.png&w=3840&q=75&dpl=dpl_423kpoB5RW1rkj3BJPpvFYb4QBVG)
On the night of 1 to 2 November 2026, attackers logged into supermarket refrigeration controllers across Belgium, Luxembourg and Sweden and pushed the freezers into defrost. By morning, some Swedish freezers were blowing air at 50 °C and the stock had to be thrown away. No ransomware, no data theft, no zero-day: just internet-facing devices, weak passwords and contractor access that nobody on the retailer side was governing.
This article tells the story as the facts stand today, explains what it means for NIS2, CER and GDPR in each country, and shows how a GRC programme catches this class of risk before it reaches the cold room.
"Most boards can show you a cyber risk register, but the freezer that keeps a store trading rarely appears on it. When that system fails, the loss is immediate and physical: food has to be thrown away. That blind spot is what made 2 November so damaging."
Alexis HirschhornCEO, Acuna GRCWhat happened in the Belgium, Luxembourg and Sweden supermarket refrigeration attack?
Between roughly midnight and 05:30 on 2 November 2026, refrigeration settings were changed remotely at dozens of stores in at least six countries. Freezers were switched to defrost or heat, alarms fired around 03:00, and store teams arrived to spoiled stock.
- 6+countries hit on 2 November
- ~700French stores hit on 11 to 12 October
- 50 °Cair reported in Swedish freezers
- 28 minfor an AI agent to build an exploit in Claroty’s test
| Country | Who was hit | Scale reported |
|---|---|---|
| Belgium | Delhaize (incl. Proxy and Shop & Go), Carrefour Belgium, Spar (Colruyt), De Laet & Van Haver | "Several dozen" Delhaize stores across BE and LU; 15 of 700+ Carrefour; 5 Spar |
| Luxembourg | Delhaize | "A few" stores; no authority statement found |
| Sweden | ICA (Sjöbo, Tomelilla, Böda, Brösarp, Sankt Olof, Baronen Stockholm), Coop | 6 to 7 Coop stores of about 800; a "limited number" of ICA stores |
| Ireland, Estonia, Netherlands | SuperValu, an Estonian chain, 17 Dutch businesses | 13 of 223 SuperValu stores |
The damage was physical. Reported peak temperatures were about 15 °C in Belgium and 50 °C or more in Sweden. One Belgian Delhaize operator put the loss at €4,000. An ICA Sjöbo manager spoke of food worth hundreds of thousands of kronor destroyed. The Financial Times reported millions of euros lost across Sweden and Belgium.
The detail that matters most for governance came from ICA: the affected stores connect outside its central network. The devices sat beyond the retailer's IT controls, installed and monitored by refrigeration contractors.
"A supermarket can usually cope with a broken till for a day, but a freezer left warm for a morning is a different story. The controller that keeps it cold is often managed by an outside contractor, so it ends up outside the retailer's own continuity planning. That is exactly the kind of dependency a business impact analysis should surface."
Henri HaenniPresident, Abilene GroupA business impact analysis asks how long each process can stop before the damage becomes unacceptable. For chilled and frozen sales, the answer is measured in hours.
Is the November attack connected to the French supermarket fridge attack in October?
Very probably, but nobody has officially confirmed it. Three weeks before Belgium, Luxembourg and Sweden, France went through the same night.
What happened in France on 11 to 12 October 2026?
On the night of 11 to 12 October, attackers reached refrigeration controllers in French supermarkets and forced them into defrost. At Intermarché stores, fridges were heated to 50 °C for about six hours. To delay alarms, defrost cycles were reportedly stretched from one hour to eight. Some sites reported fires, and two stores in Alsace alone reportedly put their combined losses at €270,000.
The scale was far larger than November. France's Economy and Finance Minister, Roland Lescure, told Parliament that about 700 stores were affected; the group behind Intermarché reported between about 150 and 300 of its Intermarché and Netto stores hit, depending on the count. The Paris prosecutor's cybercrime unit opened an investigation.
The authorities moved fast, and their warnings reached Belgium and Sweden well before 2 November:
- Danfoss firmware R4.3.1 fixes the last of three AK-SM 800A flaws
- About 700 French stores lose refrigeration overnight
- CERT-FR issues alert CERTFR-2026-ALE-012 on Danfoss AK-SM and AK-SC controllers
- CERT-FR adds Copeland and Dixell XWEB; the CCB warns Belgian operators; Claroty shows an AI-built exploit in about 28 minutes
- CERT-FR updates its recommendations; CERT-SE’s weekly bulletin flags the attacks and exposed Swedish control systems
- Freezer alarms fire in Belgium, Luxembourg and Sweden
- Remote changes stop; store teams find spoiled stock
How the attackers got in is covered below, in the section on the controllers themselves.
France vs. Belgium, Luxembourg and Sweden: what matches?
| Point | France, 11 to 12 October | BE, LU, SE (and others), 1 to 2 November |
|---|---|---|
| Timing | Overnight | Overnight, about 00:00 to 05:30 |
| Method | Remote login, forced defrost, longer cycles | Remote changes, forced defrost or heat |
| Systems | Danfoss AK-SM/AK-SC, Copeland and Dixell XWEB (named by CERT-FR) | Not confirmed; Copeland reportedly hit in Belgium |
| Peak temperature | Up to 50 °C | About 15 °C (BE) to 50 °C or more (SE) |
| Scale | About 700 stores | Dozens of stores in at least six countries |
| Who did it | Unknown, unclaimed | Unknown, unclaimed |
| Official response | Criminal investigation, CERT-FR alerts | Investigations ongoing; Sweden's NCSC handling several incidents |
What is still unknown?
- The vendor in November. Danfoss reportedly said no link to its products had been established for the 2 November attacks, while Dutch broadcaster NOS reportedly said Copeland equipment was hit in Belgium. Both claims are secondhand.
- The exact vulnerability. No authority has named the CVE used in either wave.
- A formal link. Sabcobel, Belgium's refrigeration federation, said the November wave may use the same mechanism. No CSIRT or prosecutor has yet linked the two.
Two other events are often mentioned alongside these waves. Refrigeration failures at six or more US military commissaries in August 2026 are being investigated as a suspected cyberattack, but no link has been shown. And the Ahold Delhaize network incident of 11 October, which took online ordering offline at Albert Heijn and Delhaize, began the same day as the French wave but has not been linked to it.
The takeaway for GRC teams: the November victims had a three-week warning, with named products and clear advice from CERT-FR and the CCB. Whether or not it is one campaign, the question every board should ask is why that warning didn't turn into action.
Who was behind the supermarket refrigeration attacks?
Nobody knows yet. No group has claimed it, and no government, CSIRT or vendor has attributed it. Pro-Russian groups have hit French targets before, but there is no evidence tying any named actor to the refrigeration waves.
What this means for your reporting: write "unattributed" and "suspected common campaign" in board papers and client communications. Overclaiming attribution damages credibility with regulators and insurers.
"People naturally want to know who was behind an attack, and that question will matter eventually. In the first 72 hours, though, the more useful question is whether the exposure that let them in has been closed. Whoever the attacker turns out to be, an unsecured management interface remains an unsecured management interface."
Alexis HirschhornCEO, Acuna GRCHow did attackers get into the refrigeration controllers?
Through the front door. In France, authorities confirmed that the controllers' management web interfaces were reachable from the public internet, and reports pointed to logins as simple as "admin" with a date-based password. The same pattern is suspected in Belgium, Luxembourg and Sweden.
- 1Exposedcontroller web interface reachable from the internet
- 2Logged indefault or date-based password
- 3Unwatchedcontractor access outside the retailer’s MFA and logging
- 4Defrostsetpoints changed, defrost stretched, stock spoiled
Three weaknesses lined up:
- Internet exposure. CERT-FR and Belgium's CCB both said management interfaces should never face the internet. An October survey by SVT found about 3,800 exposed industrial control systems in Sweden, roughly 2,000 protected by nothing more than a username and password.
- Supplier-run access. Refrigeration contractors install and remotely monitor these units. Their access paths sat outside the retailers' identity, MFA and logging controls, which is exactly the gap third-party risk management exists to close.
- Known, unpatched flaws. Danfoss AK-SM 800A vulnerabilities (CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452) were fixed in firmware R4.2 (May 2025) and R4.3.1 (August 2025). Many affected units were legacy models that no longer receive updates.
The attackers likely needed no malware. Sekoia found no malicious code on the French controllers, which suggests legitimate admin functions were abused to change setpoints and defrost timing.
Why the warning time should worry every board
The flaws were public for more than a year. Claroty published exposure counts in August 2026. And in October, Claroty showed an AI agent turning publicly downloadable Danfoss firmware into a working exploit in about 28 minutes, for about $6 of AI usage. The gap between disclosure and exploitation is now measured in minutes; the gap between advisory and action in most organisations is still measured in quarters.
"In audits, the issue I see most often is not a missing technical control; it is a system that nobody clearly owns. It may have worked quietly for years, but as soon as something goes wrong, everyone starts asking whose responsibility it was."
Alexis HirschhornCEO, Acuna GRCIs the supermarket refrigeration attack a NIS2 incident?
For most store operators, probably not. NIS2 Annex II covers food businesses in wholesale distribution and industrial processing, and the CCB's own FAQ says supermarkets are retail and generally fall outside it. But NIS2 scope is decided entity by entity, and several entities in a retail group may still be in:
| Entity type | Likely position | What to check |
|---|---|---|
| Store / retail operating company | Likely out of NIS2 scope | Still document the assessment |
| Group wholesale or distribution centre | Likely in scope as important entity | Did the event affect its services? |
| Refrigeration contractor or MSP | Case by case | Annex I managed-service definitions and size thresholds |
| CER-designated critical entity | In scope regardless of size | 24-hour notification under national CER rules |
| Any entity, GDPR | Likely not triggered | Re-assess if logs, staff credentials or CCTV were reached |
| Financial arm (e.g. a retail bank) | DORA only if its ICT third parties were affected | No sign that they were |
Who do you report to in Belgium, Luxembourg and Sweden?
All three countries use the same NIS2 incident reporting sequence, but the laws, authorities and supervision arrangements differ.
| Country | NIS2 law | Authority | Deadlines | Max penalty (essential / important) |
|---|---|---|---|---|
| Belgium | Law of 26 April 2024 | CCB (Safeonweb@Work / CERT.be) | 24 h / 72 h / 1 month | €10m or 2% / €7m or 1.4% |
| Luxembourg | Law of 5 May 2026 (+ CER law, same date) | ILR; CSSF for finance; HCPN for CER; CIRCL, GOVCERT.LU | 24 h / 72 h / 1 month | €10m or 2% / €7m or 1.4% |
| Sweden | Cybersäkerhetslagen (SFS 2025:1506) | NCSC incl. CERT-SE; MCF; sector supervisors | 24 h / 72 h / 1 month | €10m or 2% / €7m or 1.4% (reported figures; check SFS 2025:1506) |
Swedish sources disagree on how supervision is split after July 2026. Confirm your recipient before you need it.
Why is this a governance failure and not just a technical one?
Because every fix was known, cheap and public for months. The technology did what it was configured to do. What failed was ownership: of the asset, of the supplier relationship and of the advisory that should have triggered action.
Four lessons for boards and management bodies:
- NIS2 Article 20 liability is personal where you are in scope. Management must approve and oversee cyber risk measures. "We didn't know the fridges were online" is not a defence.
- Legal scope is narrower than operational risk. Being outside NIS2 did not protect a single freezer. Put OT and building systems in the risk register whatever their legal label.
- Supplier-run OT is your risk. Contracts with refrigeration and facilities providers need MFA, logging, patch SLAs, 24-hour incident notice and audit rights. The same logic drives the questions in our article on CRA supplier due diligence.
- Advisories need an owner. Someone must triage CERT-FR, CCB, CERT-SE and CIRCL alerts within 48 hours and decide whether they apply.
"When I ask leadership teams which suppliers could bring the business to a halt by morning, they usually mention payment providers and logistics firms. The company maintaining the refrigeration system seldom comes up, even though a failure there can leave shelves empty within hours. That exercise is worth repeating in every retail organisation."
Henri HaenniPresident, Abilene Group"Good governance shows itself when a security advisory arrives and somebody recognises that it applies to their systems and takes action. A policy document alone does not do that; a named owner does."
Alexis HirschhornCEO, Acuna GRCHow does a GRC platform help prevent an OT supply-chain attack like this?
A GRC platform won't patch a controller. What it does is make sure the controller has an owner, a supplier on record, a risk score, a deadline and a board-visible status. That is exactly the chain that broke on 2 November. Here is how each failure maps to Acuna GRC.
| What failed on 2 November | Acuna module | What you do there |
|---|---|---|
| Controllers missing from the inventory | Implement → Assets | Register each controller with type, location and CIAT rating; link it to the contractor, the store process and the risks it feeds |
| Nobody knew the cold chain was a single point of failure | Operate → BIA and SPOF Analysis | Put "chilled and frozen sales" in BIA scope with RTO and MTPD; SPOF Analysis surfaces assets that support several critical processes |
| Contractor access ungoverned | TPRM (Supplier Shield) | Score each refrigeration contractor on Dependency and Penetration; send one OT remote-access questionnaire as a campaign; collect scan outputs and firewall configs as evidence, reused until they expire; turn gaps into findings |
| Subcontractors invisible | TPRM (Supplier Shield) → Supply Chain | Record who the contractor delegates monitoring to, in the supplier's Supply Chain tree |
| Known CVEs, no deadline | Vulnerability management | Pull Tenable, Qualys or Rapid7 results (or a CSV), match items to the controller assets, and get one issue per CVE with an SLA (14 days for critical by default) and escalating reminders |
| End-of-life units left running | Assure → Exceptions | Record each legacy unit as a time-bound exception with an approver and valid-until date, so "we'll replace it next year" becomes a decision someone signed |
| Unclear NIS2 / CER scope per entity | Comply → Frameworks and Scopes | Assign NIS2 and GDPR to each legal entity through scopes, and import your national CER rules as a custom framework; mark requirements Not applicable with a written justification |
| Many countries, no single view | Group management | Group Compliance shows each subsidiary's risks, vulnerabilities and suppliers side by side; a Group KPI such as "OT interfaces exposed to the internet" rolls up to one board figure |
| Was every country actually fixed? | Evaluations | Run a frozen gap assessment of each subsidiary against your OT control set and dispatch findings into its own Issues |
| Evidence lost in the scramble | Assure → Issues | Log the event as an Incident with a dated, backdatable timeline and files per step: configs, logs, photos, insurer contact |
| Store teams didn't know the playbook | Staff Portal | Publish the OT incident and cold-chain playbook; run an acknowledgement campaign for everyone or for identity provider groups such as store teams, with reminders and a CSV export as proof |
| Questions under pressure | Aiko | Ask which threats can affect availability, which assets a threat exposes, or whether a risk still matches its evidence, open vulnerable items included |
A 30-day path in Acuna
- 1Week 1: inventoryAdd every refrigeration, HVAC and building controller under Assets and link it to its contractor in Supplier Shield.Freezer controller, store 12, linked to its refrigeration contractor
- 2Week 2: contractorsLaunch an OT remote-access questionnaire campaign to all facilities contractors; require exposure-scan evidence.One campaign, one questionnaire, a scan output from each contractor
- 3Week 3: vulnerabilitiesConnect your scanner or import a CSV into Vulnerability management; set the severity floor and SLAs.CVE-2025-41451 on 14 controllers becomes one issue with a due date
- 4Week 4: scope and boardRecord NIS2 and CER scope per entity, approve exceptions for legacy units, and add the OT KPI to the board dashboard.KPI: OT interfaces exposed to the internet, target 0
Week 2 is where most of the value sits: a well-built vendor risk assessment questionnaire turns "our contractor handles it" into answers you can check.
What should CISOs and compliance officers do this week?
Start with exposure, then access, then paperwork. This list follows the CERT-FR and CCB recommendations.
- Get written confirmation from every refrigeration and building-services contractor that no controller you rely on is reachable from the internet, with a scan output or firewall config as proof.
- Scan your corporate, store and contractor IP ranges for StoreView, XWEB and similar login pages.
- Check controllers for unexpected setpoints, longer defrost durations or new user accounts; factory-reset any compromised unit, as the CCB advises.
- Rotate all controller passwords and remove default or date-based credentials.
- Force contractor access through an MFA-protected VPN or zero-trust broker with named accounts.
- Upgrade Danfoss AK-SM 800A to R4.3.1 or later and list end-of-life units with a replacement budget.
- Add temperature alarms that do not depend on the controller under attack.
- Classify each legal entity against NIS2, CER, GDPR and DORA and record the result.
- Run a 60-minute tabletop of the 24-hour, 72-hour and one-month reporting sequence with the right authority.
- Check insurance terms before cutting contractor data links, and preserve evidence first.
- Brief the board, name a remediation owner and deadline, and minute the decision.
For the wider programme behind these steps, see NIS2 compliance in Acuna GRC.
Where can GRC teams learn to govern OT and supplier risk?
Tools only work when people know what to look for. That is why Acuna works hand in hand with Abilene Academy, a Swiss professional training organisation. Henri Haenni, President of Abilene Group, is a PECB Certified Trainer and lecturer at Université Paris 1 Panthéon-Sorbonne. Training built around real incidents like this one lets learners practise the decisions that matter: who owns a device, which entity reports, and what a board needs to hear.
Three learning paths fit the 2 November lessons:
- NIS2 scope and incident reporting. Classify entities, run the 24/72-hour clock, and work with CCB, ILR and NCSC requirements. Courses: NIS 2 Directive Foundation, NIS 2 Directive Lead Implementer and, for the incident process itself, ISO 27035 Lead Incident Manager.
- Third-party and OT supplier risk. Write security clauses, design remote-access standards and assess contractors with evidence, not promises. Courses: ISA/IEC 62443 Lead Implementer, which covers supply chain management for industrial systems, and Lead SCADA Security Manager, which covers third-party vendors and remote access.
- Board briefing for management bodies. Help directors meet their Article 20 training duty and ask the right questions about operational technology.
Learn more at Abilene Academy.
Sources
Incident facts come from Acuna's internal threat briefing of 2 November 2026 and the public sources below, all accessed on 2 November 2026. Sabcobel's statement is reported by L'essentiel and Euronews. The Financial Times report, Sekoia's findings on the French controllers and the CCB NIS2 FAQ are named without a link.
- CERT-FR (ANSSI), alert CERTFR-2026-ALE-012 on remote controllers of refrigeration installations, 12 October 2026, revised 13 and 16 October 2026
- Centre for Cybersecurity Belgium (CCB), "Warning: Security Incidents in France Targeting Remote Controllers of Refrigeration Installations, patch immediately!", 13 October 2026
- Centre for Cybersecurity Belgium (CCB), Frequently Asked Questions (FAQ) NIS2 in Belgium, version 2.0, February 2025
- Claroty Team82, "Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers", 9 August 2026
- Claroty Team82, "Firmware to Root in 30 Minutes: How AI is Changing Threat Intelligence", 13 October 2026
- CISA, ICS advisory ICSA-25-140-03, Danfoss AK-SM 8xxA Series (Update A), 26 August 2025
- ILR, NIS 2 (Act of 5 May 2026)
- Government of Luxembourg, "Cybersécurité: l'ILR présente la nouvelle loi NIS 2", 6 July 2026
- Riksdagen, Cybersäkerhetslag (SFS 2025:1506)
- Reuters (via NBC News), "European supermarkets hit by new fridge cyberattack", 2 November 2026
- BBC (via Yahoo News), "Shop freezers in seven European countries hit by suspected cyber-attack", 2 November 2026
- SVT, "Coop-frysar i Gävleborg utslagna i misstänkt hackerattack", 2 November 2026
- VRT NWS, "Cyberattack hits several Belgian supermarket chains", 2 November 2026
- The Brussels Times, "Suspected cyberattack hits fridges and freezers at dozens of Belgian supermarkets", 2 November 2026
- The Brussels Times, "Cyberattack on supermarket refrigeration systems spreads across Europe", 2 November 2026
- L'essentiel, "Cyberattaque chez Delhaize: des dizaines de supermarchés touchés dans leurs réfrigérateurs", 2 November 2026
- Euronews, "Cyberattack hits supermarket fridges and freezers in Europe", 2 November 2026
- Econostrum, "Des frigos chauffés à 50 °C : que sait-on de cette cyberattaque massive qui a paralysé les supermarchés ?", 12 October 2026
- Reuters and AFP (via SBS News), "Hackers hit French supermarket fridges, sparking fires and spoiling food", 13 October 2026
- Associated Press (via NY1), "Cyberattacks hit European supermarket chains and disrupt refrigeration systems", 13 October 2026
- Le Monde Informatique, "Une cyberattaque perturbe les installations frigorifiques de centaines de supermarchés", 13 October 2026
- Reuters (via The Star), "Copeland, Dixell refrigeration systems also hacked, French cybersecurity agency says", 13 October 2026
- SecurityWeek, "Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers", 15 October 2026
- CERT-SE, "CERT-SE:s veckobrev v.42", 16 October 2026
- Supermarket News, "Ahold Delhaize shuts down websites after cybersecurity issue", 12 October 2026
- Just Food, "Albert Heijn resumes online deliveries after cyber outage"
- Task & Purpose, "Pentagon investigates series of commissary freezer failures as possible cyberattack", 29 October 2026
Regulatory References
President, Abilene Group