Over 100 European Stores Hit as Supermarket Fridge Attacks Return

What it is

A second wave of refrigeration attacks hit more than 100 stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden overnight on 2 to 3 November 2026. Problems were also reported in Finland, Italy and Portugal. Some units were pushed as high as 50°C (122°F). The first wave struck about 700 French supermarkets on 11 to 12 October. Nobody has claimed responsibility, and investigators have not established whether the two waves are connected.

How it works

Attackers forced the units' evaporators into defrost mode, the same technique as in France, according to Stephan Moelans, CEO of Belgian refrigeration firm Sabcobel. Officials have not said how the attackers got in. Security researcher Kevin Beaumont reports that every freezer hit on Monday had a management interface reachable from the internet.

Lupovis recorded suspicious activity against its Danfoss AK-SM sensors from 20 to 30 October, peaking on 26 October, and had not seen it before 20 October. Most attempts used factory-default credentials that Danfoss documents publicly. Others looked like fingerprinting of specific controller components. All attempts against the sensors were rejected.

Preconditions / Affected

• Danfoss AK-SM and AK-SC controllers, mostly legacy products Danfoss no longer updates.
• CERT-FR widened its alert a day after the first one to cover Copeland and Dixell XWEB systems.
• A management interface reachable from the internet. Beaumont says many devices are end-of-life with no patch available.
• Censys counts just over 1,000 internet-reachable Danfoss StoreView interfaces. Exposed French instances fell from 1,825 before the October attacks to 220.

Censys estimates patch status by matching firmware build dates. Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia.

What to do

Danfoss told customers on 13 October to cut their systems' internet connections and reconnect only through a secure network. A Danfoss spokesperson said most stores did so and a small number did not. The page gives no other mitigation steps, commands or patch versions.

Caveats

• Moelans says a software update does not fully fix the weakness. The affected equipment also needs physical modification. The page does not say what the modification is.
• Censys did not say whether any patched devices were among those compromised on Monday, so patching alone is not shown to protect.
• The Lupovis timing is noted as significant but is not tied to the attacks.