The supermarket fridge hack is back. Your building systems could be next.

The supermarket fridge hack has happened again. Overnight on Sunday into Monday, attackers took remote control of refrigeration systems in supermarkets across Belgium, Luxembourg, Sweden, Ireland, Estonia and the Netherlands, and turned fridges and freezers up to around 50°C. Staff arrived to warm freezers and stock that had to be thrown away.

It’s the second wave in three weeks, and the way in looks the same both times. That’s why it’s worth a few minutes of your time even if you’ve never sold a frozen pea in your life.

The first wave, in France

On the night of 11 October, attackers reached the controllers that run all the fridges and freezers in a store and switched them into defrost. The Paris prosecutor’s office has since put the number of victims at around 700. Intermarché, Carrefour, Coopérative U and E.Leclerc all confirmed stores were hit, and the boss of Intermarché’s owner told French TV he expected losses in the tens of millions of euros.

France’s cyber security agency, ANSSI, linked the attacks to refrigeration controllers made by Danfoss, and later to Copeland and Dixell equipment too. Its advice was blunt: take these controllers off the internet, or tightly restrict who can reach them.

The second wave, across Europe

According to The Record and Help Net Security:

• More than 50 stores were affected in Belgium, including Delhaize, Carrefour and Spar shops.
• Delhaize stores were also hit in Luxembourg, and Coop and Ica stores in Sweden.
• Stores in Ireland, Estonia and the Netherlands were affected, with the BBC also reporting Finland.
• Freezers were again set remotely to 50°C, and staff couldn’t change them back.

Nobody has claimed either wave, and nobody knows if it’s the same group. Belgium’s national cyber security centre said it may never be possible to identify them. At the time of writing, no UK supermarkets have reported being hit.

How it happened

This wasn’t a clever break-in through the head office network. In the words of security researcher Kevin Beaumont, the affected systems all had their management screens facing the internet, and many were “end of life and have no patch available, they’ve just been left online to quite literally rot”.

Danfoss has said most of the units hit in France were older models it no longer updates. One of them was declared end of life in 2021, the other phased out in 2016. Some newer controllers were hit too, and those were running out-of-date software.

Two details stand out. Ica said the stores affected were ones that “have their connection outside Ica’s central network”, in other words set up separately from the IT the company manages. And in Belgium, the installer Sabcobel said some units needed physical changes, not just a software update, to be fixed properly.

Why this matters if you don’t run a supermarket

Swap “fridge controller” for the box that runs your heating, your CCTV recorder, your door entry system, your alarm panel or your cold room, and it’s the same story. Somebody installed it years ago. They set it up so they could log in remotely and fix things without driving out. It works, so nobody has touched it since.

That kit usually isn’t on anyone’s IT list. It’s managed by a contractor, it doesn’t get updates and it often still has the password it shipped with. Cameras were already the favourite target in record attack attempts on UK businesses this year. The fridge hack just shows what happens when someone finally uses that access.

What to do this week

1. List the things that aren’t computers. Heating and air conditioning controls, CCTV, door entry, alarms, fridges and freezers, EV chargers, anything with a screen or an app. Note who installed each one and who looks after it.
2. Ask each contractor four questions. Can it be reached from the internet? How do you log in remotely? Does it still get security updates? Has the default password been changed? If they’re not sure, that’s your answer.
3. Take management screens off the open internet. Remote access should go through a VPN or the maker’s secure remote service, limited to known addresses, never a login page anyone can find.
4. Replace or isolate anything that’s out of support. If the maker no longer updates it, plan to replace it. Until then, keep it away from your office network and off the internet.
5. Make sure a human finds out fast. A temperature or fault alarm that texts a real person is what saved stock in many French stores. Know what you’d switch to manually if a system misbehaved.

My step-by-step guide to securing CCTV and smart devices in your business walks through each of these, with the questions to ask your installer.

These are the same two habits Cyber Essentials checks for on your computers: nothing unsupported, and nothing exposed to the internet without a good reason. Applying them to your building kit too is a sensible next step. If you want a quick sense of where your business stands, try the free Cyber Essentials readiness check.

If something has already been tampered with

If a system is behaving oddly or settings have changed on their own, disconnect it from the internet first and call the installer, then check whether anything else on the same connection has been touched. If you think your wider network has been reached, treat it as a cyber incident and get help quickly.

Sources

• The Record: Second wave of suspected cyberattacks hits supermarket freezers across Europe (2 November 2026)
• Help Net Security: Second wave of refrigeration cyberattacks hits European supermarkets (2 November 2026)
• The Hacker News: Attackers heat French supermarket fridges up to 50°C by hijacking Danfoss controllers (October 2026)