Supermarket freezer hack hits Europe again: 55°C in the aisles

Imagine walking into your local supermarket on a Monday morning and finding the ice cream aisle sweating. That’s not a metaphor. That’s what happened this week in Belgium, Sweden, Ireland and Luxembourg, where a supermarket freezer hack turned cold storage into something closer to a sauna.

Yes, again. Because if you followed the news in mid-October, you’ll remember the French episode: Carrefour, Intermarché, Monoprix and Coopérative U all had refrigeration systems remotely cranked up to 50°C, with Intermarché’s parent group alone reporting around 150 stores hit. CERT-FR issued an alert, everyone threw out their stock, and we all assumed the lesson had been learned.

It hadn’t.

Supermarket freezer hack, the sequel

On November 2, Delhaize identified what it politely called “an IT incident affecting the refrigeration systems in several dozen of our stores”, about 40 of them. In Belgium alone, Carrefour (around 15 stores), Intermarché, Spar, the Shop & Go corners at Q8 petrol stations and even a butcher chain got the same treatment. In Sweden, ICA and six Coop locations were affected; one manager told public broadcaster SVT the freezers had been “set to 55 degrees C”. In Ireland, at least 13 SuperValu stores run by Musgrave joined the party, as The Register reported.

The quote of the day comes from Diego Louwers, who manages the Delhaize in Overijse: “We can’t have anything worse in our line of work.” I believe him. For a grocer, a freezer at 55°C isn’t an outage, it’s a dumpster full of money.

How do you hack a fridge, anyway?

Nobody has officially confirmed the entry point for this second wave, and none of the chains would say who they think is behind it. But the French incident gave us a strong hint. Some of the affected stores were running Danfoss AK-SM and AK-SC refrigeration controllers on, in the vendor’s own words, “outdated firmware”. A quick Shodan search back then turned up more than 4,500 of these controllers sitting directly on the public internet, over half of them in France. Security firm Claroty had already disclosed a date-based authentication bypass on the AK-SM 800A, patched in August 2025.

So let’s recap: industrial controllers that regulate food safety, reachable from anywhere, with a known bypass, firmware nobody updates, and a web interface that lets you type in a temperature. You don’t need to be a nation-state to pull this off. You need a browser and a bad attitude.

That’s what bugs me most. We’ve spent years hearing about “smart retail” and connected everything, and the actual deployment looks like someone plugged a 2016 controller into the store’s internet box and walked away. The attackers didn’t break encryption. They just showed up.

Why you should care even if you don’t run a supermarket

Because your building probably has the same problem. Heating, ventilation, cold rooms, access control: all of it increasingly runs on little boxes with a web UI, and most of them were installed by a contractor who’s long gone. If you’re responsible for any of that, the practical move is painfully boring: inventory what’s exposed, put it behind a VPN or at least a firewall, and update the firmware. It’s the same story as the connected gadgets in your living room, except here the failure mode is salmonella instead of ads.

And for the rest of us: maybe check the ice cream before you buy it this week.

The internet of things was supposed to make the fridge smarter, not the attacker.