A cyberattack raised refrigerator and freezer temperatures at supermarkets in Belgium, Sweden and Ireland overnight on 1 to 2 November 2026. Delhaize told Euronews it had identified an IT incident affecting the refrigeration systems in several dozen stores, and said it had immediately taken the steps needed to keep stores operational.
Ahold Delhaize spokesperson Sarah De Meester confirmed temperature increases in the cooling systems to Reuters. Carrefour Belgium and the Colruyt Group’s Spar chain reported similar problems, and Ireland’s Musgrave confirmed the attack hit 13 of its SuperValu stores. Sweden’s Coop and ICA also confirmed overnight incidents of their own.
Belgian reporting puts the count at about 40 Delhaize stores, 15 Carrefour stores and five Spar locations. Coop’s press officer, Carlos Cancino, named six stores in central Sweden, and ICA said a limited number of stores, whose connections sit outside its central network, were hit. Reuters also reported one unnamed Estonian supermarket affected.
The attackers used the same technique as an October 12 incident at hundreds of French supermarkets. France’s CERT-FR named the targeted hardware in alert CERTFR-2026-ALE-012: Danfoss’s AK-SM and AK-SC refrigeration controller series, plus Copeland and Dixell xweb units. Danfoss told AFP the affected models are the AK-SM 800, end of life since May 2021, and the AK-SC 355, phased out in 2016. Neither model receives new security fixes.
Why This Hardware Cannot Simply Be Patched
Sabcobel CEO Stephan Moelans told the Belga news agency that the Belgian attack used exactly the same mechanism as the French one. Attackers remotely switch a unit’s evaporator into defrost mode, he said. Moelans said most of his customers have since moved their fridges onto a secure internet connection. He added that a firmware update alone is not enough, since the installations need a physical change too.
As of 2 November, CERT-FR’s alert and Danfoss’s public statements name no CVE for these compromises, and no firmware update exists for either model. That leaves containment, not patching, as the only real option for a defender running this hardware today.
Seven Steps to Contain an Exposed Refrigeration Controller
The order below starts with what is reachable from the internet right now, because that is the open door both the French and the Belgian attackers used. Credential and network work follow, since they close the same door for good, and a backup alarm covers the fact that this hardware itself cannot be patched.
- Find every Danfoss, Copeland or Dixell controllerList every AK-SM, AK-SC, Copeland xweb or Dixell xweb unit on your network, with its exact model and firmware version. CERT-FR’s alert and Danfoss’s statement to AFP both point to the AK-SM 800 and the AK-SC 355 as the units hit in France.
- Check which interfaces face the internetTest from outside your network whether each controller’s management interface answers directly, the way an outside-in scan of your internet-facing assets would.
- Pull any exposed interface offline nowCERT-FR’s instruction for the French incident was to remove internet exposure at once and reconnect only through a secure VPN or a protected network. Treat any controller you find exposed the same way, before anything else on this list.
- Check for default or weak passwordsLog in to each controller with its current credentials and change any default, shared or weak password. Both attacks reached the controller remotely, not through a code flaw, so a weak password is itself an open door.
- Segment the refrigeration network from general ITPut refrigeration and building-management controllers on their own network segment, behind a firewall, apart from office systems and point-of-sale terminals. This keeps one compromised controller inside one store, not a whole chain.
- Add a temperature alarm outside the controllerSince neither the AK-SM 800 nor the AK-SC 355 gets a security fix, add a physical or independent sensor that alerts staff directly. A future attempt is then caught by temperature, not only by the controller’s own dashboard.
- Watch for CERT-FR and Danfoss updatesIf you operate in France or run either affected model anywhere, check CERT-FR’s alert page and Danfoss’s own advisories for changes. CERT-FR has already updated its October alert twice: once on 13 October to add more targeted equipment, and again on 16 October to update its recommendations.
Step 3 restates CERT-FR’s own instruction for the French incident. The rest, the credential check, the network segment, the backup alarm and watching for updates, is our advice, not an instruction from Danfoss or CERT-FR.
Our External Attack Surface Management service runs this outside-in check for you. It finds internet-facing assets the way an attacker would, including a refrigeration controller a store forgot was reachable.
Where the Open Door Sits in a Refrigeration Network
- InternetThe management interface sat open online in both incidents; CERT-FR names this as the entry point.Who closes itDanfoss, but not for these two modelsWhere the open door sits
- VPN or firewallCERT-FR’s own fix: require a secure VPN or a protected network before any outside connection reaches the controller.Who closes itThe store or chain’s own IT team
- Refrigeration network segmentKept apart from office and point-of-sale systems, so one compromised controller cannot reach the rest of a site.Who closes itThe store or chain’s own IT team
- Controller firmwareBoth models are end of life; the newer AK-SM 8xxA series gets separate Danfoss firmware releases.Who closes itDanfoss, but not for the AK-SM 800 or AK-SC 355
A refrigeration controller is not the asset most security teams watch first, but food retail counts as critical infrastructure in several of the countries hit this week. An end-of-life device with no CVE record is exactly the kind of asset a vulnerability intelligence program should flag before an attacker finds it first.