In early November 2026, a cyberattack unusual in its logic swept through retail chains in several European countries. The perpetrators did not attempt to steal banking data, hijack government servers, or disable a power plant — their target was the operating temperature of refrigerators and freezers in supermarkets. According to Reuters, the incident recorded on November 2 affected retail chains in Belgium, Luxembourg, Sweden, Ireland, and several other countries. Major retail groups — including Ahold Delhaize, Colruyt, ICA, Coop, Carrefour, and Musgrave — reported problems. Instead of stealing money, hackers altered climate control parameters, leading to rapid food spoilage and forcing stores to discard goods for customer safety.
Scale: From Fifteen Stores in Belgium to Fifty Degrees in Sweden
The affected chains provided specific figures. In Belgium, Carrefour confirmed that disruptions impacted 15 stores; in Ireland, problems arose in 13 SuperValu locations, and several IKEA stores were also among those affected. The most striking case occurred in Sweden, where the temperature in a freezer at an ICA store rose to 50 degrees Celsius. Employees discovered the anomaly hours after changes were made to the system, resulting in the destruction of a significant portion of inventory. Importantly, this was not an isolated episode: approximately three weeks prior to November, a similar attack hit France, affecting hundreds of stores across various chains, where abnormal temperatures caused food spoilage and even fires in certain rooms.
How the 'Invisible Door' Works: IoT and the Danfoss Controller
Behind a standard industrial refrigerator lies a complex technological system: controllers, temperature sensors, compressors, defrost systems, and monitoring software that allows management of dozens or hundreds of devices from a central location. Many such systems provide suppliers and maintenance personnel with remote access for setup and troubleshooting — a key advantage of the Internet of Things (IoT). This exact access became the entry point. According to a research report published in August by Clarity’s Team82 group, the Danfoss AK-SM 800A controller, widely used in supermarket, warehouse, and factory refrigeration systems, suffers from severe vulnerabilities: a hidden authentication mechanism bypassing standard login, and administrative interface flaws leading to remote code execution and device disruption.
Patch, CVE, and the Systemic Problem of Aging Equipment
Danfoss released an update to address the vulnerabilities: security advisory DSA-2025-08-01 documents two vulnerabilities — CVE-2025-41451 and CVE-2025-41452 — affecting AK-SM 8xxA controller versions prior to 4.3.1. However, experts emphasize that industrial control equipment is designed for long service life, while firmware updates, default password changes, and security configuration checks are performed irregularly; some systems installed years ago remain online without up-to-date patches. Hackers do not need to break into a store, damage physical equipment, or have direct access to goods — infiltrating the digital control system is enough to turn a refrigerator into a tool for inflicting damage.
An Investigation Without Answers: Motives and Attribution Unestablished
European authorities are investigating, but as of publication, the identities of the perpetrators, their motives, and the ultimate connection between the November attack and the earlier incident in France remain unestablished. Publicly available evidence does not suggest this was a state-sponsored operation. For an economy increasingly built on machine-to-machine interaction, this episode serves as an alarming signal: even the most mundane household and industrial appliances are becoming backdoors through which economic activity and daily life can be disrupted without targeting traditional cyber vectors.
