Small businesses that run networked refrigeration, freezers or building controls may want to review how those systems are secured and how they would respond to a disruption. An ongoing cyberattack has reportedly struck major supermarket chains across Europe, including in France, Belgium and the Netherlands, disrupting refrigeration control systems that were reportedly set to continuously defrost at 50 degrees Celsius, while deliveries and in-store pricing powered by electronic shelf labels were also apparently affected, Tom’s Hardware reported on 12 October 2026.
What happened
Tom’s Hardware, citing La Dépêche, reported that a cyberattack hit Danfoss-made refrigeration controls used by the French retailers Intermarché, Leclerc and Coopérative U, pushing their automatic defrost function, which normally runs about two hours a day, into a forced continuous cycle with the temperature set to 50 degrees Celsius. Dominique Schelcher, president of Coopérative U, confirmed on Monday morning that "A cyberattack has been affecting the refrigeration production facilities of several stores in our network since last night," and called the incident "extremely serious." Separately, NOS reported that Dutch chains Albert Heijn, Etos and Gall & Gall had websites taken offline, disrupting deliveries, and that electronic shelf labels were compromised; Belgium’s Delhaize also reported disruption.
Are you affected?
The equipment at the center of the reports is the Danfoss refrigeration controller line. In research published on 9 August 2026, Claroty Team82 described reconstructing the daily authentication routine on the Danfoss AK-SM 800A so an attacker could "generate a valid authentication code for any given day and use it to bypass the standard login process." CISA, in an advisory dated 26 August 2025, detailed two further flaws in the AK-SM8xxA Series: "Improper neutralization of alarm-to-mail configuration fields used in an OS shell command injection in Danfoss AK-SM8xxA Series, prior to version 4.3.1, may lead to post-authenticated remote code execution on an attacked system," and "A post-authenticated external control of system web interface configuration setting vulnerability exists in the Danfoss AK-SM8xxA Series prior to version 4.3.1, which could allow for a denial-of-service attack induced by improper handling of exceptional conditions."
If you run networked refrigeration or building-management controllers, consider checking whether any of them can be reached from the internet. To check, ask your IT team for an inventory of these devices, the firmware version on each, and whether any are exposed outside your local network. CISA lists versions prior to 4.3.1 as affected for the command-injection and denial-of-service flaws. Tom’s Hardware noted that it is unclear at this stage whether the two attacks are related or how widespread either of them is.
What to do now
- Inventory every networked refrigeration and building-control device, including any Danfoss AK-SM8xxA controller, and record the firmware version on each.
- Apply the vendor firmware. CISA’s advisory lists the AK-SM8xxA Series prior to version 4.3.1 as affected by the command-injection and denial-of-service flaws.
- Take these controllers off the public internet. Review with your IT team how these controllers connect to your other business systems.
- Review who can access these controllers and how their web management interface is reached.
- Confirm every cabinet or unit has a working manual override and that staff know how to return it to a safe temperature without the network.
Why one controller becomes a store-wide outage
When controllers are connected to a network, it is worth thinking about how they can be reached and keeping that access protected. In the supermarket incident the disruption reached beyond refrigeration: Tom’s Hardware reported that websites were taken down, affecting deliveries, that electronic shelf labels were compromised, disrupting in-store pricing, and that loyalty programs were suspended. Albert Heijn said, "We have immediately taken measures to protect our IT environment. Part of this involves the preventive temporary shutdown of a number of systems." Early reports indicate losses are already approaching 300,000 euros, but could run into several million euros nationwide, Tom’s Hardware reported.
The lesson for a smaller operation is that a contingency plan has to be written and practiced before an incident, not improvised during one. A study published in the Journal of Emergency Management in 2025 describing a 24-hour simulated ransomware exercise run by Assistance Publique-Hôpitaux de Paris with more than 200 participants found that procedures worked well overall, but that failings in internal and external communication and conflicting priorities among staff hampered the IT team, and that information overload at times left senior managers reacting to immediate problems rather than planning ahead. Consider writing and practicing a short response plan that sets out who disconnects what, who talks to customers, and how units can be run manually.
FAQ
Which supermarkets were hit by the refrigeration cyberattack?
French retailers Intermarché, Leclerc and Coopérative U reported disruption to their refrigeration systems. In the Netherlands, Albert Heijn, Etos and Gall & Gall had websites taken down, impacting deliveries, and Belgium’s Delhaize also reported disruption.
How were the supermarket fridges attacked?
According to reporting cited by Tom’s Hardware, Danfoss-made refrigeration controllers were affected and the automatic defrost cycle, normally about two hours a day, was reconfigured to run continuously with the temperature set to 50 degrees Celsius, pushing cabinets above food-safe levels. The source and motive remain unconfirmed.
What other systems were affected by the supermarket cyberattack?
Electronic shelf labels used for in-store pricing were compromised, websites were taken down, affecting deliveries, and loyalty programs were suspended; Albert Heijn said it had taken a number of systems offline as a precaution.