/International/wireStory/freezers-supermarkets-european-countries-hit-apparent-cyberattacks-137765494) |
| E.Leclerc (FR) | – | [Reuters (via Business Insurance), 13 Oct](https://www.businessinsurance.com/investigators-hunt-french-supermarket-fridge-hackers-no-claim-of-responsibility/); [AP, 13 Oct](https://www.ksat.com/business/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says/); [Euronews/AFP, 12 Oct](https://www.euronews.com/2026/10/12/hundreds-of-french-supermarkets-hit-by-cyberattack-on-refrigeration-systems); [Boursorama, 13 Oct](https://www.boursorama.com/actualites/cyberattaque-contre-les-frigos-des-supermarches-une-minorite-de-magasin-touches-tempere-le-pdg-de-cooperative-u-1e0bfe57ed2db98c027e44ac8ae8aea9); [Al Jazeera, 13 Oct](https://www.aljazeera.com/economy/2026/10/13/french-fridge-fright-why-supermarkets-have-become-target-for-hackers) |
| ICA (SE) | – | [AP (via ABC News), 2 Nov](https://abcnews.com/International/wireStory/freezers-supermarkets-european-countries-hit-apparent-cyberattacks-137765494); [Reuters (via CNBC), 2 Nov](https://www.cnbc.com/2026/11/02/cyberattack-on-fridges-hits-supermarkets-across-europe.html) |
| K Group (FI) | – | [Euronews, 2 Nov](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers) |
| Ahold Delhaize – Delhaize (LU) | – | [AP (via ABC News), 2 Nov](https://abcnews.com/International/wireStory/freezers-supermarkets-european-countries-hit-apparent-cyberattacks-137765494); [Reuters (via CNBC), 2 Nov](https://www.cnbc.com/2026/11/02/cyberattack-on-fridges-hits-supermarkets-across-europe.html) |
| Stock losses |
| Économie Matin | ~€40m | Économie Matin estimate, assuming €100,000 per affected store. No official total exists. ([Économie Matin, 12 Oct](https://www.economiematin.fr/?p=233732)) |
| Losses in France according to Les Mousquetaires (Intermarché, Netto) | “several million euros” | [Forbes Belgique, 14 Oct](https://www.forbes.be/fr/cyberattaque-supermarches-france/) |
| Coopérative U hypermarket (CEO estimate) | €180,000–200,000 | [Boursorama, 13 Oct](https://www.boursorama.com/actualites/cyberattaque-contre-les-frigos-des-supermarches-une-minorite-de-magasin-touches-tempere-le-pdg-de-cooperative-u-1e0bfe57ed2db98c027e44ac8ae8aea9) |
| Super U, Wasselonne | ~€220,000 | [Économie Matin, 12 Oct](https://www.economiematin.fr/?p=233732) |
| Intermarché, Haguenau | ~€50,000 | [Économie Matin, 12 Oct](https://www.economiematin.fr/?p=233732) |
| De Laet & Van Haver butcher, Belgium | ~€15,000 | [Reuters (via CNBC), 2 Nov](https://www.cnbc.com/2026/11/02/cyberattack-on-fridges-hits-supermarkets-across-europe.html) |

**Losses:** No official total exists, neither for France nor for Europe. Les Mousquetaires put its losses in France at “several million euros”. The often-quoted figure of about €40 million is an estimate by the newspaper Économie Matin, based on an assumed €100,000 per affected store. Single stores reported stock losses from about €50,000 (Intermarché Haguenau) to about €220,000 (Super U Wasselonne). Coopérative U’s CEO estimated €180,000 to €200,000 for a hypermarket.

**Not to be confused with:** On 12 October, Ahold Delhaize (group level, not the Belgian refrigeration cases above) reported a separate cybersecurity incident in its network. It took its brands’ websites and apps offline as a precaution; according to its 19 October update, all stores stayed open. The group draws no link to refrigeration.

## Confirmed cases in Germany

The second wave also reached German stores on the night to 2 November. Two cases are confirmed:

-   **Edeka in Reisbach (Lower Bavaria):** According to media reports, the refrigeration was heated to up to 50 °C. According to ZDF heute, an Edeka spokesperson confirmed “an IT incident in connection with a refrigeration system”; the store wrote that huge amounts of food had to be thrown away.
-   **AWO supermarket in Wetter-Volmarstein (North Rhine-Westphalia):** The Arbeiterwohlfahrt confirmed the attack to dpa. It was aimed at the company that maintains the refrigeration remotely.

ZDF heute also reports a supermarket in Lilienthal near Bremen whose owner had to discard goods worth over €360,000, and, citing WDR, a manipulated system in Wuppertal. We do not count these until they are confirmed. After the French attack, Germany’s BSI had already urged operators to secure internet-reachable control systems to the state of the art.

The topic is most relevant for:

-   **Food retail**: supermarkets, discounters and franchise stores with centrally controlled display cases.
-   **Food logistics**: cold stores, distribution centres and cross-docks, often maintained remotely by the refrigeration contractor.
-   **Pharma cold chain**: wholesalers, pharmacy logistics and warehouses, where a temperature excursion can write off whole batches.
-   **Hospitality and catering**: commercial kitchens, canteens and restaurant chains where an installer put the system online “just for convenience”.

Operators often don’t know their system is reachable at all. Refrigeration contractors frequently set up this access to receive alarms or carry out maintenance.

## How the attacks worked

Only part of it is public. According to reports, the attackers used the controllers to trigger the **defrost cycle** continuously, the built-in function that periodically de-ices evaporators. Left on permanently, it heats the case up. They needed no malware in the classic sense, just access to the operator interface.

On 12 October, CERT-FR (ANSSI) published alert **CERTFR-2026-ALE-012**. It names the **Danfoss AK-SM** and **AK-SC** series and, since 13 October, the **Copeland XWEB** and **Dixell XWEB** supervisors. Danfoss said many affected units had reached end of life or were running outdated firmware. In the second wave too, according to Reuters, at least some of the systems used Danfoss technology; a spokesperson located the weakness “primarily in outdated software”.

Two figures show the size of the attack surface: Reuters found at least 4,500 Danfoss interfaces still visible via the Shodan search engine on 13 October. In Belgium, the company Approach Cyber found about 700 openly reachable refrigeration controllers on 16 October, about 400 of them apparently running vulnerable software. Belgium’s Centre for Cybersecurity had already issued a warning on 13 October.

Vulnerabilities in the Danfoss AK-SM 8xxA series, found by Claroty Team82, are also known: an authentication bypass (CVE-2025-41450, fixed in R4.2) plus a command injection and a configuration manipulation flaw (CVE-2025-41451 and CVE-2025-41452, fixed in firmware R4.3.1, Danfoss advisory DSA-2025-08-01).

**Still open:**

-   **Who** is behind the attacks. There has been no claim of responsibility and no ransom demand, and no attribution to any group is confirmed.
-   **Whether** the two waves are linked. Reuters could not establish this.
-   **How** exactly the attackers got in. Several of those affected point to the provider that maintains the refrigeration remotely. Exposed web interfaces or default passwords are also possible.
-   **Whether** the CVEs above were exploited. A link is plausible but not confirmed.

## Checklist: what to check now

1.  **Internet exposure**: Is any controller, system manager or supervisor reachable on a public IP address? Check your own IP ranges, for example with Shodan or Censys, and ask your refrigeration contractor directly.
2.  **Remote maintenance access**: Who connects, and how? Access should run only through a VPN or a secured jump host with multi-factor authentication. CERT-FR calls firewall IP filtering an emergency measure only.
3.  **Default passwords**: Have all factory passwords and shared installer accounts been replaced?
4.  **Firmware and end of life**: What firmware is running, and is the device still supported by the vendor? Units without updates must never be on the internet and should be replaced.
5.  **Web interface authentication**: Is the vendor’s highest security mode enabled (for Danfoss, “Strict” according to CERT-FR)? Is HTTPS enforced?
6.  **Network segmentation**: Do refrigeration controllers share a network with tills, office IT or guest Wi-Fi? They belong in a separate, filtered segment.
7.  **Alarms and parameter changes**: Are changes to setpoints and defrost schedules logged and alerted on? Do temperature alarms work independently of the controller, for example via separate sensors?
8.  **Physical and serial interfaces**: Who in the store can reach service ports, Modbus or RS-485 lines and gateways?

If a device has already been compromised, CERT-FR recommends a restart or factory reset, a clean reconfiguration and hardening before it goes back into service. A reset alone is not enough, because the device remains vulnerable afterwards. Also check your insurance contract before cutting data connections to your contractor.

## When an IoT & hardware pentest helps

You can work through most of this checklist yourself. A pentest shows whether your measures actually hold, from the internet and from the store network. For systems in live operation, we agree the scope with you and your refrigeration contractor beforehand. Find out more on our [IoT & hardware pentest](https://mr-cyber.com/services/iot-hardware-penetration-testing) page.

## Sources

**Wave 1 and advisories**

-   CERT-FR: [CERTFR-2026-ALE-012 – Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération](https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/) (12 Oct 2026, updated 13 and 16 Oct 2026)
-   Reuters via Business Insurance: [Investigators hunt French supermarket fridge hackers](https://www.businessinsurance.com/investigators-hunt-french-supermarket-fridge-hackers-no-claim-of-responsibility/) (13 Oct 2026)
-   AP via KSAT: [Cyberattack targeting refrigeration systems hits 700 supermarkets, French government says](https://www.ksat.com/business/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says/) (13 Oct 2026)
-   Euronews: [Hundreds of French supermarkets hit by cyberattack on refrigeration systems](https://www.euronews.com/2026/10/12/hundreds-of-french-supermarkets-hit-by-cyberattack-on-refrigeration-systems) (12 Oct 2026)
-   Al Jazeera: [French fridge fright: why supermarkets have become a target for hackers](https://www.aljazeera.com/economy/2026/10/13/french-fridge-fright-why-supermarkets-have-become-target-for-hackers) (13 Oct 2026)
-   Boursorama: [Cyberattaque contre les frigos des supermarchés : une minorité de magasins touchés, tempère le PDG de Coopérative U](https://www.boursorama.com/actualites/cyberattaque-contre-les-frigos-des-supermarches-une-minorite-de-magasin-touches-tempere-le-pdg-de-cooperative-u-1e0bfe57ed2db98c027e44ac8ae8aea9) (13 Oct 2026)
-   Forbes Belgique: [Cyberattaque contre des supermarchés en France](https://www.forbes.be/fr/cyberattaque-supermarches-france/) (14 Oct 2026)
-   Économie Matin: [Frigos piratés : plusieurs millions d’euros de pertes pour la grande distribution](https://www.economiematin.fr/?p=233732) (12 Oct 2026)
-   Ahold Delhaize: [Update on status of cybersecurity incident](https://newsroom.aholddelhaize.com/ahold-delhaize-update-on-status-of-cybersecurity-incident/) (19 Oct 2026)

**Wave 2**

-   Euronews: [Cyberattack hits Belgian supermarket fridges and freezers](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers) (2 Nov 2026)
-   RetailDetail: [Koelmeubels Delhaize-supermarkten gehackt](https://www.retaildetail.be/nl/news/food/koelmeubels-delhaize-supermarkten-gehackt/) (2 Nov 2026)
-   Reuters via CNBC: [Cyberattack on fridges hits supermarkets across Europe](https://www.cnbc.com/2026/11/02/cyberattack-on-fridges-hits-supermarkets-across-europe.html) (2 Nov 2026)
-   AP via ABC News: [Freezers at supermarkets in European countries hit by apparent cyberattacks](https://abcnews.com/International/wireStory/freezers-supermarkets-european-countries-hit-apparent-cyberattacks-137765494) (2 Nov 2026)
-   RTP: [Sete lojas do Intermarché atingidas por ciberataque em Portugal](https://www.rtp.pt/noticias/pais/sete-lojas-do-intermarche-atingidas-por-ciberataque-em-portugal_n1776375) and [Observador](https://observador.pt/2026/11/02/ataque-informatico-atinge-frigorificos-e-congeladores-de-supermercados-na-belgica-luxemburgo-e-suecia/) (2 Nov 2026)
-   ZDF heute: [Kühlanlagen gehackt – auch Supermarkt in NRW muss Lebensmittel entsorgen](https://www.zdfheute.de/politik/deutschland/cyberangriff-supermaerkte-nrw-bayern-temperatur-100.html) (3 Nov 2026)
-   Security-Insider: [Cyberangriff auf Edeka-Kühlanlagen in Bayern](https://www.security-insider.de/cyberangriff-edeka-kuehlanlagen-reisbach-niederbayern-a-4115718eba6a6c73e6b05b846024e2d9/) (3 Nov 2026)
-   The Brussels Times: [Belgian supermarkets were warned of cyber risks](https://www.brusselstimes.com/belgium/2389696/belgian-supermarkets-were-warned-of-cyber-risks-could-the-attacks-have-been-prevented) (4 Nov 2026)

**Technical background**

-   IT-Connect: [Cyberattaque des supermarchés : le froid ciblé](https://www.it-connect.fr/cyberattaque-supermarches-froid-danfoss/) (12 Oct 2026)
-   Danfoss: [Security Advisory DSA-2025-08-01](https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-08-01/) (August 2025)
-   NVD: [CVE-2025-41452](https://nvd.nist.gov/vuln/detail/CVE-2025-41452)

## FAQ

Were German supermarkets affected?

Yes. In the second wave, on the night to 2 November 2026, Edeka confirmed an incident at a store in Reisbach (Bavaria) and the Arbeiterwohlfahrt confirmed one at a supermarket in Wetter-Volmarstein (North Rhine-Westphalia). ZDF heute reports further cases that we could not confirm independently. No total for Germany has been published.

Who is behind the attacks?

That is not known. There has been no claim of responsibility and no ransom demand. Belgium's Centre for Cybersecurity said it is not known who is behind the attack and that it may never be determined. Rumours about specific groups are unconfirmed.

Which devices does the CERT-FR alert name?

Alert CERTFR-2026-ALE-012 names Danfoss AK-SM and AK-SC series remote controllers and the Copeland and Dixell XWEB supervisors. The French agency stresses that exposing any management interface to the internet is contrary to good practice, whatever the vendor.

How large are the losses in total?

No official total exists. The most-cited figure, about €40 million for France, is an estimate by the newspaper Économie Matin, which assumed an average of €100,000 per store. Les Mousquetaires (Intermarché, Netto) itself spoke of “several million euros”. Individual supermarkets reported stock losses from about €50,000 to about €220,000.

Is a firmware update enough to secure a refrigeration controller?

No. Updates close known flaws, but older units without vendor support no longer receive them. What matters most is that the management interface is not publicly reachable, remote maintenance runs only through secured access, and default passwords are replaced.