European supermarkets hit by a new wave of refrigeration-controller attacks
Supermarkets in multiple European countries reported refrigeration disruption on November 2. Sabcobel described remotely enabled defrost cycles; a researcher confirmed internet-facing management interfaces. Isolate controllers and restore safe settings with refrigeration specialists.
- Disclosed
- Nov 2, 2026
- Updated Nov 7, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Internet-exposed refrigeration management; exact affected models in the November wave remain unconfirmed
- industrial-control
- In the wild
- Yes
- CERT-FR confirmed the earlier compromises; EU authorities confirm the November 1–2 wave.
What happened
This is a new November wave, distinct from the French attacks covered by the October CERT-FR alert. Belga’s direct interview with Sabcobel describes attackers switching evaporators into defrost mode at Belgian supermarkets, including Delhaize, Carrefour and Spar. In a separate interview, Ahold Delhaize confirmed refrigeration disruption to Supermarket News. Broader country and store counts remain provisional; this article does not treat installer estimates as a final victim count or quantify losses.
Kevin Beaumont’s original November 2 post says he confirmed internet-facing management on affected systems with contacts, and that many systems have no patch because they are end of life. That is a researcher’s attributed observation, not a published forensic demonstration of one exploit across all stores. No specific CVE, shared attacker or connection to other retail/US incidents has been established here.
The earlier CERT-FR alert names Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb. It confirms previous compromises and supplies actionable isolation and recovery guidance, but does not establish that every November victim uses those models. Apply its steps with the device manufacturer and refrigeration contractor; there is no verified universal firmware threshold for this new wave.
The case is rated L4 because reported attacks are already disrupting physical refrigeration and putting food stock at risk. Changing a controller password or resetting it while leaving an unpatched management interface public does not remove the exposure.
The November 4 joint EU statement confirms a second wave on November 1–2 and directs operators to national advisories collected by ENISA. Ireland’s NCSC recommends checking all remotely accessible equipment, including alarms and their notification routes. In a separate measurement, Censys found 3,124 distinct hosts visible on the internet across Danfoss StoreView and Copeland/Dixell XWEB on November 5, versus 6,695 on October 9, a 53% decline. Its dataset cannot show which hosts were attacked or why a host stopped appearing.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Refrigeration controller firmware | Model-specific | No universal fixed version established; isolate EOL equipment and plan replacement |
Crime-scene timeline
Oct 12, 2026
CERT-FR warns about refrigeration-controller compromises
Earlier French wave; Danfoss AK-SM/AK-SC and Copeland/Dixell xweb are named.
Oct 16, 2026
CERT-FR revises its recovery guidance
This remains the alert’s last revision; it is not a new November alert.
Nov 2, 2026
Installers and retailers report a new European wave
Belga interviews Sabcobel about remote defrost changes; Supermarket News obtains an Ahold Delhaize statement about affected stores.
Nov 2, 13:37 UTC
Researcher reports internet-facing management on affected systems
Kevin Beaumont says he confirmed this with contacts, and warns that many devices are end of life. No named CVE or detailed forensic report accompanies the post.
Nov 3, 2026
Ireland's NCSC publishes cold-chain operator guidance
The advisory recommends reviewing all remotely accessible refrigeration equipment, including alarm and notification settings and remote-access permissions.
Nov 4, 2026
EU authorities confirm a second wave and urge immediate mitigation
ENISA and partner bodies date the new wave to November 1–2 and say affected member states are investigating.
Nov 5, 2026
Censys measures remaining public controller exposure
Censys counted 3,124 distinct internet-visible hosts across two product families, down from 6,695 on October 9. These are measurements of exposure, not attack or victim counts.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- CERT-FR CERTFR-2026-ALE-012PrimaryOctober 12 alert, last revised October 16; earlier affected families and recovery steps, not confirmation of each November device.
- Kevin Beaumont original public postPrimaryNovember 2 observation based on contacts; management exposure and EOL warning, without public forensic evidence.
- Public Mastodon status JSONPrimaryReadable original post and explicit UTC creation time.
- Belga interview with SabcobelOriginal installer interview: remote defrost manipulation, disconnection and possible food loss.
- Supermarket News interview with Ahold DelhaizeSeparate retailer statement confirms refrigeration disruption; further scope is reported, not a final victim census.
- Irish NCSC refrigeration-controller advisoryPrimaryRecommends removing direct exposure, inspecting alarms and access permissions, and checking devices regardless of manufacturer.
- ENISA and EU partners' joint statementPrimaryConfirms the November 1–2 wave and urges immediate mitigation while member states investigate.
- Censys measurements of controller exposurePrimaryOriginal host measurements for Danfoss StoreView and Copeland/Dixell XWEB, with limits on causal inference.