Supermarket Fridge Cyberattack: Why No Alarm Fired

At a glance

Sector: Food retail · Cold chain
Where: France, Belgium, Ireland, Sweden, and four more
When: October–November 2026
Basis: Public reportingNot a customer engagement

What happened

On the night of 11–12 October 2026, someone reached the refrigeration controllers of as many as 700 French supermarkets and set them to defrost. Cabinets that should hold −18 °C were driven towards +50 °C. Intermarché and Netto were hit hardest: AFP counted at least 300 of their stores and Reuters about 150. Around 80 Coopérative U, 80 Carrefour, some 30 Monoprix and several E.Leclerc stores were affected too. Equipment melted. Some of it caught fire, and sprinkler water finished what the heat had started. France-wide losses were counted in tens of millions of euros.

The way in was not sophisticated. The controllers were Danfoss AK-SM800 and AK-SC355 units, which the manufacturer has described as legacy products no longer receiving security updates. Each ran a web server reachable from the public internet. Many were reportedly still answering to the username "admin" with the current date as the password. CERT-FR also pointed at exposed Copeland and Dixell XWEB units.

Here is the detail that matters more than any of the rest. The attack went unnoticed through the night because it did not set off any alarms, and there was nobody in the building to notice. The refrigeration controller is also the refrigeration alarm. Once it belonged to someone else, it reported that everything was fine, and it kept reporting that while the stock thawed.

Three weeks later, on the night of 1–2 November, it happened again across at least seven more countries: several dozen Delhaize, 15 Carrefour and 5 Spar stores in Belgium, Coop and ICA stores in Sweden, 13 SuperValu stores in Ireland, and sites in Estonia, Finland, the Netherlands and Luxembourg. This is not a one-off any more. It is a repeatable method against a target class that is still exposed.

But the second wave also produced the comparison this whole analysis rests on. In Ireland, Musgrave said its monitoring systems alerted it to the problem and it took immediate action. Chilled and frozen lines came off sale at 13 SuperValu stores as a precaution, and by that afternoon Musgrave said the incident was resolved and restocking was under way. Reports do not say what that monitoring was built on. They do show the outcome: same night, same method, and stores that were told in time lost a precaution instead of a holding. The variable was not better security. It was being told.

What it teaches

The loss is a function of time, not of the breach
Frozen stock does not spoil the moment a setpoint changes. It spoils as it crosses and then holds above its safe band, over hours. A defrost command discovered in fifteen minutes is an inconvenience and a service call. The same command discovered when the morning shift unlocks the door is the entire frozen and chilled holding of the store, plus the equipment, plus in some cases the building. Every euro of that loss was bought with elapsed time.
An alarm that shares a brain with the thing it watches is not an alarm
This is the structural lesson and it is not specific to refrigeration. If the device that controls a process is also the only device that reports on it, then compromising, crashing or unplugging that device removes the control and the reporting in one move, and leaves behind a screen that says everything is normal. France is what that looks like at scale.
The fix does not require fixing the controller
Nobody needed to patch an end-of-life Danfoss unit overnight to have avoided this. They needed a second, independent opinion about the temperature in the cabinet, one that did not depend on the controller being honest, reachable, or even alive. That is a much smaller and much cheaper problem than securing the installed base, and it can be solved on a weekend.
The people who carry the loss are not the people with a security team
The chains hit hardest are largely owner-operated: Intermarché has 2,168 stores, Coopérative U 1,904, E.Leclerc 766 in France, ICA around 1,300 in Sweden, SuperValu 223 in Ireland. An individual owner-operator absorbs a night like this directly. They are not going to run a SOC. They will, however, fit a sensor that tells them.

How Sentrel changes the outcome

Sensors that answer to us, not to the controller

Sentrel reads its own probes through its own gateway in the store. It does not ask the refrigeration controller what the temperature is, so a controller that has been taken over, misconfigured or switched off has no way to tell Sentrel that things are fine. The second opinion is the entire point.

Limits per cabinet, checked on every reading

Each cabinet or cold room gets its own safe band. Readings arrive on a fixed interval, thirty seconds being typical, and every one is checked against that band as it lands. A cabinet climbing out of range is a breach on the reading that leaves the band, not on a daily report.

An email the moment it breaks, and again until someone answers

A critical alert is dispatched immediately rather than batched, and it repeats on a configurable reminder interval so an unread alert keeps asking. This is what ships today, and we would rather say so plainly than imply a capability we have not finished.

Records that survive the argument afterwards

Readings are retained with their timestamps, so what the cabinet actually did, and when someone was told, is answerable weeks later. For frozen food storage in the EU that record is not optional: Regulation 37/2005 requires recording instruments and that the records be kept for a year.

What early warning is worth

What follows is an illustration, not a quotation, and it only holds if someone is able to act on the alert when it arrives. The published numbers from these two waves give us honest anchors: losses in the tens of thousands of euros at a single store, €270,000 across two stores in Alsace, around €15,000 of meat at a single independent butcher in Belgium, and tens of millions across France.

A night that nobody is told aboutFull chilled and frozen holding

Plus equipment damage, disposal, lost trading while shelves are empty, and in the worst French cases fire and water damage.

A night where someone is told in minutesA call-out, and some of the stock

Musgrave's stores were restocking the same afternoon. They still pulled every chilled and frozen line as a precaution, because early warning narrows the loss, it does not erase it.

What the monitoring costsA fraction of one such night

Sensors, a gateway and a subscription for a single store sit far below the low end of the published per-store losses.

We are not claiming we would have stopped the attacker. We would not have. Sentrel does not sit in front of your refrigeration controller and it does not patch it. What it does is remove the silence, so that the night costs you a call-out instead of your stock. Whether that trade is worth it depends on the value of what is in your cabinets, which you know better than we do.

What you end up with

Temperature readings that do not come from the device under attack
Per-cabinet safe bands checked on every reading, not on a daily summary
Critical alerts sent immediately and repeated until acknowledged
Timestamped history retained for EU Regulation 37/2005 record-keeping
Runs on the store network with no dependence on the controller vendor
Fits an owner-operated store without a security team to run it

What it runs on

Independent temperature probes
Modbus TCP
Modbus RTU
OPC-UA
Edge gateway with local buffering
Threshold and limit rules
Immediate email alerting
Retained reading history

Questions people ask

What happened in the European supermarket fridge cyberattacks?

On the night of 11 to 12 October 2026, attackers reached internet-exposed refrigeration controllers in as many as 700 French supermarkets and set them to defrost, driving freezers towards +50 °C. A second wave on 1 to 2 November hit stores in Belgium, Sweden, Ireland, Estonia, Finland, the Netherlands and Luxembourg.

Which refrigeration controllers were affected?

Reporting names legacy Danfoss AK-SM800 and AK-SC355 supervisory controllers, which Danfoss describes as no longer receiving security updates, with web interfaces reachable from the internet. CERT-FR also pointed to exposed Copeland and Dixell XWEB units.

Why did the alarms not go off in France?

In most stores the refrigeration controller is also the refrigeration alarm. Once the attacker controlled it, it kept reporting normal conditions, and with no one in the store overnight the warming went unnoticed until morning.

How can a supermarket protect its freezers from this kind of attack?

Take refrigeration controllers off the public internet, change default passwords and replace end-of-life units. Separately, add temperature monitoring that does not depend on the controller, so a compromised or failed controller cannot hide a rising temperature.

Would Sentrel have stopped the attack?

No. Sentrel does not sit in front of the refrigeration controller and does not patch it. It reads its own temperature probes through its own gateway and emails an alert the moment a cabinet leaves its safe band, so the loss is limited to the time it takes someone to respond.

What temperature records does EU law require for frozen food?

Regulation (EC) No 37/2005 requires appropriate recording instruments to monitor the air temperature where quick-frozen foods are stored, and the records must be dated and kept for at least one year.

Sources

Every figure on this page comes from the reporting below. Where accounts differ, we have used the more conservative number and said so in the text.

All case studies

The night the freezers were turned up, and the alarm stayed quiet