Skip to content
HackIT
Talk to a tester

Supermarket freezer hacks: what happened in Estonia and Europe

Attackers have changed the settings of supermarket refrigeration controllers in Estonia, France and elsewhere. What is known about the attacks and the devices.

HackIT Security Team

Explainer cover: Supermarket freezer hacks: what happened in Estonia and Europe

In short: Attackers have been taking over supermarket refrigeration controllers and changing their settings. In October, CERT-FR, the French government's CERT, warned of numerous compromises of Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb controllers and said campaigns are probably still under way. Neither the French authorities nor Danfoss have said who is behind the attacks or how the attackers got into the controllers.

What happened in Estonia?

On 2 November 2026, ERR reported that attackers had reached the control computer of an older Danfoss refrigeration system at an Estonian supermarket chain and changed the temperature setting of a refrigerated case to +50°C, according to the Estonian original. ERR did not name the chain.

The account comes from Jann Mutso, chief executive of the refrigeration company Kitman Coldtech. He told ERR that other businesses in Estonia, not only his firm's clients, had also been attacked, that "the signature is the same" as in earlier attacks, and that the controllers being targeted are old ones that have not been updated. He said the incident was handled within 10 minutes of being reported, so no damage was caused. According to Mutso, it is normal for refrigeration in large food stores to be digital and connected to the network; this attack sought specific security holes, and the store chains have started updating their controllers. Mutso also said the method resembles attacks in France and the Netherlands in October.

Two weeks earlier, Taavi Kupper, head of incident handling at RIA, had told ERR that only a handful of network-visible devices existed in Estonia and that all parties had been contacted.

What happened elsewhere in Europe?

France. On the night of 11 October 2026, attackers took remote control of fridges and freezers at hundreds of French supermarkets, according to the chains' own figures as reported by The Hacker News. One group said its units were put into defrost and heated to as much as 50°C. The chains' own counts, as compiled by The Hacker News, differ by outlet: Les Mousquetaires, which owns Intermarché and Netto, said at least 300 stores according to AFP and about 150 according to Reuters, while Carrefour said 80 supermarkets and Coopérative U 80 of its 2,000. Coopérative U's chief executive said the cold chain held in most of its affected stores; Intermarché said its affected stores had to throw away all the products concerned. Danfoss said it was aware of incidents affecting "a limited number of refrigeration management systems". The next day, CERT-FR issued an alert; it added more targeted equipment on 13 October and updated its recommendations on 16 October.

Sweden, Belgium and Luxembourg. ERR's Estonian article reports that similar incidents were reported on 2 November in Sweden, Belgium and Luxembourg. In Sweden, citing Dagens Nyheter, it says refrigeration and freezer systems at stores of two chains failed overnight. One store said on social media that its fridges and freezers had fallen victim to a hacker attack and been set to 50 degrees. A press officer for one chain said the affected stores were few, and were stores with connections outside the chain's central network; the other chain said it uses devices similar to those linked to the incident in France and had already ordered new systems. Neither chain had confirmed that hackers were behind the problems. Citing Reuters, ERR also reports that a retail group found temperatures rising in fridges and freezers in Belgium and Luxembourg and is investigating.

As of 11:00 UTC on 2 November, neither CERT-FR, RIA nor CERT-SE had published anything linking these incidents to the French attacks.

Which controllers were targeted?

CERT-FR lists four product families: the Danfoss AK-SM and AK-SC series, and Copeland xweb and Dixell xweb. Its alert gives no CVE and names no single vulnerability.

According to Danfoss, as reported by The Hacker News, most units hit were older products that no longer get software or security updates: the AK-SM 800, end of life since May 2021, and the AK-SC 355, phased out in 2016. Danfoss also told the trade publication Cooling Post, The Hacker News reports, that some current AK-SM 800A units were hit and were running outdated firmware. Copeland's security notice acknowledges a vulnerability in one generation of its XWEB EVO controllers, which have reached end of service and will receive no further security fixes.

These controllers are not only in supermarkets. Claroty, which researched the AK-SM 800A, says the model is widely used in supermarkets, cold stores, warehouses and other commercial sites, and in research published on 9 August 2026 it cited a Censys scan showing 2,765 exposed AK-SM 800A devices. Separately, Danfoss fixed a flaw in the AK-SM8xxA series, which includes the AK-SM 800A, CVE-2025-41451, in version 4.3.1; no authority has linked it to the attacks.

Why these controllers are a target

The Danfoss controller runs all of a store's fridges and freezers and can be managed remotely by maintenance firms, The Hacker News reports, and stores may get the system through a refrigeration contractor. That remote management is the weak point. CERT-FR says that exposing a management interface on the internet goes against good practice, and that keeping an end-of-life unit without security fixes exposed makes compromise very likely.

Physical consequences follow quickly. Mutso told ERR that disrupting these digital systems can directly affect food safety and cause significant damage. Copeland's notice makes the same point: changed setpoints or alarm thresholds can compromise food safety.

The UK's NCSC says the same of operational technology in general: any organisation with internet-exposed OT could be affected, and none should assume its OT is unreachable from the internet without verifying it.

What have the authorities advised?

CERT-FR's main recommendation is to remove the internet exposure of affected units and of every unit on a public IP address, and to restore access only through a secure VPN or a protected network; filtering the contractor's IP addresses on a firewall is an emergency measure, not a lasting one. For Danfoss units, it names updating the firmware, setting the security level to Strict and changing default passwords. It warns that on an end-of-life unit that stays exposed, a factory reset removes the attacker's foothold but leaves the unit vulnerable, and it will almost certainly be compromised again.

In Estonia, incidents are reported to CERT-EE, RIA's incident response team; RIA says CERT-EE works 24/7.

What is still unknown

  • Who is behind it. Neither the French authorities nor Danfoss have said who carried out the attacks, and no authority has attributed the Estonian or Swedish incidents.
  • How the attackers got in. No authority has named a vulnerability or an entry route, and the CERT-FR alert lists no CVE.
  • Whether the incidents are connected. Mutso says the signature matches, and one Swedish chain says it uses devices similar to those linked to France, but no authority has linked them.
  • The scale in Estonia. Mutso says other businesses were hit; by 11:00 UTC on 2 November, RIA had not published a statement on the incident.

How a security review fits in

Refrigeration controllers may be installed and run by a supplier, so they can be missing from an organisation's own list of internet-facing systems. Finding every management interface an organisation exposes, including the ones suppliers installed, is part of security consulting.

If you want to know what your sites expose to the internet, talk to a tester.

Sources

All posts