Supermarket fridge and freezer hacks in Europe (2026)
- When
- Oct 11 – Nov 3, 2026
- Where
- France + 6 European countries, UK
- Scale
- ~700 stores (Oct), 100+ (Nov)
- Status
- Ongoing investigation
- Attribution
- France: IRGC-linked unit (French attack only)
Attackers took remote control of internet-connected refrigeration controllers and pushed fridges and freezers into defrost or heating mode, in some cases to 50°C (122°F). The first wave hit about 700 supermarkets and shops in France overnight on October 11-12, 2026. A second wave on November 2 hit stores in at least six other European countries. Food had to be thrown away, and some stores reported fires and sprinkler water damage.
On November 9, France attributed the French supermarket attack to Shahid Kaveh, a cyber unit linked to Iran's Islamic Revolutionary Guard Corps (IRGC). Iran has not publicly accepted responsibility. No authority has said who carried out the November wave in other countries, and investigators have not said whether the waves are linked.
U.S. agencies (CISA, FBI, HHS, USDA, DOT) warned on November 5 that refrigeration and cold-chain controllers are being targeted worldwide. Officials and the controller maker point to the same weak spots: controllers reachable from the internet, default passwords never changed, and old models that no longer get security updates.
Chains that publicly confirmed they were hit: Intermarché, Coopérative U, Monoprix, Delhaize, Carrefour Belgium, Colruyt, SuperValu, ICA, Coop, Kesko, Intermarché Portugal.
Timeline
- Claroty discloses flaws in Danfoss AK-SM 800A refrigeration management software that can allow login bypass and remote code execution; a fixed firmware (R4.3.1) is available.
- Overnight, refrigeration units in about 700 French supermarkets and shops are forced into defrost; temperatures reach about 50°C for around six hours.
- Danfoss tells customers to cut controllers off the internet and reconnect only through a secure network. France's CERT-FR links the attacks to Danfoss AK-SM/AK-SC controllers, then widens its alert to Copeland and Dixell XWEB systems.
- Second wave: more than 100 stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden report fridges and freezers heating overnight; problems also reported in Finland, Italy and Portugal. Belgium's federal prosecutor opens an investigation.
- Cold-storage sites holding plasma at France's national blood service are targeted; alarms let staff intervene and no blood products were lost.
- The UK's National Cyber Security Centre says UK food businesses were also hit, with minimal national impact.
- CISA, FBI, HHS, USDA and DOT publish a joint fact sheet on threats to industrial refrigeration and cold-chain monitoring systems.
- France's foreign minister and the Paris prosecutor attribute the French supermarket attack to the IRGC-linked Shahid Kaveh group; a judicial investigation is opened and France says it will seek EU sanctions.
What we know
Each claim is labelled: Confirmed Claimed by attacker Claimed, unverified Company denies Reported Disputed Retracted
- Confirmed About 700 supermarkets and shops in France had fridges and freezers remotely forced into defrost on Oct 11-12, with temperatures reaching about 50°C. (SecurityWeek)
- Confirmed France's foreign minister said Iran's Revolutionary Guards are responsible for the French supermarket attack; the Paris prosecutor named the IRGC-linked Shahid Kaveh group, citing the use of Farsi and IP addresses traced to devices in Iran. (The Guardian)
- Confirmed A French judicial investigation targets the head of Shahid Kaveh and his deputies; prosecutors are seeking international arrest warrants. (SecurityWeek)
- Reported More than 100 stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden were hit on Nov 2; no one has claimed it and investigators have not said whether it is linked to the French attack. (SecurityWeek)
- Confirmed U.S. agencies say malicious actors are targeting unpatched or internet-accessible refrigeration controllers in grocery and cold-storage sites worldwide, using login bypass, code injection and weak configurations. (CISA)
- Reported The French attack involved legacy controllers connected to the internet with default passwords. (The Guardian)
- Reported Danfoss said most hacked units were legacy products it no longer updates; a researcher said every freezer hit on Nov 2 had a management interface reachable from the internet. (SecurityWeek)
- Confirmed Attackers raised temperature and defrost thresholds at three plasma cold-storage sites of France's blood service; staff intervened and no blood products were lost. It is not known whether this is linked to the supermarket attacks. (SecurityWeek)
- Confirmed The UK's NCSC said UK food businesses were also hit and the national impact was minimal. (The Guardian)
- Claimed, unverified Russian hacktivist groups Noname057(16) and Z-Pentest Alliance reportedly claimed to have hacked Danfoss; no authority or company has confirmed it. (SecurityWeek)
What was affected
No customer or personal data has been reported stolen. The attacks changed settings: temperature setpoints and defrost cycles on refrigeration controllers. The damage was physical: spoiled fresh and frozen food (one French chain reported losses of tens of millions of euros in a single day), some fires and sprinkler water damage, and blood-plasma storage that staff had to move or secure.
What to do
Shoppers: stores say they withdrew any product whose storage temperature could not be guaranteed. If you bought chilled or frozen food around October 12 or November 2 and it looks or smells wrong, do not eat it; ask the store.
Businesses with commercial refrigeration or cold storage (from the CISA/FBI fact sheet):
Take controllers and their management interfaces off the public internet. If remote access is needed, use a VPN or other secure connection with strong authentication.
Change every default password and use strong, unique ones.
Apply the vendor's security updates (for Danfoss AK-SM 800A, firmware R4.3.1 or later).
Find and replace old controllers the vendor no longer supports.
Keep a temperature alarm that works independently of the controller, and check units in person after any alert.
Report suspicious activity: in the U.S. to the FBI (ic3.gov) or CISA; in France to ANSSI/CERT-FR; in the UK to the NCSC.
Severity: Critical = physical or safety impact, active exploitation at scale, or an official government warning; High = confirmed attacks on many organizations; Moderate = limited or unconfirmed impact.
Change log
- Page text set (approved by Nicolas 2026-11-11).
- Claim added (confirmed).
- Claim added (confirmed).
- Claim added (confirmed).
- Claim added (reported).
- Claim added (confirmed).
- Claim added (reported).
- Claim added (reported).
- Claim added (confirmed).
- Claim added (confirmed).
- Claim added (claimed unverified).
- Published after editor review.
