At 50 Degrees, the Supermarket Freezer Hack Found the Stores Outside the Central Network

The ICA Kvantum store in Sjöbo wrote to its customers on Instagram in the morning, in a translation from Swedish, that its refrigerators and freezers had been hacked in the night and set to 50 degrees. “We are extremely sorry and are working flat out to throw away and get everything going again,” the store wrote. It kept the shop shut for the morning and then opened again.

At an ICA store in Stockholm, the attack started at 02:00 and was noticed at 05:30, and the freezers there read 38 degrees when staff arrived and 50 later. In Böda, on Öland, the manager of an ICA Nära store arrived to water on the floor and a freezer at 55 degrees. The store in Sjöbo told TV4 its staff could not put the settings back. Delhaize, which called what happened an “IT incident”, said it realised on Monday that temperatures were rising in its cooling systems, and its spokesperson Sarah De Meester said the company was investigating.

The first replies under the Sjöbo store’s post came from shoppers. One wrote, in translation, “That is how you knock out a population, you start with the most important thing. Food and water.” Another asked why the freezers should be connected at all. A third wrote that she loved the shop and asked why anyone would waste time destroying things. The companies, meanwhile, were describing the night in the language of systems: an incident, an anomaly, a limited number of stores.

Stephan Moelans, the chief executive of Sabcobel, the Belgian company that operates Delhaize’s systems, told the Belga news agency that the units’ evaporators had been switched to defrost mode, the same method believed to have been used in France. His company had worked all night and morning to disconnect the affected units from the network, he said. Technicians were called out at 1 a.m., according to Le Soir. Moelans said Sabcobel had been working since the French attack to protect its customers’ fridges against the vulnerability, but the units needed physical modifications, not just software updates. The simplest answer, he said, was managing the fridges through a secure internet connection, and most customers had moved to that after France. The butcher chain De Laet & Van Haver said its alarms went off at about 03:00 after its settings were changed remotely, and that it was able to pause the system in time.

Researchers at Claroty’s Team82 had counted the exposure in August. They reported finding 2,765 management interfaces for one Danfoss controller model, the AK-SM 800A, reachable from the public internet. The same research described a hidden “code-of-the-day” login that let someone generate a valid daily code from the device’s own date, without the administrator’s password, and a flaw that could lead to remote code execution once logged in. Danfoss fixed those flaws in firmware version R4.3.1, for the current model. From one console, an operator could set a store’s temperature thresholds and defrost schedules. Nobody involved has said those flaws were the way in, in France or on Monday, and France’s CERT-FR named no vulnerability and no attacker in its alert.

For most of the controllers hit in France, there was no fixed firmware to install. Danfoss told AFP and the trade press that most of the affected units were legacy products that no longer receive software or security updates: the AK-SM 800, declared end of life in May 2021, and the AK-SC 355, phased out in 2016. The current-model units that were hit were running outdated firmware, Danfoss said, and its fuller account described products with nothing newer to run. The same models had been hit before, according to Danfoss’s own newsletter from October 2025, which records sixteen supermarkets in Russia using the AK-SM 800 targeted in 2022, and forty stores in Israel hacked the same year, all of them lacking proper firewall or VPN protection. Synacktiv, a French security firm, had reported the date-derived login in the older model in 2023.

France’s computer emergency response team, CERT-FR, published its alert on the supermarket freezer hack on 12 October, added two more controller families the next day, and updated its advice again on 16 October. It said attack campaigns against the controllers were probably still underway. It warned that keeping an end-of-life unit exposed to the internet left it at a very high probability of compromise, and that a factory reset alone was not enough, because the unit would stay vulnerable and would certainly be compromised again. It told operators to check the defrost ranges in their configurations, to check their insurance terms before cutting the data feed to their refrigeration contractor, and to restore access only through a secure VPN or a protected network. One of the commenters under the Sjöbo post wrote, in a translation from Swedish, “The ironic thing is that French cybersecurity issued warnings on 12 October.” He went on to propose temperature alarms that would alert on-call staff and independent limits on what a computer command could do.

In Sweden, ICA said the affected stores were a limited number whose connections operated outside its central network. Its press manager told the Swedish news agency TT that the affected stores had chosen an external supplier and a system other than ICA’s own, and were connected to Danfoss equipment. In Finland, Kesko’s head of corporate security, Petri Kayhko, said only a couple of smaller grocery stores were affected, stores whose equipment was not included within the scope of Kesko’s centralised safeguards, after automated alerts and staff arriving in the morning. An IT-related incident was not ruled out there. Axfood, another Swedish retailer, said freezers at a distribution centre for home grocery deliveries near Gothenburg had been hacked. Coop said at least six of its roughly 800 Swedish stores had problems and food to throw away, and its spokesman said the units had either stopped working entirely or had been partially impaired.

About forty Delhaize stores in Belgium and Luxembourg, fifteen Carrefour stores in Belgium, five Spar shops under the Colruyt franchise, and smaller Shop & Go and Proxy Delhaize outlets in Belgium were hit. Thirteen SuperValu stores in Ireland, where Musgrave said one specific refrigeration model was affected and chilled and frozen products were withdrawn. A supermarket chain in Estonia, unnamed, set to 50 degrees, according to the technology supplier Kitman Coldtech. At least seventeen businesses in the Netherlands, including butchers and neighbourhood shops, according to a Danfoss spokesperson speaking to the Dutch broadcaster NOS. One Delhaize store in Hoeilaart, in Flanders, told a local news site it had lost €100,000 worth of produce, not counting the cost of closing. The BBC counted seven countries in all. In France the month before, the finance minister put the count at about 700 of the country’s roughly 10,000 supermarkets, with some units held at 50 degrees for six hours, fires at some stores, and losses running into tens of millions of euros, and the Paris prosecutor opened an inquiry. After France, scans still found thousands of Danfoss interfaces reachable online: Reuters located at least 4,500 through the Shodan search engine, and a French researcher counted 2,752 exposed systems, 1,590 of them in France, on scans that covered different models on different days and none of which showed the exposure closed.

Ahold Delhaize had reported a separate cybersecurity incident to Dutch police, and has still not said what caused a separate outage at its Dutch stores. No group has claimed responsibility for the French attack or for Monday’s. The UK’s National Cyber Security Centre said it was working with international partners and industry to understand the incident fully, and that no incidents had been reported in the UK.