Supermarket Freezer Hack Hits Belgium and Sweden
Stores hit overnight 1-2 November 2026
| Country | Chain | Stores affected | Peak temperature |
|---|---|---|---|
| Belgium | Delhaize | ~40 | ~45C |
| Belgium | Carrefour | 15 | ~45C |
| Belgium | Spar | 5 | ~45C |
| Sweden | ICA | Several (2 closed) | 55C |
| Sweden | Coop | 7 | ~50C |
| Luxembourg | Ahold Delhaize | Multiple | ~45C |
| Ireland | SuperValu (Musgrave) | 13 | ~50C (est.) |
| Estonia | Selver (Kitman Coldtech) | 1 | 50C |
55CPeak temperature recorded in Swedish ICA freezers
How the attack works
The target is the Danfoss AK-SM 800 and AK-SC 355, controllers that manage a supermarket's entire refrigeration plant and are routinely accessed remotely by third-party maintenance firms. The AK-SM 800 reached end-of-life in 2016; the AK-SC 355 in 2021. Neither receives security updates. Both have a publicly accessible login with a default username of "admin" and use a "code of the day" derivable from the device's own date. Attackers exploit this to log in remotely, activate forced defrost cycles while food is still inside, and raise temperatures to 50-55C. Belgian refrigeration firm Sabcobel, which operates Delhaize's systems, confirmed to the Belga news agency that the defrost mode was remotely triggered. Cybersecurity firm Claroty had published a public warning about the flaw in August 2026.
Estimated 4,500 Danfoss controllers remain openly reachable on the internet across European supermarkets as of early November 2026.
The controllers also expose Copeland and Dixell units at s
France attack (12 Oct)
Up to 700 stores, tens of millions euros lost
Belgium/Sweden attack (2 Nov)
70+ stores, millions of euros lost
Controllers still exposed online
~4,500 across Europe
Danfoss AK-SM 800 end-of-life
2016
Danfoss AK-SC 355 end-of-life
2021
What is known and what is not
Known: the Danfoss flaw is real, documented, and has been publicly disclosed; attackers are exploiting remote access to trigger forced defrost; attacks confirmed in France, Belgium, Sweden, Luxembourg, Ireland, and Estonia; SuperValu (Musgrave) confirmed 13 Irish stores affected with food withdrawn; Selver confirmed one Estonian outlet attacked; Kitman Coldtech CEO confirmed older Danfoss controller exploited; ICA and Coop confirmed refrigeration failures; food worth millions of euros has been destroyed across Belgium and Sweden. Not yet known: who is behind the attacks; whether the two waves (France and now five more countries) are connected; whether further countries are next; whether Finland's K-Group reports (cited by Bloomberg and Helsinki Times) will be officially confirmed; whether any criminal group has claimed responsibility.
What happens next
France opens criminal investigation (Paris prosecutors, October 2026)
ANSSI coordinating with EU counterparts after France attack
ENISA or national CERTs expected to issue advisory on Danfoss units
Danfoss patch available for AK-SM 800A (newer series); older AK-SM 800 and AK-SC 355 have no patch path
Retailers taking affected units offline and replacing vulnerable controllers
Belgian and Swedish police investigations expected to open
Sources: Ahold Delhaize statement and Sabcobel/Belga via NL Times (nltimes.nl, 2 Nov 2026); Guardian (2 Nov 2026); CBS News France attack (cbsnews.com); Trending Topics EU (trendingtopics.eu); BBC (bbc.co.uk, 2 Nov 2026). Ireland: Musgrave/SuperValu statement via The Journal.ie (2 Nov 2026); Agriland.ie (2 Nov 2026). Estonia: Kitman Coldtech CEO Jann Mutso and Selver statement via ERR (Estonian public broadcaster, 2 Nov 2026). No group has claimed responsibility for any of the Nov 2 attacks.
