The first people to find out weren’t security analysts. They were store managers who came in on Monday morning, 2 November 2026, and found puddles on the floor. One Swedish manager found freezers set to 55°C. Overnight, attackers had remotely changed temperature settings on freezers and cooling systems in more than 115 stores in six countries.
No data was stolen and no ransom note was reported. The damage was physical: food going warm in the dark. This post covers what happened, why this kind of equipment is easy to miss, and a checklist for watching the operational technology (OT) and IoT devices that most security teams never look at.
The night the freezers turned warm
Overnight into Monday, attackers shut down refrigerators or switched on defrost systems. Temperatures rose, stock was lost, and managers had to step in early in the morning.
Some details from the reporting:
- An ICA store manager told TV4 that settings had been changed to +50°C (122°F) and could not be modified, so the frozen food had to go.
- Coop said problems ranged from fully shut-down units to partly working ones, and in one case the system started to generate heat.
- A Proxy Delhaize manager near Brussels called it “catastrophic”. His store threw out all of its fresh and frozen products.
- Some stores used refrigerated trucks to try to save stock, according to RTL.
How wide it spread
Several chains confirmed problems to the press. The numbers below come from company statements and media reports, and some are approximate.
| Chain (country) | Stores affected | What they said |
|---|---|---|
| Ahold Delhaize (BE, LU) | Around 40 | “IT incident affecting the refrigeration systems in several dozen stores” |
| Carrefour (BE) | 15 of 700 | No hypermarkets hit, all stores open, mainly freezers |
| Intermarché (BE) | Around 15 | Confirmed |
| SuperValu (IE) | 13 | Fresh and frozen food thrown out |
| Coop (SE) | 7 of 800+ (or 6) | 7 stores, “contained”; The Register reported six |
| Spar / Colruyt (BE) | Around 5 | Run by independent operators with their own refrigeration systems |
| ICA (SE) | At least 4 | Stores “operating outside ICA’s central network” |
| Selver (EE) | 1 | Confirmed |
The two outlets give different numbers for Coop, so both are shown. In the Netherlands, at least 17 butcher shops and neighbourhood stores were hit. In Belgium, an Ikea in Mons and some chocolate shops were also affected. A reader comment on BleepingComputer mentioned stores in Germany, but that has not been confirmed.
It is unclear whether this was one coordinated campaign or separate attacks on each target. None of the companies The Register contacted said who was behind it.
The turning point: this had happened before
This was the second wave. In mid-October, chains in France including Carrefour, Coopérative U, Intermarché and Monoprix had hundreds of stores hit. Attackers compromised Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers and set them to defrost mode.
| France (mid-October) | Europe wave (2 November) | |
|---|---|---|
| Scale | Hundreds of stores | 115+ stores in six countries |
| Gear named | Danfoss AK-SM/AK-SC, Copeland/Dixell XWEB | Sabcobel-supplied systems at several sites |
| Known weakness | Outdated Danfoss firmware at some stores | Vendor says “same vulnerability” as France |
| Official alert | CERT-FR alert on Danfoss compromises | None mentioned in the sources |
| Method | Remote defrost | Remote defrost and setpoint changes |
The sources don’t fully agree on whether the method was the same. Stephan Moelans, director of the refrigeration vendor Sabcobel, told RTL that the attacker used the same vulnerability as in France. The Register says it remains unclear whether the methods match. France also wasn’t only a Danfoss problem: Coopérative U said it was not a Danfoss customer.
What matters for defenders is that there was a public warning about a month earlier. Moelans said most of his clients moved to a secure connection after France. The stores hit on 2 November were presumably among the rest.
How a setting change becomes a business loss
The attack chain is short, and that’s the problem. Nothing has to be encrypted or stolen. Someone only has to change a value that the controller is designed to accept.
The timing made it worse. Overnight, nobody is in the store to notice. Sabcobel technicians started disconnecting affected installations from 1 a.m., and Ahold Delhaize texted managers around 4 a.m. For a freezer, a few hours is enough.
Why the SOC probably never saw it
The sources don’t describe how any security operations centre (SOC) handled this. But the companies’ own wording points to a common blind spot:
- ICA said the affected stores were operating outside ICA’s central network.
- Colruyt said its Spar stores are run by independent entrepreneurs with their own refrigeration systems.
- At Delhaize, distribution centres ran normally. The core IT was fine while the store-level equipment failed.
Refrigeration controllers often belong to facilities teams, franchisees or the installer. Their logs don’t reach the security monitoring system (SIEM), and the alarms go to a technician’s phone, not a security analyst. So a security team can see every laptop and still miss the device that ruined the stock.
Patching alone won’t fix this either. Moelans said a software update is not enough because the refrigerators also need physical modifications.
A detection checklist for the gear nobody watches
The checklist below is general defensive guidance based on what these incidents show. It is not a vendor-specific fix. Start with whatever you can actually see.
| Check | Why it matters here | Where to look |
|---|---|---|
| Find every reachable controller | These were remote changes, so the controllers could be reached from outside | Asset inventory, firewall rules, your own external scan results |
| Remove direct internet access | Sabcobel calls a secure connection the simplest solution | VPN or secure remote-access gateway, network segmentation |
| Check firmware versions | Some French stores ran outdated Danfoss firmware | Vendor portals, CERT-FR and other advisories |
| Alert on setpoint and defrost changes | Changing settings and starting defrost was the whole attack | Controller event logs, sent to the SIEM if possible |
| Flag logins at odd hours or from new places | The changes happened overnight | Remote-access and VPN logs |
| Send temperature alarms to someone who is awake | Hours passed between the changes and staff finding them | Alarm routing, on-call rota |
| Plan for settings you can’t change | One manager couldn’t change the setting back | Manual override steps, isolation runbook |
A few practical habits help:
- Ask the CERT-FR question. When an advisory comes out about OT gear in your sector, check whether you run it, even if a contractor owns it.
- Write down who owns each device. For every controller, record who owns it, who can log in remotely and who gets the alarm.
- Practise the disconnect. Sabcobel’s main response was disconnecting installations. Make sure you know how to do that safely before you need to.
- Have a stock fallback. Refrigerated trucks and supply from distribution centres kept some shelves stocked.
What to learn from this
- A warning is only useful if someone acts on it. France was hit in October, CERT-FR published an alert, and a second wave followed less than a month later. Treat sector advisories about OT gear as urgent for your own estate.
- If you don’t monitor it, it isn’t secure. Systems “outside the central network” and franchisee-owned equipment can still cost your business money. Bring them into your inventory and logging, or at least your alarm routing.
- Watch for changes to settings, not just malware. These attacks reportedly just changed values like temperature setpoints and defrost mode. Alerts on those changes, especially overnight, are your best early warning.
- Remove direct internet access first. The vendor’s simplest fix was a secure connection, and patches alone weren’t enough. Network access control comes before everything else.
- Plan for physical damage. Know how to disconnect a controller, run it manually and save stock before the next night when nobody is watching.