Refrigeration Attacks Return: A Second Wave Hits Supermarkets in at Least Ten European Countries, French Blood Banks and Norwegian Cold Stores

Three weeks after attackers forced the fridges and freezers of around 700 French supermarkets into defrost, the same technique has been used again, and this time it did not stop at one country or one sector. Overnight on 1 to 2 November 2026, retailers in at least ten European countries found refrigeration units warming, with setpoints pushed as high as 50C. The same night, three cold-storage sites belonging to France's national blood service were tampered with. Within two days a Norwegian warehouse store had its sprinkler system triggered by an overheating freezer, a fruit store in Hardanger saw a cold room climb to 30C, and the UK's National Cyber Security Centre confirmed "a couple of impacts" among British firms.

We covered the first wave in our analysis of the French supermarket sabotage. This article sets out what is new, who has claimed responsibility and what any business with remotely managed equipment should check this week.

What Happened

The attacks began around midnight on Sunday 1 November. Stephan Moelans, chief executive of the Belgian refrigeration installer Sabcobel, told the Belga news agency that the attackers remotely switched evaporators into defrost mode, which normally clears ice but in this case was used to heat the units. In Sweden and Estonia the reported method was simpler still: temperature setpoints were raised to 50C.

The Hacker News compiled the retailers' own statements. In Belgium and Luxembourg, Delhaize reported an "IT incident" affecting refrigeration in several dozen stores, Carrefour said around 15 of its 700 or so Belgian stores were disrupted by a cyber attack, five independently owned Spar shops and 10 to 15 Intermarché stores were hit, and IKEA confirmed a cyber incident at its Mons store. In Sweden, Coop said refrigeration had been tampered with at six or seven of its roughly 800 stores, and ICA reported a limited number of affected stores. In Ireland, Musgrave took chilled and frozen products off sale at 13 of 223 SuperValu stores. Selver in Estonia, Kesko in Finland, seven Intermarché stores in Portugal, at least four Coop stores in Sicily and an Edeka store in Reisbach, Germany, were also reported as affected, and Danfoss told the Dutch broadcaster NOS that at least 17 businesses in the Netherlands, mainly butchers and small shops, were attacked. One Belgian butcher told Reuters he lost around 15,000 euros of meat.

France: The Blood Service

The French Blood Establishment (EFS) said three of its cold-storage facilities were targeted the same night and that "temperatures and defrosting thresholds were raised to extremely high levels", according to The Independent. The weekly Le Canard Enchaîné, which first reported the incident, said units normally held at minus 30C had been reprogrammed to 110C. That figure is a setpoint rather than a measured temperature. Monitoring picked up the change before any samples were damaged, The Independent reports, and the French Health Ministry said there were no operational consequences for transfusion supplies. French authorities are investigating.

Norway: A Sprinkler System and a Fruit Store

Norway's cases arrived a day later. E24 and NRK reported that in the early hours of Tuesday 3 November someone entered the freezer system at Havaristen, a warehouse store in Ytre Enebakk in Akershus, and raised the evaporator temperature until the heat set off the sprinkler system. The fire service was dispatched at 03:11 and the owner described "damage of considerable extent". The freezer was connected to the internet through an external 4G transmitter that sat outside the company's firewall. "It was a bit unknown to us that we had one transmitter there that was unsecured," Thomas Michelsen, general manager of the store's owner Miko Trading, told NRK. That evening a technician at Ullensvang Fruktlager in Hardanger found a cold room at 30C. Only one room was in use; in peak season, its manager said, it could have been a crisis.

Næringslivets Sikkerhetsråd (NSR), the Norwegian business security council, told Digi that it had scanned the internet and found "several dozen" Norwegian refrigeration systems exposed, some still using factory passwords. Lars Magne Hovtun, who leads its preparedness centre, said several attacks were averted but that tracing the owners was "detective work" and not everyone could be warned in time. The developer news site kode24 notes that no confirmed link between the two Norwegian incidents and the wider European wave has been established. Cybergen follows Norwegian and Nordic developments closely, and these cases arrived less than a week after Norway raised its national cyber risk level to High.

The UK: Minimal Impact So Far

The UK appears to have been touched lightly. Dr Richard Horne, chief executive of the NCSC, told BBC Radio 4's Today programme on 3 November that staff had worked through the night contacting organisations with vulnerable technology exposed: "There are handfuls of organisations in the UK we've alerted and we're aware of a couple of impacts." The Association of Independent Meat Suppliers said a few of its roughly 300 members had units heat up overnight, that they were empty and that no meat was lost, ITV News reported. No major UK supermarket chain has reported being affected.

Who Is Affected

The pattern is the important part. The large chains were mostly hit at the edges of their estates: franchised or independently owned stores, sites that connect through an outside supplier, and the last locations not yet migrated to a newer system. ICA said its affected stores used an external supplier's connection outside its central network. Kesko said the equipment at its affected stores sat outside its central protections. Selver said the one store hit was the last it had not moved to a new system. In Portugal the incidents appeared to involve an outside refrigeration contractor.

Beyond the chains, the victims are small businesses: butchers, local shops, a fruit packing house, a discount warehouse. They are also no longer only retailers. Blood plasma storage, meat processing and cold storage warehousing all use the same families of remote supervisory controllers. CERT-FR's alert names the Danfoss AK-SM and AK-SC series and the Copeland and Dixell XWEB supervisors, and Danfoss has confirmed its products were involved again in November.

No group has been formally identified. On 4 November, Italian broadcaster Rai News reported that two pro-Russia hacktivist groups, NoName057(16) and Z-Pentest, had claimed the attacks on Telegram and posted what they described as a 2,500-line sample of Danfoss employee and customer logins. The channels have since been deleted. SentinelLABS, in an assessment published on 3 November and updated the next day, says the claims "have not been independently verified", treats Russian-aligned involvement as a credible hypothesis rather than an established fact, and warns that copycats and unrelated actors fit the evidence equally well. Separately, Xavier Bellekens of the threat intelligence firm Lupovis told Help Net Security that his company saw login attempts against Danfoss AK-SM controllers from 20 to 30 October, peaking on 26 October and mostly using publicly documented factory-default credentials. Belgium's federal prosecutor has opened a criminal investigation, and RetailDetail reports that the European Commission convened a meeting with ENISA and Europol.

Why It Matters

The most uncomfortable fact about the second wave is that nothing about it was new. CERT-FR published its alert on 12 October, extended the list of affected equipment the next day and updated its recommendations on 16 October. Belgium's Centre for Cybersecurity issued its own warning on 13 October, and Danfoss advised Dutch customers the same day to disconnect and reconnect only over a secure network. ANSSI's director told the French Senate on 21 October that the French compromises came down to exposed administration interfaces and weak passwords. Three weeks later the same approach worked across a continent. Sabcobel's chief executive told AFP that about 10 percent of installations had still not been fixed after the French attack, and has said that a proper fix needs physical changes as well as a software update.

That is a lesson about how slowly warnings travel through a supply chain. The equipment belongs to the store, the connection often belongs to a contractor, the controller may be a model the manufacturer no longer updates, and nobody in the retailer's security team has it on an asset list. A national alert does not reach a butcher in Hove or a fruit store in Hardanger, and it does not help a business that does not know it owns an internet-connected controller in the first place.

It is also a lesson about consequences. The October attack spoiled food. The November attacks reached medical cold storage, triggered a fire suppression system and, in the absence of early detection, could have destroyed products that cannot be replaced by a delivery the next morning. The NCSC's chief executive described the underlying cause as decades of "tech on the cheap", with end-of-life systems kept running and upgrades delayed, and listed heating and refrigeration controls alongside water and power equipment as the kind of exposed technology that can now be found and abused at scale. Because the technique is cheap and repeatable, SentinelLABS expects further incidents wherever the same access conditions persist.

What To Do Now

Find what is exposed, including what your contractors installed. Ask every refrigeration, heating, ventilation and building management contractor in writing how they reach your equipment remotely. Look specifically for 4G and 5G modems and SIM routers fitted to individual units, because these bypass your firewall entirely. Check your own public IP ranges for management interfaces, and do the same for franchised and newly acquired sites.

Take management interfaces off the internet. CERT-FR's guidance is to remove internet exposure from affected units and anything else on a public IP address, then restore remote access only through a VPN or a protected network. Filtering by a contractor's source IP address is acceptable as an emergency measure and nothing more. CERT-FR also advises checking your insurance terms before cutting a contractor's data feed.

Change default credentials and apply the hardening steps. Factory passwords featured in the Dutch and Norwegian cases. Change them on every controller, apply the manufacturer's secure configuration (for Danfoss units, CERT-FR points to the Strict security level) and update firmware where an update exists.

Review the configuration and add an independent alarm. Check defrost schedules, setpoints and alarm routing on every unit, since a controller that has been tampered with may also have had its alarms altered. A separate temperature sensor that alerts by a different route gives you a warning the attacker cannot switch off.

Plan for end-of-life equipment. CERT-FR warns that an unpatched, end-of-life controller left on the internet is very likely to be compromised and that a factory reset alone will not stop it happening again. Budget for replacement and isolate these units until then.

Rehearse the physical response. Know who can switch a cabinet or cold room to manual control at 02:00, where stock would be moved and who calls the contractor. Preserve logs and configuration records before resetting equipment where it is safe to do so, and report incidents to the NCSC and the police.

How Cybergen Can Help

Cybergen's CREST penetration testing team can map what is reachable from the internet across your sites, including equipment connected by contractors. Our cyber threat intelligence service tracks campaigns like this one across the UK, Norway and the wider Nordics, and our incident response service is available if you find a controller that has already been altered.

Frequently Asked Questions