Supermarkets under attack in Europe: hacked refrigeration

In Sjöbo, Sweden, an ICA Kvantum supermarket reported that someone had set its fridges and freezers to 50 °C. Staff had to throw away the affected products. It is one of the incidents reported by Associated Press on 2 November 2026, alongside refrigeration problems reported in Belgium, Luxembourg, Ireland and Estonia. Carrefour said 15 stores were affected in Belgium; Musgrave, 13 SuperValu stores in Ireland.

This is one shape a cyberattack can take: the company website keeps working, maybe the tills do too, but the system that keeps the stock cold receives the wrong commands. For someone running a shop, the damage is counted in products pulled from the shelves, lost work, and whether you can reopen safely.

The situation described here is current as of 2 November 2026. There have been incidents in several European countries; talking about a single new vulnerability hitting the whole of Europe goes beyond what has been established. To understand the risk, you have to separate the reporting on the attacks from the technical flaws that are already documented.

What we know about the attacks on supermarket refrigeration

The important technical precedent dates back to October. CERT-FR, the French government's incident response centre, published an alert on 12 October, updated on the 16th: it documents numerous compromises of remote refrigeration controllers from Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb.

So the alert covers several families of equipment. It does not point to a single CVE as the explanation for every incident. A flaw existing in a product and proof that the flaw was exploited in a given shop are two different pieces of information. The same caution applies when linking the October incidents to the November ones.

For a business, this also changes how to respond: hunting only for the name of a vulnerability risks losing sight of an old remote panel that is still reachable, a maintenance contractor's access left open, or a device that is no longer supported.

How a web panel can control a physical installation

In its research on Danfoss AK-SM 800A controllers, Claroty Team82 describes a console that centralises temperatures, schedules, alarms and maintenance. A technician can work from a browser without travelling to each store. The problem starts when that interface is exposed directly to the internet and has exploitable vulnerabilities.

The researchers found 2,765 devices exposed via Censys: that is a measure of the reachable attack surface at the time of the research, not the number of supermarkets attacked. They also analysed an alternative authentication mechanism based on a daily code, a command injection, and the ability to alter the web server configuration.

These systems belong to operational technology, or OT: the software interacts with equipment that does physical work. A flaw in the panel can therefore affect how the installation is run. What kind of consequences follow depends on the functions that can be reached and on the protections actually in place; a device merely being on the network does not prove it has been compromised.

The documented Danfoss vulnerabilities had already been fixed

The vendor's advisories let you check models and versions without relying on a news headline. For the AK-SM 8xxA series, Danfoss published these bulletins in 2025:

CVE	Documented issue	Fixed in
CVE-2025-41450	Authentication flaw, with access to sensitive information	4.2
CVE-2025-41451	Command execution after authentication	4.3.1
CVE-2025-41452	Tampering with the web configuration after authentication, possible denial of service	4.3.1

Affected are the versions of the series listed in the advisories that predate the respective fixed release.

The first entry comes from DSA-2025-03-01, published on 24 March 2025. The other two from DSA-2025-08-01, published on 1 August 2025. The last two require authentication: describing them on their own as unauthenticated code execution would be inaccurate.

The versions in the table are the ones that introduce the fixes from those bulletins. They are not an invitation to install old firmware today: you need to check the currently recommended release for the exact model and its compatibility with the installation. These CVEs document real risks, but they do not amount to a technical attribution of the 2 November attacks.

What to check with your refrigeration contractor

The first check is very concrete: knowing who can reach the management console. CERT-FR recommends removing public exposure and restoring access through a secure VPN or a protected network. It also asks operators to review the configuration, including defrost intervals. A factory reset on its own leaves an unpatched device vulnerable if it is exposed again.

Danfoss's security recommendations likewise stress segmented networks, firewalls, controlled remote access, updates and replacing default passwords. Giving the technician convenient access and leaving the panel open to anyone are very different choices.

To prepare for the conversation, ask your maintenance contractor and whoever is responsible for the network to work out four things together:

Inventory: exact controller model, installed firmware, support status and who is responsible for updates.
Access: the path used for remote support, authorised accounts and services reachable from outside.
Continuity: a verified copy of the configurations, recovery procedure and the person who can step in out of hours.
Alarms: who receives the alerts, a check that they actually work, and independent temperature monitoring in line with the business's procedures.

This is work to coordinate with whoever maintains the installation. Cutting a connection blindly can also interrupt the monitoring that the service contract provides for. If temperatures are abnormal, the priority is to get the technical lead involved and follow the company's food safety procedures; looking for the IT cause has to go hand in hand with managing the emergency.

Why this matters for shops and businesses in Ticino too

The lesson for a Swiss business is about access and responsibilities. Whoever manages the website often doesn't manage the router, whoever maintains the router may not know about the refrigeration controller, and the refrigeration technician may be using a connection set up years ago. If nobody keeps a shared map, it becomes hard even to know who should check an urgent alert.

It is the same organisational problem we run into with maintaining PHP and Node.js runtimes: knowing a patch exists is of little use if you don't know which version is actually running and who can replace it. With operational installations, there are also continuity constraints and specialist skills to respect.

A network check before the next emergency

At Webcracy we can help you map out access to your systems and assess your network's exposure as part of an authorised security assessment, working with your IT provider and, for the installations, with the maintenance contractor in charge. The starting point is having names, versions and responsibilities you can verify, so that an alert turns into a precise request to someone who can act on it.

Let's check access to your systems

Illustrative photo: Haberdoedas on Unsplash, used under the Unsplash License. The supermarket pictured has not been named as involved in the attacks.