Supermarket freezers hacked in a second European wave as governments split on who is behind it

Supermarket fridges and freezers in at least five European countries were switched into heating mode overnight into Monday, November 2, 2026. Stores in Sweden, Belgium, Luxembourg, Ireland and Estonia threw out chilled and frozen food. By Tuesday, reports had reached Germany, Italy, Portugal, the Netherlands and Finland. The method matched the attack on roughly 700 French supermarkets three weeks earlier. No group has claimed either wave. No ransom demand has been reported. Investigators in several capitals say they do not yet know who did it.

The politics is moving faster than the forensics. The European Commission calls the incidents "a deliberate attempt to disrupt" the food chain. Washington is asking whether freezer failures at US military commissaries in August were the first sign. Yet France's cyber agency, a Romanian cyber chief and several researchers say the attackers used basic weaknesses, not advanced tools, and that there is no evidence yet of a state behind them.

What happened on November 2

Alarms started in the early hours. A Delhaize store manager in Brussels told RTBF he was woken by alarms on his phone around 3:00 a.m., the same time a Belgian butchery chain's alerts fired (RTBF). In Sweden, store owners found freezers reading 50°C or more on Monday morning (SVT). In Estonia, a Selver store's freezer was set to 50°C but was caught within about ten minutes, and no stock was lost (ERR).

The companies' own statements, gathered by the Associated Press, TT, Belga, RTÉ and ERR, give the clearest picture.

The counts are the companies' own and were still moving on Tuesday. Edeka confirmed one hacked store in Germany, Mosqueteiros seven Intermarché stores in Portugal, and a Coop group in Sicily at least four (The Hacker News). A Danfoss spokesperson told Dutch broadcaster NOS that at least 17 Dutch businesses, mainly butchers and small grocers, were hit (NL Times). Axfood said a delivery warehouse near Gothenburg discarded food worth about SEK 3 million (SVT).

How the attack works

Every account from France, Belgium, Sweden and Estonia describes the same mechanism. Store refrigeration is run by a supervisory controller, often made by the Danish firm Danfoss, that maintenance contractors reach over the internet. The attackers logged in and switched the evaporators into a long defrost cycle, or set the target temperature to 50°C. Stephan Moelans, head of the Belgian installer Sabcobel, which looks after Delhaize's systems, told Belga the units "were switched to defrost mode." He said a software update alone is not enough, because physical changes to the installations are needed (Euronews).

Danfoss says the problem lies with old or unpatched equipment. In October it named the AK-SM 800, out of support since May 2021, and the AK-SC 355, phased out in 2016, as the units most affected. It said it had "long advised customers to keep supported systems updated with the latest firmware" (AP via KSAT). On Monday a Danfoss spokesperson told NOS the Dutch systems hit were not on a secure network and "were still using default passwords" (NL Times). Danfoss advisory DSA-2025-03-01, dated March 24, 2025, covers an authentication flaw (CVE-2025-41450) in the newer AK-SM 8xxA series, fixed in version 4.2 (Danfoss). The US agency CISA republished it on May 20, 2025, with a CVSS v3.1 score of 8.2 and advice to keep such devices off the internet (CISA).

Whether that flaw was even needed is disputed. ANSSI director Vincent Strubel told a French Senate committee on October 21 that "défauts de sécurisation élémentaires" (basic security failures) enabled the French attack. Equipment was exposed directly to the internet and run without special protection, he said, and he set aside outside analyses that blamed the published vulnerabilities (Public Sénat). British researcher Kevin Beaumont wrote on October 12 that on several thousand internet-facing Danfoss units "The username is admin and the password changes every day automatically to.. the current date," and that changing the temperature was "easily scriptable" (Mastodon post). That is one researcher's account; 567politics has not tested it.

The exposure can be measured. Forescout queried Shodan on October 22 and found 12,976 refrigeration-control services on 6,017 public IP addresses in 99 countries. Of those, 4,697 were Danfoss StoreView interfaces, and 80 percent of them ran firmware older than the patched 4.3.1 release (Forescout). Censys tracked what happened in France after the first attack.

0

500

1,000

1,500

2,000

Oct 111,825

Oct 121,781

Oct 14537

Oct 11Oct 12Oct 14

Source: Infosecurity Magazine, citing Censys

Show the numbers

Date	Exposed hosts
Oct 11	1,825
Oct 12	1,781
Oct 14	537

France went from 1,825 exposed hosts to 537 in three days, a 71 percent drop. Exposure outside France fell far less over the same period, from 1,166 to 966 (Infosecurity Magazine). That gap helps explain why the second wave landed outside France.

The French precedent

The first wave hit on the night of October 11–12. CERT-FR, the response arm of ANSSI, published alert CERTFR-2026-ALE-012 on October 12. It said it was "aware of numerous compromises" of remote refrigeration controllers, and later added Copeland and Dixell XWEB devices to the Danfoss AK-SC and AK-SM series (CERT-FR). Finance Minister Roland Lescure told Parliament on October 13 that about 700 of France's 10,000 supermarkets were affected and called it "a wake-up call for everyone" (AP via KSAT). Les Mousquetaires put Intermarché and Netto's share at about 300 stores; Coopérative U said 80 of its 2,000; Carrefour said 80 franchised stores (The Hacker News). Lescure is the same minister now steering a contested 2027 budget, which 567politics covered in its report on the postponed revenue vote.

The Paris prosecutor's cybercrime section opened an inquiry, assigned to the anti-cybercrime office OFAC, covering spoiled food and equipment that began to catch fire (The Hacker News). Thierry Cotillard of Les Mousquetaires told BFMTV he expected losses in the tens of millions of euros nationwide. No official total has been published. 567politics found no report of an arrest in France as of November 3.

1. 2025-03-24Danfoss publishes advisory DSA-2025-03-01 for the AK-SM 8xxA authentication flaw
2. 2025-05-20CISA republishes the flaw as an industrial-control advisory
3. 2026-08-26Fort Huachuca, Arizona, says a commissary freezer "went into defrost mode"
4. 2026-10-12Overnight attack on about 700 French supermarkets; CERT-FR issues alert
5. 2026-10-13Lescure tells Parliament about 700 of 10,000 supermarkets were hit
6. 2026-10-21ANSSI chief Strubel tells senators "basic security failures" enabled the attack
7. 2026-10-29Reuters reports the Pentagon treats August freezer failures as a suspected hack
8. 2026-11-02Second wave hits Sweden, Belgium, Luxembourg, Ireland, Estonia and the Netherlands
9. 2026-11-03Reports from Germany, Italy, Portugal and Romania; Commission says "not isolated incidents"

Source: CERT-FR, Reuters via CP24, Euronews

How governments are responding

Sweden. Minister for Civil Defense Carl-Oskar Bohlin said the events "once again show how important it is for all organizations to review their cybersecurity and IT systems." He added that "the worsened security situation and rapid technological development mean everyone must act quickly" (SVT). John Billow, head of Sweden's National Cybersecurity Center, told Reuters the center was handling several incidents and that "we have quite a lot of exposed operational technology devices in Sweden" (Al Jazeera/Reuters). Police in southern Sweden are coordinating a national investigation. In April, the same two men disclosed that an actor "with ties to Russian intelligence and security services" had tried to disrupt a Swedish heating plant in 2025 (Euronews). Bohlin now speaks for a government in limbo: the Riksdag rejected a new prime minister on Tuesday, leaving Ulf Kristersson's cabinet in caretaker mode.

Belgium and Luxembourg. Interior Minister Bernard Quintin said there was "aucun problème général d'approvisionnement" (no general supply problem) (RTBF). The federal prosecutor opened a criminal investigation. Katrien Eggers of the Center for Cybersecurity Belgium told Euronews: "There are no reports yet as to who was behind the attack... and it may never be possible to identify them" (Euronews). The response falls to a federal government whose prime minister offered its resignation over the budget days earlier. In Luxembourg, Delhaize said four stores were hit; no government statement had been published by Tuesday (Paperjam).

Ireland. Justice Minister Jim O'Callaghan was briefed and the National Cyber Security Center monitored the incident (RTÉ). Taoiseach Micheál Martin said on Tuesday: "There are ongoing attacks almost on a weekly, daily basis from hacktivists," and that "it is becoming far more concerning and even more dangerous than ever before" (Irish Times). He named no state. He spoke on his way into the Cabinet meeting at which he was pressing his island-futures study.

Estonia. Mai Kraft, head of the cyber security center at the Information System Authority (RIA), told ERR that "what the motives of these attacks are is unknown at the moment." RIA had received one notification, from Selver, and had found fewer than ten exposed refrigeration controllers in Estonia, against more than 30,000 vulnerable internet-connected devices of all kinds (ERR).

European Union. Agriculture Commissioner Christophe Hansen said: "These are a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it," while stressing that "food security is not currently at risk" (The Next Web; Eunews). Commission spokesperson Thomas Regnier said on Tuesday, "These are not isolated incidents" (Euronews). ENISA said the attacks underscored "the importance of European cooperation, rapid information-sharing and coordinated responses to cyber incidents" (Reuters via Investing.com). 567politics found no Europol statement by Tuesday evening. Italy's ministers met intelligence chiefs on Tuesday and called the domestic impact "highly limited" (Euronews). The incidents land as EU leaders head into a summit where Kaja Kallas has been urging a "step by step" path to closer security ties.

United Kingdom. Richard Horne, head of the UK's National Cyber Security Center, said attackers had also tried small meat-processing firms and that "We're obviously on heightened alert" (Reuters via Investing.com).

The attribution debate

The gap between what officials suspect and what they can show is wide, and most say so.

The case for a state-linked campaign rests on context, not evidence from these incidents. Reuters notes that European governments have blamed Moscow for a growing list of infrastructure incidents, and that Russia has repeatedly denied involvement in sabotage or hybrid warfare (Al Jazeera/Reuters). SentinelOne's Tom Hegel wrote on Tuesday that "Russian-aligned groups are credible suspects, but attribution remains open." He cited the record of groups such as CARR and Z-Pentest against exposed industrial controls, but stated that "Responsibility for the European incidents has not been publicly established" and listed copycats, ideological operators and financially motivated intruders as alternatives (SentinelOne). Germany's spyware warning to Bundestag members last week, covered here, shows how quickly European governments now reach for a hostile-state frame, and how rarely they publish the evidence.

The case against naming a state comes mostly from the technical agencies. Dan Cimpean of Romania's National Cyber Security Directorate called the attack "semi-amateurish" and said there was no suspicion of a state actor (Euronews). Strubel's testimony points the same way. Ken Munro of Pen Test Partners suggested in October the culprits could be "kids messing around," given how easy the exploit was (coverage summarized on Wikipedia). Awais Rashid of the University of Bristol said the likely motive is disruption with "societal impacts in terms of security of the food supply chain," without naming an actor (Al Jazeera).

Both camps lean on pattern. "Russia has done this before, so Russia did this" is an inference, not a finding. So is "the method was crude, so it was not a state." Both are premises waiting for evidence.

The US angle

Reuters reported on October 29, citing four officials, that the Pentagon is treating freezer failures at US military bases in August as a suspected hack. At least six commissaries were affected. Fort Huachuca in Arizona wrote on Facebook on August 26 that a freezer "went into defrost mode where it heated up all the food. Trust us when we say it was 'spoiled.'" A Cyber Command unit said it was "working in close coordination with interagency and law enforcement partners," and the Army's Criminal Investigation Division said its cyber field office was working with French police (Reuters via CP24). Reuters could not confirm which controller brand the bases used. 567politics found no CISA advisory specific to the October or November incidents; the May 2025 Danfoss advisory remains its latest published guidance on these devices.

Does food retail count as critical infrastructure?

Under EU law, mostly not yet. The NIS2 Directive, which member states had to transpose by October 17, 2024, lists "production, processing and distribution of food" among its "other critical sectors." But it limits that to food businesses engaged in wholesale distribution and industrial production and processing, and applies in general to firms with at least 50 staff or more than €10 million in turnover (European Commission; Finnish Food Authority). Finland's official guidance states that retail trade is outside the scope. An independent franchise supermarket, the kind hit hardest in Sweden and France, is usually not an NIS2 entity at all.

The Critical Entities Resilience Directive uses the same food definition. It applied from October 18, 2024, and required each member state to identify its critical entities by July 17, 2026 (EUR-Lex). 567politics could not establish whether any member state has designated a grocery retailer under it.

The Cyber Resilience Act reaches the devices rather than the stores. It entered into force on December 10, 2024. Its vulnerability-reporting duties for manufacturers applied from September 11, 2026, and its main obligations apply from December 11, 2027 (European Commission). It does not reach back to a controller sold in 2015 and left online with its default password.

What people are saying online, and the limits

567politics set out to quote verified public posts from officials, researchers, retail workers and shoppers in the affected countries. Searches on November 3 found candidate posts on X from news aggregators and individual users in Sweden, Germany and elsewhere. But the tool we use to confirm a post's exact wording and timestamp failed for every post attempted, and X's pages could not be opened directly. We therefore quote no X posts here. Reddit was not accessible to us this run. The one social post we could verify is Kevin Beaumont's October 12 Mastodon post quoted above, retrieved from its original server. We found no representative poll on these incidents. Nothing in this article should be read as a measure of public opinion in any country.

What remains unknown

• Who did it. No claim, no ransom note and no arrests have been reported in any country as of Tuesday evening.
• Whether the November wave used the same entry path as France. SentinelOne notes that the French assessment pointed to exposed interfaces and weak passwords, and that it is not yet known whether this applies to the November incidents or the US commissaries (SentinelOne).
• Whether a shared maintenance contractor was the common link anywhere. Sabcobel said about 20 of the hundreds of units it manages were hit (Euronews); no compromised provider has been confirmed.
• The total loss. France has a trade estimate; Sweden has one warehouse figure; Belgium has no total.
• Whether the US commissary failures are connected at all, and what controllers they ran.
• Whether regulators will move retail refrigeration into the NIS2 or CER scope, and who would pay to replace end-of-life controllers in independent stores.

What is established is narrower. Thousands of refrigeration controllers were reachable from the public internet with weak or default credentials, vendors and agencies had warned about it for more than a year, and someone has now used that twice in three weeks.

Differing perspectives

How should European governments respond to the supermarket refrigeration cyberattacks?

Each position is summarized as its supporters make it, with equal weight and in alphabetical order. A summary is not an endorsement; the evidence for each is weighed in the story above.

• Fix basic hygiene: patch, disconnect and replace end-of-life controllers

  Who holds it: Danfoss, refrigeration installers such as Sabcobel, and national CERTs including CERT-FR

  Vendors and installers argue the incidents exploited devices that were out of support, unpatched, directly reachable from the internet or still using default passwords, and that customers who followed earlier advice were largely spared. They say the remedy is known and proportionate: remove internet exposure, restore remote access only through a VPN or protected network, update firmware where it exists and migrate legacy units to supported ones. Most stores acted after the French attack; those that did not are now bearing the consequences. New rules are less urgent than applying existing guidance.

  In their words: NL Times, reporting the Danfoss spokesperson's statement ↗

• Keep it proportionate: likely low-skill opportunists, not warfare

  Who holds it: ANSSI director Vincent Strubel, Romania's cyber directorate head Dan Cimpean and researchers such as Ken Munro

  Technical agencies and some researchers argue the attack required no sophistication: exposed administration interfaces and weak or date-based passwords let anyone log in and change a setpoint. Strubel told French senators that "basic security failures" enabled it and set aside analyses blaming published vulnerabilities; Cimpean called the November wave "semi-amateurish" with no suspicion of a state actor. On this reading, governments should resist framing the incidents as hybrid war before evidence exists, treat them as crime to be investigated by prosecutors, and focus on the easy exposure that made them possible.

  In their words: Public Sénat, reporting ANSSI director Strubel's Senate testimony ↗

• Pursue attribution, with Russian-aligned groups as credible suspects

  Who holds it: Threat-intelligence analysts such as SentinelOne's Tom Hegel; officials in Sweden and elsewhere who have previously linked industrial-control attacks to Russian services

  This view argues that groups aligned with Russia have a documented record of tampering with exposed industrial controls in Europe and North America, so they are credible suspects and governments should invest in establishing responsibility through access records, infrastructure provenance and validated account activity. Its proponents say the "hacktivist" label is not a reliable guide to capability or independence, that attribution remains open and should be stated as such, and that a shared controller model alone is not evidence. They want forensic work and public findings, not assumptions in either direction.

  In their words: SentinelOne SentinelLABS ↗

• Regulate operators of connected industrial equipment, including retail

  Who holds it: Industrial-security researchers such as Forescout and academics such as Awais Rashid; some national ministers calling for all organizations to review OT security

  This position argues that internet-based remote maintenance was an anticipated deployment option in manufacturer documentation, so exposure is a system design problem rather than an accident, and that nearly 13,000 refrigeration-control services were reachable online across 99 countries. Operators, it says, need explicit ownership of remote access, validated permissions and auditable changes, and remotely managed systems should run only over secure networks. Because food retail sits largely outside NIS2 and the CER Directive, proponents want rules or guidance that reach the stores and contractors who actually run these devices.

  In their words: Forescout Research, Vedere Labs ↗

• Treat it as a deliberate attack on the food chain and respond at EU level

  Who holds it: European Commission (Agriculture Commissioner Christophe Hansen, spokesperson Thomas Regnier) and ENISA

  The Commission argues the repeated attacks are "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it," and that incidents across many member states are "not isolated." It says the EU has tools to manage such incidents, that its Security College should review retailers' backup arrangements and response speed, and that European cooperation, rapid information-sharing and coordinated responses are the right frame. Food security, it says, is not at risk today, but food waste and business losses are real and warrant a collective answer rather than store-by-store fixes.

  In their words: Eunews, reporting Commissioner Hansen's statement ↗