Hackers heated supermarket freezers to 50°C across Europe. The way in was a control box on the internet.

01 What happened

Intermarché and Netto counted 300 stores. Cooperative U counted 80, Carrefour about 80, Monoprix about 5% of its 490. Several stores reported fires as equipment overheated. Intermarché’s chief executive put the losses at up to tens of millions of euros in a single day [ Al Jazeera ] . The Paris prosecutor’s cybercrime unit opened an investigation.

The second wave came overnight into 2 November. Ahold Delhaize and Colruyt reported dozens of stores in Belgium and Luxembourg with temperatures climbing. Sabcobel, which runs refrigeration for Delhaize and others, said the attack switched evaporators into defrost. Its technicians started at 1 a.m. and pulled units off the network [ CBS News ] . In Sweden, a store in Sjöbo posted that its units had been set to 50 degrees. Coop Sweden had problems in 6 of about 800 stores and said it had no sign of an attack. A vendor in Estonia reported one client breached.

Posts going round on LinkedIn add Ireland. We found no confirmed Irish case in the reporting we checked. Nobody has claimed either wave, and nobody has attributed them.

02 The box behind the freezer

A supermarket’s cabinets report to one store controller. A contractor manages it remotely, through a web page. In France the attackers went after Danfoss controllers, and France’s CERT-FR warned of “numerous compromises” of its AK-SM and AK-SC models [ The Register ] . Danfoss said the affected stores ran outdated firmware, mostly on older products that no longer get updates, and told customers to put them behind a firewall [ AP ] .

The weaknesses were public. Claroty’s Team82 had shown that the AK-SM 800A accepted a hidden administrator “code of the day” worked out from the device’s date, whatever password the store had set (CVE-2025-41450). A second flaw let a logged-in user run commands on the box. Claroty counted 2,765 of the web interfaces online [ Claroty Team82 ] . Danfoss had shipped fixes in firmware R4.3.1.

03 The same box in your building

You may not sell frozen food. You still have a building management system. A contractor installed it, opened remote access so they could fix it without a visit, and has not touched the firmware since. It runs the heating, the server-room cooling, the door locks or the lab freezers. It rarely shows up on the IT asset list, so nobody patches it and nobody watches it.

The supermarkets learned which boxes they had at 1 a.m., from the alarms. You can learn it this week from a test. We find the controllers that answer, show you what an attacker could change, and hand you the fix list. Enterprise-grade. Not enterprise-priced.