Three weeks after cyberattacks targeted the cooling systems of hundreds of supermarkets in France, similar incidents occurred again in different European countries. Shortly after midnight on Monday, November 2, 2026, the cooling systems of stores in Belgium, Sweden, the Netherlands, Luxembourg, Ireland, and Estonia were remotely switched to defrost mode, raising temperatures to as high as 50°C. Some reports from Belgium indicated temperatures reached 70°C.
Employees arriving at their stores in the morning were met with the same scene that French retailers faced in October: heated refrigerators, spoiled goods, and large quantities of food being set aside for disposal.
It is noteworthy that both waves of attacks show similarities in terms of methods and timing. The main difference between them is the targeted countries. Publicly available system data obtained over the last three weeks sheds light on the possible reasons for this difference.
What happened on November 2nd?
Although the second wave of attacks affected fewer stores than the first, it spread across a wider geographical area.
The Record reported that more than 50 stores in Belgium and over a dozen stores in total across Ireland, Estonia, the Netherlands, and Luxembourg were affected.
According to information published by Euronews , in Belgium alone, approximately 40 Delhaize stores, at least 15 Carrefour and 5 Spar stores, as well as a butcher shop, were affected by the attacks.
In Sweden, ICA and Coop stores were targeted. According to a statement from Help Net Security , an ICA spokesperson stated that the affected stores were those with connections outside the central ICA network.
Belgian system installation company Sabcobel announced that its technicians have been working since 1:00 AM to disconnect the affected devices. The company stated that software updates as well as physical modifications to the devices may be necessary to fully resolve the issue.
In Estonia, a contracting firm reported that attackers gained access to an old Danfoss system. Dutch broadcaster NOS reported that Copeland equipment in Belgium was also targeted.
Security researcher Kevin Beaumont stated that all of the affected devices he could verify had internet-accessible management interfaces. According to Beaumont, these systems have the same security vulnerability as previous attacks, and a significant portion of the devices have reached the end of their lifecycle and are therefore not receiving security updates.
However, many aspects of the attacks remain unclear. No group has claimed responsibility for either attack, the vulnerability used has not been officially disclosed, and it has not been confirmed that the attacks were carried out by the same threat actor.
The Paris prosecutor’s office has updated the number of shops affected by the October attacks to approximately 700. This figure is roughly double the initial estimate.
France took swift action following the attacks in October.
Data from Censys, which monitors internet-accessible systems, shows that France took swift action after the attack.
Censys analyzed the changes before and after the attack by monitoring the StoreView web consoles used by Danfoss system administrators for remote access.
On October 11, there were 1,825 online StoreView consoles in France. Three days later, that number dropped to 537. According to Censys’ latest analysis published on November 2, the number had fallen to 220.
This indicates a decrease of approximately 88% in the number of systems accessible via the internet.
Censys’ research revealed that consoles with and without security updates experienced similar rates of internet inaccessibility. This suggests that businesses are choosing to disconnect from the internet rather than update their systems.
Given the national CERT alert, the ongoing legal investigation, and the widespread publicity surrounding the issue, disconnecting the connections was considered one of the swiftest measures that could be implemented.
In other European countries, the response was slower.
Countries outside of France have made more limited progress in reducing the number of systems open to the internet.
According to Censys data, on October 11, 1,166 StoreView consoles were online in countries outside of France. Three days later, that number had dropped to 966.
The report dated November 2nd stated that there were just over 1,000 StoreView consoles online worldwide, including 220 systems in France.
These data show that open systems outside of France decreased by approximately 30% over a three-week period, while the decrease in France reached 88%.
The countries affected by the second wave of attacks were among those in regions where internet access systems were still available.
According to Censys’ findings:
- 138 StoreView consoles in Belgium
- 51 StoreView consoles in the Netherlands
- 50 StoreView consoles in Sweden
It was accessible via the internet.
The Belgian example is particularly noteworthy. Despite 68% of internet-enabled consoles in the country running fully up-to-date software versions, app stores were severely affected by the attacks.
This shows that high update rates alone are not enough. Systems that haven’t received updates, devices that have reached the end of their lifespan, and equipment from different manufacturers can still pose security risks.
Furthermore, Censys’ data only covers StoreView web consoles. Older devices using different interfaces may not be included in these counts. Therefore, the actual number of internet-connected systems may be higher.
Incidents at military facilities in the US are also being investigated.
The attacks in Europe have also brought back into focus the cooling system failures that occurred in markets at military facilities in the US in late August.
In the same week, at least six military markets reportedly lost refrigerated and frozen products.
At Fort Huachuca military facility, although there was no power outage, it was announced that all freezers were switched to defrost mode overnight.
At the end of October, four officials told Reuters that the Pentagon was considering these incidents as a possible cyberattack.
French authorities have been included in the investigations conducted by the Defense Criminal Investigations Service. A unit from the US Cyber Command is also reported to be supporting the inter-agency coordination and cooperation processes with law enforcement agencies.
However, these developments do not definitively confirm that the events in the US were caused by a cyberattack. Nor is there yet any evidence directly linking them to the attacks in Europe.
Disconnecting the systems from the internet does not eliminate the security vulnerability.
Disconnecting the control systems from the internet shuts down one of the most important avenues for attackers to gain direct access.
Data from France shows that this measure can be implemented on a large scale and in a short time. However, cutting off internet access does not completely eliminate security vulnerabilities in the systems.
According to Censys’ analysis, 45% of the 220 consoles still connected to the internet in France are using software older than version 4.2.
The date-based “code of the day” entry mechanism was removed in version 4.2. The presence of this mechanism in older versions poses a significant security risk.
Even if a controller is running behind a firewall or VPN, it can still be targeted by attackers accessing the same network. For example, a compromised contractor account could offer attackers an alternative way to access systems.
Devices that have reached the end of their lifespan present a more complex problem.
There is no security patch available for systems such as the Danfoss AK-SM 800 and AK-SC 355.
The fact that the core obligations under the European Union’s Cyber Resilience Act (CRA) will come into effect in December 2027 will also not require manufacturers to update these older products.
Therefore, remote configuration changes may not be sufficient for some devices. Physical intervention, on-site maintenance, budget planning, and hardware upgrade processes may be required.
OT Systems Outside of Centralized Networks Create New Risks
The statement from Swedish retail chain ICA highlights a significant security management issue.
The fact that the affected stores had connections outside the central network suggests that these systems may have been outside the organization’s standard security monitoring mechanisms.
This situation poses a particularly common risk in cooling systems installed and managed by third-party contractors.
Standalone connections used for remote maintenance and management can become access points for attackers if adequate security controls are not implemented.
Therefore, for retail businesses, one of the first steps should be to identify which stores and which OT devices are outside the central security infrastructure.
First Wave of Attacks: What Happened in Supermarkets in France?
Cyberattacks targeting the refrigeration systems of hundreds of supermarkets in France on October 11–12 highlighted the operational risks that insecure remote access connections can create.
The attackers remotely controlled the cooling systems of numerous stores, activating defrost mode on refrigerators and freezers. System temperatures were reportedly raised to as high as 50°C.
Store employees were faced with heated refrigeration units, spoiled products, and significant operational losses in the morning hours.
According to information reported by BleepingComputer , some stores also reported that equipment had caught fire.
According to information reported by Le Monde and published by TIME, the attackers extended some de-icing cycles, which normally last an hour, to up to eight hours. This delayed the activation of alarms that were intended to alert employees.
Retail chains such as Intermarché, Netto, Coopérative U, Carrefour and Monoprix have confirmed that some of their stores have been affected.
Initial Reuters reports indicated that at least 350 supermarkets were affected by the attacks, while the Paris Public Prosecutor’s Office later updated the figure to approximately 700 stores.
Thierry Cotillard, chairman of Les Mousquetaires, stated that the attacks caused tens of millions of euros in losses across the country in just one day.
CERT-FR, affiliated with ANSSI, France’s national cybersecurity agency, confirmed numerous security breaches in Danfoss AK-SM and AK-SC series controllers in an alert (CERTFR-2026-ALE-012 ) published on October 12.
A Critical Lesson in OT Security: Remote Access Must Be Kept Under Control
These attacks, which started in France and spread to different countries in Europe, once again highlight the importance of secure remote access in OT environments.
The fact that devices managing physical processes, such as cooling systems, are directly connected to the internet shows that cyberattacks can affect not only information systems but also daily operations and physical infrastructure.
Similar risks had previously been raised in control systems used in water infrastructure and in fuel tank measuring devices at gas stations.
The US Cybersecurity and Infrastructure Security Agency (CISA) had advised organizations to remove unnecessary remote access connections and secure essential ones following attacks on water infrastructure.
The key takeaway from these events is that OT security isn’t just about protecting devices. Identifying internet-facing systems, controlling third-party access, managing legacy devices, and implementing security policies across the entire operational infrastructure are also critically important.
For organizations, increasing security visibility in OT environments and controlling remote access risks is becoming a crucial requirement to mitigate the operational and financial impact of similar attacks.