Refrigeration Controller Hack: How to Check If Yours Is Exposed

Overnight on November 1–2, 2026, refrigeration systems at grocery stores in Belgium, Sweden, Ireland, the Netherlands and Estonia were switched into defrost mode or had their temperatures set to around 50°C (122°F), and stock spoiled before staff arrived. It is the second wave in a month: on October 11–12, hundreds of French supermarkets were hit the same way. If a contractor manages your fridges, freezers or cold room over the internet, the fix France’s national cyber agency recommends is to take the controller off the public internet, check its settings and only reconnect through a VPN.

This guide covers what was reported on November 2, which controller models have been named, how to check whether your own controller can be reached from the internet, and the CERT-FR checklist in plain English.

What happened on November 2

Reports came in from retailers and public broadcasters through Monday. Store counts differ between outlets; the table uses the figures companies gave directly.

Country	Company	Reported impact
Belgium and Luxembourg	Delhaize	About 40 stores; Delhaize calls it an “IT incident”
Belgium	Carrefour	15 of 700 stores; all stayed open
Sweden	ICA	A small number of stores operating outside ICA’s central network
Sweden	Coop	7 of more than 800 stores; Coop says the situation is contained
Ireland	Musgrave (SuperValu)	13 stores, linked to a specific refrigeration model, per RTÉ
Netherlands	Danfoss customers	17 facilities, including frozen storage and butcher shops, per NOS

The clearest technical detail comes from Belgium. The CEO of Sabcobel, the contractor that runs Delhaize’s refrigeration, told the Belga news agency that evaporators had been switched into defrost mode, and that technicians spent the night disconnecting affected installations. One ICA store in Stockholm said the change hit at 2 a.m. and staff noticed at 5:30 a.m. A Delhaize store in Hoeilaart put its spoiled stock at about €100,000.

As of November 2, nobody had claimed the attacks, no authority had named a suspect or an entry point, and no retailer had reported a ransom demand or customer data theft. Sweden’s national cybersecurity center said it was handling several incidents and that the country has many exposed operational technology devices that still need updating.

Which refrigeration controllers have been targeted

France’s CERT-FR published alert CERTFR-2026-ALE-012 on October 12, 2026, and updated it on October 13 and 16. It lists four product lines with confirmed compromises in the French wave:

• Danfoss AK-SM series
• Danfoss AK-SC series
• Copeland xweb
• Dixell xweb

For the November 2 incidents, Danfoss confirmed to Dutch broadcaster NOS that facilities using its systems were affected. Other retailers have not named brands. Do not assume a controller from another vendor is safe: the common factor in the French alert is a management interface reachable from the internet, not a single product.

A similar overnight pattern hit at least six U.S. military commissaries in August, according to Reuters, and the Pentagon is investigating. No shared attacker has been established across the three waves.

How to check if your refrigeration controller is exposed

You do not need to be technical for the first three checks. You need answers from whoever installed and maintains the system.

1. Ask your contractor how they connect. Three questions: Do you reach our controller through a VPN, a cloud portal, or a web address you type into a browser? Is the controller on a public IP address? Is our model still receiving firmware updates?
2. Look for port forwarding on your router. Sign in to your router or firewall admin page and open the port forwarding (sometimes called virtual server or NAT) section. A rule pointing to the controller’s local IP address means anyone on the internet can reach its login page. Write the rule down before changing anything so your contractor can see what was there.
3. Test from outside your network. Turn off Wi-Fi on your phone and, using mobile data, open the address your contractor uses to log in. If a login page loads, the controller is exposed.
4. Check the settings themselves. With your contractor, compare defrost schedules, temperature setpoints and alarm thresholds with what was originally configured. Check who receives alarms and whether anyone gets them at night.

If you share a building network with other tenants, or your contractor installed a separate 4G router for remote access, check that device too. It is often forgotten.

What CERT-FR says to do, in plain English

The French alert splits its advice by whether a controller has already been tampered with.

If nothing has been changed yet

• Remove internet exposure for the controller and for any other unit sitting on a public IP address.
• Before cutting the data link to your contractor, check your insurance contract. Some policies require remote temperature monitoring.
• Review the full configuration, especially the defrost time ranges.
• Restore remote access only through a secured VPN or a protected network. Filtering your contractor’s IP addresses on a firewall is acceptable as an emergency measure, but CERT-FR says it should not be treated as a lasting fix.
• Apply the manufacturer’s security guidance. For Danfoss units, CERT-FR names updating firmware, setting the security level to Strict and making sure default passwords have been changed.

If a controller was tampered with

• Take it off the internet first, with the same insurance check.
• Restart the Danfoss unit, or restore it to factory settings if a restart is not enough.
• Have it reconfigured before it goes back into service, then restore remote access only through a VPN or protected network.

CERT-FR adds a blunt warning: an end-of-life controller that no longer gets security patches has a very high chance of compromise if it stays online, and a factory reset alone will not help because the device is still vulnerable. If your contractor says your model is out of support, ask for a replacement quote now.

Add an alarm that does not depend on the controller

Every reported wave started overnight. A standalone temperature sensor that sends text or app alerts over its own connection gives you a warning even if the main controller is tampered with or its alarms are switched off. Many cold-chain monitoring products work this way; we have not tested specific models, so ask your contractor or food-safety consultant what fits your setup. Make sure at least one alert goes to a phone that someone answers at night.

If your contractor’s remote portal supports it, turn on two-step sign-in for every account. Our guide to turning on two-step verification for Google and Microsoft accounts explains how the codes and prompts work.

What it means if you are not a store owner

For shoppers, the main effect so far is empty freezer aisles and late openings at affected stores. Retailers say spoiled stock was thrown out. No company has reported that payment or customer data was taken.

At home, consumer fridges have not been named in any of these incidents. The lesson still applies to other connected devices: do not forward router ports to a device’s admin page, and update or replace gear that no longer gets security fixes. Our check for infected Android TV boxes covers the same problem on a home network.

FAQ

Was customer data stolen in the supermarket freezer hacks?

None of the affected retailers has reported data theft as of November 2, 2026. The attacks changed refrigeration settings. Investigations are still running, so this could change.

Who is behind the attacks?

Unknown. No group has claimed the French, U.S. or November incidents, and no government has attributed them. Treat any named group you see on social media as speculation until an authority confirms it.

Does a factory reset fix a hacked controller?

Not on its own. CERT-FR says a reset removes what the attacker left behind, but a device that is still exposed and unpatched will likely be compromised again. Close the internet exposure first.

My controller is not Danfoss, Copeland or Dixell. Am I safe?

Not necessarily. Those are the models named in the French alert. Any refrigeration controller with a web login reachable from the internet carries the same risk.

Related guides

• Synology C3RB3R Ransomware: Update DSM and Lock Down Your NAS
• Broadcom WPS flaw (WPSplinter): is your router affected?
• CVE-2026-98432: How to Check and Patch Your Linux Server

If you run Node-RED for automation, lock down the Node-RED editor with adminAuth.

Sources

How we checked: we read the CERT-FR alert in full and compared retailer statements reported by ABC News on November 2, 2026, with SOCRadar’s incident summary. Store counts may change as companies update them.

• CERT-FR: CERTFR-2026-ALE-012, security incident targeting remote controllers of refrigeration installations (October 12, 2026, updated October 16, in French)
• ABC News: European grocery chains’ freezers, refrigerators targeted in apparent cyberattacks (November 2, 2026)
• SOCRadar: Supermarket freezer attacks reach Belgium, Sweden, Luxembourg (November 2, 2026)

Next step: send your refrigeration contractor the three questions in the checklist above today, and ask for a written answer on how they connect to each site.