The fridge cyberattacks: the mistakes that made them possible, and how to protect yourself
In October and November 2026, attackers took remote control of supermarket refrigeration controllers, in France and then in several other European countries, and of plasma cold rooms at the French blood service (EFS). They forced cases into defrost and pushed setpoints to very high temperatures. No sophisticated flaw has been established: the recommendations of CERT-FR and of the manufacturer target controllers reachable from the internet, end-of-life units without updates, and default passwords. These are practices, and they can be fixed.
What happened
Night of 11 to 12 October 2026
Hundreds of French supermarkets
Refrigerated cases are forced into defrost, "up to 50 °C" according to the head of Les Mousquetaires (Intermarché); a Carrefour Market manager sees his freezers "set to 95 °C". The retailers report at least 300 Intermarché and Netto stores, fewer than 100 U stores, several Leclerc, 80 Carrefour and about thirty Monoprix. Losses quoted: €55,000 for one store, €270,000 for two others; Intermarché says its insurers do not cover this kind of incident. Source
12, 13 and 16 October 2026
The CERT-FR alert
Alert CERTFR-2026-ALE-012 covers the remote controllers of refrigeration installations from several manufacturers (Danfoss AK-SC and AK-SM series, then Dixell and Copeland xweb). It reports many compromises and campaigns "probably still ongoing". The manufacturer Danfoss says most of the systems hit in France were old models that no longer receive security updates. Source
2 November 2026
A second wave in several countries
At least Sweden, the Netherlands, Belgium, Ireland, Luxembourg and Estonia; the Belga news agency also cites Germany and Finland. In Belgium, 15 of more than 700 Carrefour stores and 5 Spar stores; in Ireland, 13 SuperValu stores, whose group says its "monitoring systems alerted us"; in Sweden, 6 Coop stores and a few ICA stores that use an external supplier. In Sweden and Estonia, setpoints are set to 50 °C. Source
2 November 2026
The French blood service’s plasma cold rooms
At a refrigeration equipment provider of the French blood service (EFS), the supervision of cold rooms at three sites is hijacked: temperature and defrost thresholds pushed to very high temperatures. The EFS surveillance and alarm systems spot the anomaly quickly, the plasma bags are moved as a precaution, and no blood products are lost. Source
On 4 November, two pro-Russian hacker groups, NoName057(16) and Z-Pentest, claimed the attacks on Telegram channels since deleted. According to the Belga news agency, the claims could not be independently verified and experts doubt the groups were really involved. No authority has named a perpetrator. In France, the Paris prosecutor opened an investigation handed to the anti-cybercrime office, and the national cybersecurity agency (ANSSI) took up the case.
The mistakes that made it possible
Several manufacturers are involved and the same recommendations apply to all of them: the problem is not a brand, it is habits in how installations are set up and run.
A controller reachable straight from the internet
Remote supervision is useful to the contractor; open on the internet without a VPN, it is useful to anyone. It is CERT-FR's first measure: remove that exposure.
An end-of-life unit that is never updated
A refrigeration controller lasts years, well beyond its software support. According to CERT-FR, an unpatched unit reachable from the internet has a very high probability of being compromised.
Default or weak passwords
CERT-FR asks for default passwords to be changed. An ethical hacker interviewed by franceinfo describes a password built on the current date; that is his analysis, not an official finding, but the advice holds either way.
Access handed to a contractor, without knowing how it is protected
At the EFS, the incident came through a refrigeration equipment provider; in Sweden, ICA speaks of stores that use an external supplier. Your contractor's access is part of your installation.
No alarm that does not depend on the controller
Where stock was saved, a monitoring system raised the alarm: the EFS's, SuperValu's in Ireland. A hijacked controller can be reprogrammed; a measurement that does not go through it is not reprogrammed with it.
The checklist for your installation
- Ask your refrigeration contractor whether your cabinets or cold rooms are supervised remotely, and how.
- If the supervisor is reachable from the internet, remove that exposure; keep only access through a secure VPN or a protected network. IP filtering is an emergency stopgap only.
- Update the firmware. The manufacturer also recommends replacing the models that no longer receive patches.
- Change default passwords and apply the manufacturer's good practice (the "Strict" security level on Danfoss units, for example).
- Check the whole configuration, in particular the setpoints and the defrost schedules.
- If the unit was compromised: cut the exposure first. A factory reset is not enough; reconfigure it before putting it back into service.
- Read your insurance contract before cutting the data feed to the contractor.
- Have a temperature measurement that does not go through the controller, with an alert that reaches someone.
- Know in advance where to move the goods and whom to call, as the EFS did.
Items 2 to 7: recommendations of alert CERTFR-2026-ALE-012.
Monitor the temperature apart from the system that controls it
The controller runs the cold and shows its own reading. If it is hijacked, what it commands and what it shows are in the same hands. A probe that only measures, connected to something other than the controller, and an alert sent to a person: that is what let the EFS move its plasma in time. It is also what manual readings do, twice a day, with their gaps at night and at weekends.
Sources
- CERT-FR, CERTFR-2026-ALE-012 - alert and recommendations, 12 to 16 October 2026
- franceinfo, 13/10/2026 - French supermarkets, retailers, losses, Danfoss statement, investigation
- NBC News / Reuters, 02/11/2026 - second wave in Europe
- Belga, via L'Avenir, 04/11/2026 - unverified claims, countries affected
- franceinfo, 04/11/2026 - cold rooms of the French blood service (EFS)
This page is updated when a new fact is confirmed by a cited source. It states nothing about the perpetrator or the access method until an authority has published them.
Frequently asked questions
Two pro-Russian hacker groups, NoName057(16) and Z-Pentest, claimed the attacks on 4 November 2026, but according to the Belga news agency the claims could not be independently verified. No authority has named a perpetrator. In France, the Paris prosecutor opened an investigation handed to the national anti-cybercrime office (Ofac). In Sweden, the national cybersecurity centre declined to speculate on who was responsible.
The attacks targeted refrigeration controllers reachable over the network, the kind a refrigeration contractor supervises remotely. A unit whose controller is connected to no network cannot be reprogrammed remotely. If your cold room or cabinets are supervised by a contractor, ask them how that access is protected.
No, according to CERT-FR: a reset removes what the attacker left on the device, but the device stays vulnerable and is likely to be compromised again if it remains exposed on the internet. Cut the exposure first, then reconfigure it and restore access through a VPN or a protected network.
Not necessarily. Intermarché said its insurers did not cover this kind of incident. Read your policy, and check it before cutting the data feed to your refrigeration contractor too: CERT-FR recommends this, because some insurance conditions depend on it.
The simplest way is to ask your refrigeration contractor: if the supervisor can be opened in a browser from outside your network, without a VPN, it is exposed. CERT-FR asks for that exposure to be removed and for access to go only through a secure VPN or a protected network.
A measurement nobody can reprogram
The KelvinTag sensor measures and controls nothing: it is connected neither to the controller nor to the regulation, and cannot change any setpoint. It alerts by email, SMS and notification the moment the range is left, as long as the relay phone is online.
See the KelvinTag sensorSee also
The other documents in the food-safety file, free to download or generate.
- Temperature log sheetGenerate a blank sheet matched to your cold enclosures and their limits, ready to post in the kitchen.Open
- Food safety plan templateThe full structure of a food safety management system - hygiene practices, HACCP plan, traceability - with your enclosures pre-filled and the questions each section must answer.Open
- Food traceability registerGoods received or opened products: a blank book ready to fill in, with the columns an inspection expects (lot, use-by, temperature on arrival).Open
- Allergen matrixDishes × 14 allergens to tick, or the Annex II list to display: the written document the rules expect front of house.Open
- Cleaning and disinfection planThe area-by-area plan to fill in, plus the daily record that proves it is applied.Open
- Storage temperaturesRegulatory storage temperatures by food category: chilled, frozen, hot holding and healthcare products.Open
- Use by and best before datesWhat each date means, what may still be sold or served once it has passed, and the article of Regulation 1169/2011 that says so.Open
- Cold-chain food recallsThe food recalls published on France's RappelConso that cite a cold-chain break: by month, category and storage temperature, with the method and the official notices.Open
- KelvinTrack getting started guideThe printable user guide: account, relay phone, adding sensors, alarms, inspections and fixes for common problems.Open
- The HACCP methodDefinition, the seven principles of Article 5 of Regulation 852/2004, the twelve steps, foodborne outbreaks and what training actually requires.Open
- Food hygiene inspectionWho inspects, which records you are asked for, and what can follow a visit - from a reminder of the rules to an order to close all or part of the premises.Open
- Temperature mappingWhen it is required (Good Distribution Practice for medicines), the method in six steps, and where the monitoring probe goes afterwards.Open
- Choosing a temperature data loggerThermometer, stand-alone logger or connected sensor: what each one proves, what Regulations 37/2005 and 852/2004 require, and the seven questions to ask before buying.Open
- Cold-chain breakFridge failure, door left open, vaccine out of the fridge: what the texts say, what decides the fate of the goods, the five moves of the first hour and the signals before a breakdown.Open
- Use-by date tracking sheetWhat is in stock and its date, for the daily check: product, lot, use-by or best-before, location, exit.Open
- HACCP and cold-chain glossaryHACCP, CCP, OPRP, TIAC, use-by and best-before dates, chilled and frozen storage, cook-chill, calibration, MKT: each term defined in a few sentences, with its official source.Open
- Mean kinetic temperature (MKT) calculatorPaste a logger's readings and get the MKT, minimum, maximum and readings out of range, computed in your browser.Open
- Food inspection barometerAlim'confiance results aggregated: how France's four hygiene levels are distributed by type of establishment, reason for inspection, region and département, with the method and its limits.Open