---
title: "Refrigerators as Weapons: The Cyberattack Turning European Supermarket Freezers into Tools of Sabotage"
description: "On November 2, a cyberattack on refrigeration control systems impacted supermarkets in Belgium, Sweden, Ireland, and other countries, causing freezer temperatures to reach 50 degrees and spoiling food. Experts link the incident to Danfoss controller vulnerabilities within the IoT ecosystem."
date: 2026-11-04T22:43:24.686Z
lang: en
url: https://xab.info/en/posts/cyberattack-supermarket-refrigerators-europe
tags: [cyberattack, iot-security, supermarket, refrigeration, danfoss, europe]
author: "Alexander Buran"
publisher: "XAB.info"
---

# Refrigerators as Weapons: The Cyberattack Turning European Supermarket Freezers into Tools of Sabotage

![Worker cleans empty supermarket shelves following a cyberattack on refrigeration equipment in Europe](https://xab.info/media/2026/11/04/kiberataka-na-holodilniki-supermarketov-evropy/kiberataka-na-holodilniki-supermarketov-evropy-1.webp)

## Key Points

- The November 2 incident affected retail chains in Belgium, Luxembourg, Sweden, Ireland, and other countries, with Ahold Delhaize, Colruyt, ICA, Coop, Carrefour, and Musgrave reporting disruptions.
- In Belgium, 15 Carrefour stores were affected; in Ireland, 13 SuperValu stores; at a Swedish ICA, freezer temperatures reached 50 °C.
- The attack exploits vulnerabilities in the Danfoss AK-SM 800A controller (CVE-2025-41451, CVE-2025-41452) discovered by Clarity's Team82 group.
- The investigation is ongoing; motives and state sponsorship remain unconfirmed.

In early November 2026, a cyberattack unusual in its logic swept through retail chains in several European countries. The perpetrators did not attempt to steal banking data, hijack government servers, or disable a power plant — their target was the operating temperature of refrigerators and freezers in supermarkets. According to Reuters, the incident recorded on November 2 affected retail chains in Belgium, Luxembourg, Sweden, Ireland, and several other countries. Major retail groups — including Ahold Delhaize, Colruyt, ICA, Coop, Carrefour, and Musgrave — reported problems. Instead of stealing money, hackers altered climate control parameters, leading to rapid food spoilage and forcing stores to discard goods for customer safety.

### Scale: From Fifteen Stores in Belgium to Fifty Degrees in Sweden

The affected chains provided specific figures. In Belgium, Carrefour confirmed that disruptions impacted 15 stores; in Ireland, problems arose in 13 SuperValu locations, and several IKEA stores were also among those affected. The most striking case occurred in Sweden, where the temperature in a freezer at an ICA store rose to 50 degrees Celsius. Employees discovered the anomaly hours after changes were made to the system, resulting in the destruction of a significant portion of inventory. Importantly, this was not an isolated episode: approximately three weeks prior to November, a similar attack hit France, affecting hundreds of stores across various chains, where abnormal temperatures caused food spoilage and even fires in certain rooms.

### How the 'Invisible Door' Works: IoT and the Danfoss Controller

Behind a standard industrial refrigerator lies a complex technological system: controllers, temperature sensors, compressors, defrost systems, and monitoring software that allows management of dozens or hundreds of devices from a central location. Many such systems provide suppliers and maintenance personnel with remote access for setup and troubleshooting — a key advantage of the Internet of Things (IoT). This exact access became the entry point. According to a research report published in August by Clarity’s Team82 group, the Danfoss AK-SM 800A controller, widely used in supermarket, warehouse, and factory refrigeration systems, suffers from severe vulnerabilities: a hidden authentication mechanism bypassing standard login, and administrative interface flaws leading to remote code execution and device disruption.

### Patch, CVE, and the Systemic Problem of Aging Equipment

Danfoss released an update to address the vulnerabilities: security advisory DSA-2025-08-01 documents two vulnerabilities — CVE-2025-41451 and CVE-2025-41452 — affecting AK-SM 8xxA controller versions prior to 4.3.1. However, experts emphasize that industrial control equipment is designed for long service life, while firmware updates, default password changes, and security configuration checks are performed irregularly; some systems installed years ago remain online without up-to-date patches. Hackers do not need to break into a store, damage physical equipment, or have direct access to goods — infiltrating the digital control system is enough to turn a refrigerator into a tool for inflicting damage.

### An Investigation Without Answers: Motives and Attribution Unestablished

European authorities are investigating, but as of publication, the identities of the perpetrators, their motives, and the ultimate connection between the November attack and the earlier incident in France remain unestablished. Publicly available evidence does not suggest this was a state-sponsored operation. For an economy increasingly built on machine-to-machine interaction, this episode serves as an alarming signal: even the most mundane household and industrial appliances are becoming backdoors through which economic activity and daily life can be disrupted without targeting traditional cyber vectors.

## Fact-Check & Sources

- [Взлом холодильников — уязвимость всей взаимосвязанной экономики.](https://www.vietnam.vn/ru/khi-tu-lanh-bi-hacker-tan-cong-lo-hong-cua-ca-nen-kinh-te-ket-noi) - The primary source cites Reuters (November 2 incident, list of countries and chains) and Cybersecurity Dive (Team82/Clarity research, CVE-2025-41451/41452, DSA-2025-08-01). Store statistics (15 Carrefour in Belgium, 13 SuperValu in Ireland, 50 °C at ICA) are reported as statements from the chains themselves.

## FAQ

### What exactly did hackers do in the supermarkets?

They altered the operating temperatures of refrigerators and freezers via the digital control system, leading to food spoilage; at a Swedish ICA store, the freezer temperature rose to 50 degrees Celsius.

### Which countries and chains were affected on November 2?

According to Reuters, the incident affected Belgium, Luxembourg, Sweden, Ireland, and several other countries, with problems reported by Ahold Delhaize, Colruyt, ICA, Coop, Carrefour, Musgrave, and some IKEA stores.

### What is the technical cause of the vulnerability?

Clarity's Team82 research uncovered vulnerabilities in the Danfoss AK-SM 800A controller (CVE-2025-41451 and CVE-2025-41452), including a hidden authentication mechanism and administrative interface flaws; Danfoss released an update (DSA-2025-08-01) for versions prior to 4.3.1.

### Have the perpetrators and their motives been identified?

No. European authorities are investigating, but identities, motives, and links to the earlier attack in France have not been established; there is no public evidence of state sponsorship.