Freezers hacked again: why the second attack matters more than the first

Three weeks ago we wrote about the night French supermarket freezers were pushed towards 50°C. In Hot Aisles, Cold Facts we argued that the real story was not fridges. It was the connected kit that sits in every estate, looked after by facilities and contractors, and often invisible to security.

We also flagged a warning from CERT-FR, France's national cyber emergency team: attack campaigns against these controllers were probably still under way. On Monday that warning came true.

The short version

Overnight into 2 November, refrigeration systems in dozens of shops across Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia were tampered with. Store staff and suppliers described freezers being set to around 50°C or switched into defrost, and stock had to be thrown out. Danfoss told Dutch broadcaster NOS that systems at no fewer than 17 Dutch businesses were hit, including butchers and small local shops.

Nobody has claimed it, and no agency has named a culprit. The Centre for Cybersecurity Belgium said the attackers may never be identified. The UK's National Cyber Security Centre says it is working with partners, and no UK cases have been reported so far.

What the second wave confirms

Most of what we said in October still stands. The difference is that it is no longer a theory.

It was never just a French problem. The same kind of equipment is installed right across Europe, and this time the attacks reached six countries in a single night.

Old kit keeps getting hit. An Estonian refrigeration contractor said an older Danfoss system was the way in. After the French incident, the manufacturers said most of the affected devices were discontinued. Sabcobel, a Belgian firm that installs and manages many of the affected units, said a software update was not enough and some units needed physical changes. Its CEO's advice was to manage fridges "over a secure internet connection".

The gap is still ownership. Three weeks is plenty of time to find and fix internet-facing controllers. Where that did not happen, the usual reason is that nobody owned the risk.

The bright spot: speed

At one Estonian store, the problem was dealt with within about ten minutes. Freezer temperatures crept up by only two or three degrees, and no food was lost, according to the contractor involved. Compare that with stores elsewhere, where freezers warmed up overnight and shelves had to be cleared.

That is the lesson worth taking into your next board meeting. You may not be able to replace every legacy controller this quarter, but you can make sure that someone notices within minutes when a setpoint changes.

What security leaders should do this week

1. Find what is exposed. Check your public IP ranges for refrigeration, HVAC and building management interfaces. CERT-FR's advice is plain: management interfaces should not sit on the open internet.
2. Ask your contractors directly. Which systems do they reach remotely, and how? Ask for confirmation in writing of VPN or protected access, no factory-set passwords, and up-to-date firmware.
3. Watch the setpoints. Alert on temperature and configuration changes outside agreed windows, and make sure an alert reaches a person who can act at 2am.
4. Plan for what cannot be patched. For end-of-life kit, a factory reset will not fix the underlying weakness. Isolate it, and put its replacement on a funded roadmap.
5. Get ahead of regulation. From December 2027, the EU Cyber Resilience Act will expect manufacturers to support products for their expected lifetime. Until then, the risk sits with you.

The bigger question

The first attack was a warning. The second one shows that the same weakness can be exploited again and again until somebody fixes it. If your organisation runs connected equipment that keeps the business going, whether that is freezers, chillers or building controls, the questions from our October piece still apply: who owns it, who can reach it, and how quickly would you know?

Security leaders are working through exactly these questions together at our CISO Inspired Summits. Our events calendar shows where we are meeting next.

Sources

• Inspired Business Media, Hot Aisles, Cold Facts: The Hidden Devices That Could Be Your Next Breach (our October piece): https://www.inspiredbusinessmedia.com/blog/hot-aisles-cold-facts-ot-security-ciso
• CERT-FR alert CERTFR-2026-ALE-012 (affected Danfoss, Copeland and Dixell controllers; internet exposure contrary to good practice; campaigns likely ongoing; factory reset insufficient for end-of-life kit; VPN, firmware and password advice): https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/
• CISA ICS advisory ICSA-25-140-03, Danfoss AK-SM 8xxA Series (keep control systems off the internet, use secure remote access): https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03
• BBC News, 2 Nov 2026 (countries affected; Sabcobel on physical modifications and secure connections; Danfoss via NOS on 17 Dutch businesses; NCSC statement): https://www.bbc.co.uk/news/articles/cq1kd1nee80eo
• The Record, 2 Nov 2026 (Centre for Cybersecurity Belgium comment; older Danfoss system in Estonia; manufacturers on discontinued devices; Cyber Resilience Act timing): https://therecord.media/cyberattack-grocery-freezers-europe
• ERR News, 2 Nov 2026 (Estonian store: response within ten minutes, two to three degree rise, no stock lost): https://news.err.ee/1610183296/hackers-raised-freezer-temperature-at-selver-supermarket-to-50-c
• AP News, 2 Nov 2026 (Sweden, Belgium, Luxembourg and Estonia affected; ruined food disposed of): https://apnews.com/article/europe-supermarkets-freezers-cyberattacks-a8ea5b30d67da47957769f29101fe686
• Euronews, 2 Nov 2026 (scope of the incident; link to the October attack in France): https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers

Images: Eduardo Soares on Pexels, Nicolás Rueda on Pexels and Freek Wolsink on Pexels (Pexels License).