Supermarket Fridge Hacks 2026: What Pakistan and GCC Stores Should Check

Hackers forced defrost cycles in supermarket fridges in France and across Europe in 2026. What happened, how it worked, and what stores in Pakistan, the UAE and GCC should check now.

3 November 2026 · Deixtra

On the night of 2 November 2026, refrigeration systems in dozens of grocery stores across Europe were tampered with remotely. Fridges and freezers were switched into defrost mode or had their set points changed, and at least one store in Sweden reported units set to 50°C. Reported victims include Delhaize stores in Belgium and Luxembourg, 15 of Carrefour's 700 Belgian stores, 13 SuperValu stores in Ireland, a handful of Coop and ICA stores in Sweden, and at least 17 smaller businesses in the Netherlands, according to the refrigeration maker Danfoss.

This was the second wave in three weeks. On the night of 11 to 12 October, attackers did the same thing to hundreds of supermarkets in France, including more than 300 Intermarché and Netto stores. Some units caught fire and Paris prosecutors opened an investigation. No group has claimed either attack and no ransom was demanded.

We build POS and inventory systems for supermarkets, pharmacies and restaurants in Pakistan, the UAE and the GCC. Nothing like this has been reported in our region as of 3 November, but the same controllers and the same default password habits are common here. Below is what happened, how it worked, and what we would check this week. Sources are listed at the end.

What happened in the European supermarket fridge cyberattacks?

Attackers reached refrigeration controllers that were connected to the internet and changed how fridges and freezers ran. In France on 11 to 12 October, hundreds of supermarkets lost stock and some units caught fire. On 2 November, a second wave hit stores in Belgium, Luxembourg, Sweden, the Netherlands, Ireland and Estonia.

The French wave was the larger one. Intermarché said more than 300 of its stores, including its Netto brand, were targeted and that affected branches had to throw away all fresh and frozen products. Coopérative U and Carrefour also reported affected stores, and E.Leclerc said one of its refrigeration equipment suppliers was hit. France's national cyber agency, through CERT-FR, issued alert CERTFR-2026-ALE-012, and Prime Minister Sébastien Lecornu asked the agency to coordinate with other European countries.

The November wave started around 2 a.m. local time in Sweden, according to Reuters reporting carried by CNBC. Some reports also list Finland and Portugal; we could not confirm those in more than one source, so treat them as unconfirmed.

Reported victims so far

Date	Country	Business	What was reported
11 to 12 Oct	France	Intermarché and Netto	More than 300 stores targeted, fresh and frozen stock discarded
11 to 12 Oct	France	Carrefour	About 80 supermarkets affected, most of its stores not affected
11 to 12 Oct	France	Coopérative U, E.Leclerc	Coopérative U reported 80 to 100+ outlets (reports differ); E.Leclerc said a supplier was hit
2 Nov	Belgium, Luxembourg	Delhaize	Stores in Flanders, Wallonia and Luxembourg; refrigeration disconnected from the internet
2 Nov	Belgium	Carrefour, Colruyt (Spar), De Laet & Van Haver, IKEA	15 of 700 Carrefour stores, 5 Spar stores, 1 butcher store, 1 IKEA store
2 Nov	Sweden	ICA, Coop	A limited number of ICA stores; 6 or 7 of about 800 Coop stores (reports differ)
2 Nov	Ireland	Musgrave (SuperValu)	13 stores, one refrigeration model involved
2 Nov	Netherlands	Butchers and small grocers	At least 17 businesses, per Danfoss; no large supermarket hit

How did hackers change supermarket fridge temperatures?

They logged in to refrigeration controllers that ran a web interface reachable from the public internet. Many were old models that no longer get security updates, and in the Dutch cases Danfoss said the systems still used a default password and were not on a secure network. Once inside, attackers forced defrost cycles or raised set points.

In a supermarket, the fridges and cold rooms are usually run by a central controller (sometimes called a system manager) that the refrigeration contractor can reach remotely. That remote link is the weak point if the controller sits directly on the internet.

In France, Danfoss told AFP that most affected equipment was legacy product, and named the AK-SM800 and AK-SC355 controllers. Reporting on the CERT-FR alert says it also covered XWEB units sold under the Copeland and Dixell names, and Dutch broadcaster NOS reported that Copeland equipment was also attacked in Belgium in November. Danfoss says the AK-SC355 was phased out in 2016 and the AK-SM800 reached end of life in May 2021.

Stephan Moelans, CEO of the Belgian refrigeration company Sabcobel, said the evaporators in affected units were switched into defrost mode. At one Dutch frozen storage site, Danfoss said units normally set to minus 20°C were found at minus 10°C.

Who is behind the supermarket fridge attacks?

Nobody knows yet. No group has claimed responsibility for the French or the November attacks, no ransom demands were reported, and Reuters could not determine whether the two waves are linked. Belgium's Centre for Cybersecurity said the people behind it may never be identified.

Because nobody asked for money, several reports describe this as sabotage rather than extortion. EU Agriculture Commissioner Christophe Hansen said "food security requires more attention at all levels." Separately, the Pentagon is investigating freezer failures at at least six US military commissaries in August as suspected cyberattacks, according to Reuters.

Could this happen to supermarkets and pharmacies in Pakistan or the GCC?

Yes, if a store's refrigeration controller is reachable from the internet with a weak or default password. The attacks did not depend on anything specific to Europe. They used remote access that refrigeration contractors set up everywhere, and older controllers that are still in service in many markets, including ours.

In Pakistan, the UAE and Saudi Arabia we see the same pattern in hypermarkets, mid-size grocery chains, pharmacy chains, butchers, bakeries and cloud kitchens. Cold rooms and display units are installed and maintained by a contractor, the contractor gets remote access so they can respond to alarms, and the store owner often has no idea which IP address, port or password is involved.

The stakes are higher in a hot climate. A forced defrost in a Karachi, Dubai or Riyadh summer will warm a cold room faster than it would in Stockholm. For pharmacies, the stock at risk includes insulin, vaccines and other items that must stay in a narrow temperature range, and a single bad night can mean throwing away a full fridge. If you run batch and expiry tracking, our post on FIFO inventory and pharmacy costing explains why losses like this also distort your margins if they are not written off correctly.

What should business owners in Pakistan, the UAE and the GCC check this week?

Start by finding out whether any refrigeration controller in your stores can be reached from the internet, who has the login, and whether the password was ever changed. Then cut direct internet access, restrict remote access to known addresses, and confirm the model still gets updates.

The Dutch National Cyber Security Centre told businesses to contact their equipment suppliers, prevent direct internet access to refrigeration systems, restrict remote access to trusted IP addresses, use strong passwords and install security updates regularly. Here is how we would turn that into actions.

Make a list of every refrigeration controller, cold room panel and temperature monitoring box in each branch, with make, model and who installed it.
Ask your refrigeration contractor in writing how they connect remotely: through a VPN, a vendor cloud portal, or a port opened on the store router. A port opened directly to the controller is the setup that was attacked.
Ask whether the default password has been changed, who knows the current one, and when it was last changed. If staff or former contractors know it, change it.
Check the model against the manufacturer's support list. If it is end of life and no longer receives security updates, plan a replacement, and keep it off the internet until then.
Remove remote access for any contractor you no longer use.
Put refrigeration, CCTV and other building devices on a separate network from your POS terminals and office PCs, so a problem on one does not reach the other.
Set up temperature alarms that reach a person at night, by SMS, call or WhatsApp, and make sure someone is on call to act on them.

Who should own each check

Check	Usually owned by	What a good answer looks like
Is the controller reachable from the internet?	Refrigeration contractor and your IT person	No, remote access only through a VPN or vendor portal
Has the default password been changed?	Refrigeration contractor	Yes, unique per site, with a named person who holds it
Is the model still supported?	Contractor or manufacturer	Yes, with a current firmware version recorded
Is it on the same network as the POS?	Your IT person or POS provider	No, separate network or VLAN
Who gets night alarms?	Store or operations manager	A named person per branch, with a backup
How do losses get recorded?	Finance and inventory team	Written off by batch in the inventory system, with temperature logs kept

How should stores record and write off spoiled stock after an incident?

Record the loss in your inventory system the same day, by item and batch, with the reason and the temperature logs attached. Keep the controller logs and any alarm messages. That record is what your insurer, auditor or food safety inspector will ask for, and it keeps your stock figures honest.

Create a separate write-off reason for temperature loss, so it does not mix with expiry or theft in your reports.
Write off by batch or lot where you track them, so expiry dates and costs stay correct for the stock that survived.
Export the controller's temperature history for the affected period before anyone resets or replaces the unit.
Tell your insurer early and ask what evidence they need; policies differ on cyber events.

Restaurants and cloud kitchens face the same issue on a smaller scale. If your POS already sends sales to a tax authority, a large write-off should be recorded properly rather than adjusted by hand; our restaurant POS integration guide for PRA, SRB and KPRA covers how those systems connect.

Common mistakes and what to watch

The most common mistake is assuming the refrigeration contractor has handled security. In the French case, reporting noted that supermarkets often outsource refrigeration and cannot manage its security themselves. In the Netherlands, Danfoss said it had told customers on 13 October to disconnect from the internet, and most did, but a small number did not, and those were the ones hit.

Leaving a controller online because "it has worked for ten years." Age is the problem here: the French models were out of support.
Sharing one remote login across many branches, so one leaked password opens every store.
Relying on alarms that only show on a screen in the back office, where nobody looks at 2 a.m.
Fixing the flagship store and forgetting franchise branches, warehouses and central kitchens. In Sweden, ICA said the affected stores were operating outside its central network.

What to watch next: new advisories from CERT-FR, the Dutch NCSC and Belgium's Centre for Cybersecurity, any list of affected models from Danfoss or Copeland, and whether attacks appear outside Europe.

Key takeaways

Attackers remotely forced defrost cycles and raised temperatures in supermarket fridges in France on 11 to 12 October and in at least six other European countries on 2 November 2026.
The affected controllers were reachable from the internet, many were old models out of support, and in the Dutch cases Danfoss said default passwords were still in use.
No group has claimed the attacks and no ransom was demanded, so motive and attribution are still unknown.
Nothing similar has been reported in Pakistan or the GCC yet, but the same contractor remote access setups are common here.
Ask your contractor this week how they connect, change default passwords, take direct internet access away and separate refrigeration from your POS network.
Record any temperature loss by batch in your inventory system with logs attached, so insurance and stock figures hold up.

Frequently asked questions

Which countries were hit by the supermarket fridge hacks?

France was hit on 11 to 12 October 2026. On 2 November, stores in Belgium, Luxembourg, Sweden, the Netherlands, Ireland and Estonia reported incidents. Some outlets also list Finland and Portugal, which we could not confirm in a second source.

Which refrigeration controllers were affected?

In France, Danfoss named its legacy AK-SM800 and AK-SC355 controllers. Reports on the CERT-FR alert also mention Copeland and Dixell XWEB units, and NOS reported Copeland equipment was attacked in Belgium. Check with your manufacturer for the current list.

Was any customer or payment data stolen in the fridge attacks?

No customer or payment data theft has been reported. The attacks changed how refrigeration ran and caused stock losses. Ahold Delhaize separately reported a cyber incident to Dutch police in October and is checking whether it is linked.

Can a hacked fridge controller reach my POS system?

It depends on your network. If the controller and POS terminals share one flat network behind the same router, a compromised device is a step closer to everything else. Putting building devices on a separate network or VLAN reduces that risk.

Should I disconnect my store's refrigeration system from the internet?

Remove direct internet access, yes. Do not lose alarms in the process. Ask your contractor to move remote access behind a VPN or a supported vendor portal, limited to known IP addresses, and test that night alarms still reach someone.

Does insurance cover stock lost to a refrigeration cyberattack?

It depends on your policy. Some property and stock policies exclude cyber events, and some cyber policies exclude physical loss. Ask your broker in writing, and keep temperature logs and write-off records so you can support a claim.

Have any stores in Pakistan, the UAE or Saudi Arabia been affected?

We have not seen any reports of these attacks in Pakistan, the UAE or Saudi Arabia as of 3 November 2026. That can change, and the setups that were attacked in Europe are also used here.

Want your stock and alerts set up properly?

We are not a refrigeration contractor and we will not touch your cold room controllers. What we do is build the systems around them: inventory with batch tracking and proper write-off reasons, POS for supermarkets, pharmacies and restaurants, network separation advice for the POS side, and WhatsApp alerts that reach the right person when something goes wrong. Send us your setup on WhatsApp (number of branches, POS and inventory software, and how temperature alarms reach you today) and we will come back with a written scope and a fixed quote.

This post is based on public reporting as of 3 November 2026. Investigations in France, Belgium, the Netherlands and elsewhere are ongoing, store counts are still changing, and some details are reported by a single outlet. It is general information, not security or legal advice. For your own equipment, follow the manufacturer's and your contractor's guidance.