Hacked Fridges: The Cyberattacks on Supermarket Refrigeration

Since October 2026, attackers have repeatedly broken into the systems that keep supermarket food cold. In two waves, they took control of refrigeration controllers in hundreds of stores across Europe and forced fridges and freezers to warm up overnight. Shops had to pull chilled and frozen products from sale and throw away food. This briefing explains what happened, how the attacks worked, whether your own smart fridge is at risk, and the concrete steps to remediate, prevent and protect.

Figures are as reported up to 3 November 2026. Investigations are ongoing, no group has claimed responsibility, and authorities have not confirmed exactly which weakness was used in each case.

What happened

First wave: France, 11 October 2026

On the night of 11 October, an unknown attacker reached the refrigeration controllers of up to 700 French supermarkets and set them to defrost mode, so fridges and freezers warmed up overnight. Stores from Intermarché, Netto, Coopérative U, Carrefour, Monoprix, E.Leclerc and others were affected, and retailers had to discard spoiled food. French cybersecurity firm Sekoia said stores in Spain, Portugal, Poland, Germany and Belgium were also affected. France’s national cyber agency ANSSI is handling the investigation.

Second wave: 2 November 2026

Three weeks later, overnight into Monday 2 November, refrigeration controls were tampered with at supermarkets in Belgium, Luxembourg, Sweden, Ireland, Estonia, the Netherlands and Portugal. Danfoss, the Danish maker of the refrigeration controllers, said its products were involved again. Some stores reported freezers reaching 50°C.

In several cases the affected stores were connected to refrigeration systems run by outside maintenance companies, outside the retailer’s own central network. The European Commission noted that the attacks show how digital threats increasingly affect everyday life, and the EU agriculture commissioner warned that food security needs more attention at every level.

The timeline

The most worrying part of this story is that the weaknesses were known months, and in some cases years, before the attacks:

• 2023: Synacktiv reported that older Danfoss SM800 controllers accepted a “code of the day” calculated only from the date, in addition to the normal password.
• 9 August 2026: Claroty’s Team82 disclosed three vulnerabilities in the current Danfoss AK-SM 800A, and Danfoss had already released fixed firmware.
• 11 October 2026: the French attack.
• 12 October 2026: France’s CERT-FR issued alert CERTFR-2026-ALE-012, covering Danfoss AK-SM and AK-SC controllers and the XWEB consoles from Copeland and Dixell.
• 2 November 2026: the second wave across northern and western Europe.

How the attack worked

No sophisticated malware was needed. Investigators identified Danfoss AK-SM800 and AK-SC355 refrigeration controllers as the main target. These controllers had a web management page reachable from the public internet, with a login that accepted the username “admin” and a hidden “code of the day” that could replace the password using the device’s date.

Once inside, the attackers used the controllers’ own functions. Belgian refrigeration company Sabcobel said the units’ evaporators were switched to defrost mode, and the temperature limits that normally prevent warming were removed. The attacks happened in the early hours, so the damage was only noticed when staff arrived.

Why the controllers were vulnerable

Is my fridge at home at risk?

The current attacks target commercial refrigeration controllers in supermarkets, not household fridges. But home smart fridges are connected computers too, and they have been abused before:

• 2014: security firm Proofpoint found a smart fridge among more than 100,000 hijacked smart devices used to send about 750,000 spam emails, often because devices still used default passwords.
• 2015: researchers showed at a hacking conference that a Samsung smart fridge could expose the owner’s Gmail login details.

For most households, the realistic risks are a hijacked device being used to attack others, or a weakly protected appliance giving attackers a foothold on the home network. The protection steps are simple and are listed below.

If you are affected: remediate now

For supermarkets, food businesses, warehouses and anyone running connected refrigeration:

1. Disconnect from the internet. Remove direct internet access to refrigeration controllers immediately, and temporarily suspend vendor remote access until it is secured.
2. Restore safe operation. Switch affected units to local or manual control, reset setpoints, alarm limits and defrost schedules, and confirm temperatures are back to normal.
3. Protect customers. Remove affected chilled and frozen products from sale and follow your food safety procedures for temperature breaches.
4. Preserve evidence. Save controller logs, configuration exports and remote-access records before changing systems, for the investigation.
5. Reset access. Change every password on the controllers and on remote-access tools, and remove unknown or unused accounts.
6. Report it. Contact your refrigeration contractor and Danfoss or the relevant manufacturer, your national CERT (for example CERT-FR in France or the national cybersecurity centre in your country), and the police.

Prevent: close the doors these attacks used

Protect your smart appliances at home

• Update: turn on automatic updates for your fridge and its app, and install pending updates.
• Change default passwords: use a strong, unique password for the appliance account, and turn on two-step verification if available.
• Separate network: connect smart appliances to your router’s guest or IoT Wi-Fi network, not the network your computers use.
• Disable what you do not use: turn off remote access and other features you do not need.
• Secure your router: change its admin password, keep it updated and use WPA2 or WPA3 encryption.
• Buy supported products: choose brands that state how long they will provide security updates.

The takeaway

The weakest connected device in a building can now empty its shelves overnight.

The fridge attacks did not rely on new or advanced techniques. They used old, unsupported equipment, outdated firmware and management pages left open to the internet, often managed by third parties. The fixes were known before the attacks. Every organisation that runs connected building equipment, from refrigeration and heating to cameras and door controls, should ask the same three questions today: what is connected, who can reach it, and is it still supported?

Sources

Research and advisories

• Claroty Team82: Freeze the Controller, Defrost the Food
• The Hacker News: Second wave of cyberattacks hits supermarkets
• Facilities Dive: Hack of Danfoss refrigeration controllers in Europe
• Wikipedia: 2026 French supermarket refrigerator hack

News

• CNN: Thousands of refrigerators were hacked across France
• NBC News: Supermarkets across Europe hit by new fridge cyberattacks
• Al Jazeera: Suspected cyberattacks trigger supermarket fridge failures
• ABC News: European grocery chains’ freezers targeted
• CNBC: New cyberattack on supermarket fridges sweeps across Europe
• RTÉ: Is my fridge vulnerable to a cyber attack?
• TechRadar: Smart fridge helps spam 750,000 email accounts (2014)