On this page (8 sections)
In the early hours of Monday, November 2, 2026, refrigeration units in supermarkets across several European countries were reportedly manipulated remotely, spoiling stock. It is the second such wave in about three weeks, after a large attack on French shops in early October, according to Help Net Security and The Record.
This is not a website flaw, but it matters to site owners, agencies and hosting administrators because the root cause is a familiar one: management interfaces reachable from the open internet on devices that no longer get patches. The lessons apply to any web-managed device you run.
At a glance
What happened
Belgian news agency Belga reported that fridges and freezers at Delhaize, Carrefour and Spar, among others, were affected, with evaporators remotely switched to defrost mode. Delhaize stores in Luxembourg were also hit. In Sweden, Coop and Ica were affected, with freezer temperatures reportedly turned up to 50 degrees Celsius, per Help Net Security.
The scale reported so far differs by source and is still changing. The Record says more than 50 shops were identified in Belgium and over a dozen others in Ireland, Estonia, the Netherlands and Luxembourg, with a limited number of smaller stores in Sweden. Help Net Security added an update citing the BBC that Finland was also affected. For comparison, the Paris prosecutor's office told The Record there were around 700 victims in October.
Colruyt and Intermarche confirmed "technical problems" at some stores but did not say whether a cyberattack was the cause. An Ica spokesperson said the affected Swedish stores were ones that "have their connection outside Ica's central network".
What is known about the cause
No vendor advisory or original disclosure was found, so the technical picture rests on reporting. According to Help Net Security, France's ANSSI said the October attack targeted refrigeration control systems from Danfoss, Copeland and Dixell and was made possible by remotely exploitable vulnerabilities in internet-exposed management interfaces. The specific vulnerabilities have not been identified in the sources.
Security researcher Kevin Beaumont said he confirmed with others that the freezers affected this time were also management-interface facing the internet, with the same issue as before, and that many are end of life with no patch available. This is one researcher's account relayed by one outlet, not an independent vendor confirmation.
Sabcobel's CEO told Belga that most of its customers moved to managing fridges over a secure internet connection after the French attack, and that a thorough fix needs a software update plus physical modification of the units. Danfoss and Copeland said after the French attack that the affected devices were mainly discontinued products without security updates, per The Record.
What is not known
- Who is behind the attacks. The Centre for Cybersecurity Belgium said it may never be possible to identify them, and no group has claimed responsibility.
- Whether the October and November attacks were carried out by the same perpetrators.
- Whether AI was used. A CCB spokesperson said the agency did not yet know, while noting a rise in vulnerabilities where AI was used to find and exploit them.
Who is realistically exposed
The direct victims are retailers and refrigeration installers, but the pattern reaches further. Agencies and hosts often look after small shops, restaurants, offices or warehouses with devices that have a web admin page: building controllers, cameras, routers, cold-chain monitors, point-of-sale peripherals. If any of these is reachable from the internet and runs old firmware, it is the same class of risk.
The Record also notes that Danfoss said earlier attacks on its controllers, including 40 stores hacked in Israel, involved sites lacking adequate firewall or VPN protection. Stores whose connection sat outside a central managed network, as in the Ica example, appear to have been the weak points.
How to check your own exposure
You cannot patch your way out of an end-of-life device, so the first job is to find out what is reachable and what is unsupported. Start with an inventory, then test from outside your network.
- List every device with a web or remote management interface at each site, including those installed by third-party contractors.
- Record the vendor, model, firmware version and whether the vendor still supports it.
- From a network outside your own (for example a mobile hotspot), check whether any management page loads on your public IP addresses.
- Ask installers and suppliers how each device is remotely managed and whether it goes through a VPN or other secure connection.
- Check router and firewall rules for port forwards pointing at device admin pages.
For websites and servers you operate, a read-only external scan can show which services are visible from the internet. Webforta Scan covers sites you verify, though it does not test refrigeration or other OT equipment.
What to do now
0 of 8 done
Detection and monitoring
Watch for changes you did not make: setpoints, defrost schedules, new remote users, and unexpected inbound connections to management ports in firewall logs. Keep logs from edge devices for long enough to look back over a weekend, since this attack reportedly began around midnight on a Sunday.
For the web side of your estate, monitoring for certificate, DNS and header changes helps you spot unexpected exposure changes early. See Webforta Monitor and the guide on uptime monitoring. For a broader baseline, the small business website security guide is a reasonable starting point.
Regulatory context
The Record notes that the EU's Cyber Resilience Act will impose stricter requirements from December 2027, when manufacturers must provide a support period reflecting a product's expected lifetime. Until then there are no legal obligations on manufacturers to fix products targeted by such attacks. The same report says Danfoss announced a "hard End of Service" policy for legacy products in an October newsletter last year, citing European cybersecurity legislation. Buyers should treat vendor support dates as a security requirement when purchasing.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.