Hackers have found a new way to ruin a grocery store's day: log into the computers that run the fridges and tell them to defrost. For hours. On Nov 2 it happened again across northern and western Europe. This page checks the news every hour for more.
Food safety rules in Canada are simple: fridge at 4 °C or colder, freezer at −18 °C. Between 4 °C and 60 °C is the "danger zone" where bacteria multiply fast. The attackers parked freezers right in the middle of it.
Less Hollywood, more "someone left the back door open." Investigators haven't published the exact entry method, but here's what the public evidence points to.
Big stores don't control each case by hand. A supervisory controller (Danfoss AK-SM / AK-SC, Copeland XWEB and others) runs them all, and many expose a web login page to the internet so technicians can work remotely. Internet scanners list thousands of them.
Danfoss says most hit units were legacy models that no longer get security fixes. The AK-SC 355 was phased out in 2016, the same year Pokémon Go came out. Researchers had already published login bypass flaws for newer models, which had fixes.
Evaporator coils frost up, so controllers routinely switch on small heaters to melt the ice, then stop. Attackers forced defrost on and kept it there. The insulation that keeps cold in also keeps heat in, so cases cooked.
Both waves landed overnight. One Stockholm store says its attack began at 2 a.m. and wasn't noticed for hours. In France, cases ran hot for about six hours. No ransom note, no data stolen. Just spoiled food.
Each square is a country, placed roughly where it sits on a map. Numbers are the minimum stores hit. Hover for details.
Italic means the country confirmed incidents but no store count.
| Country | Wave | Retailers | Stores (min) |
|---|
The warnings were public for over a year before France's stores melted.
Honest answer: nobody knows yet, and nobody has claimed it. But the shape of the attack says a lot.
Most cyberattacks want money or information. These want neither. A SentinelOne researcher told Reuters the lack of any demand points to sabotage rather than crime for profit.
One Belgian Delhaize store estimated about €100,000 in spoiled food. Losses in France are put at tens of millions of euros. A well-known researcher called the technique close to zero skill.
Logging into an exposed control panel leaves very little behind. Experts quoted in coverage say it may never be possible to identify who did it. Treat any confident attribution you see online with caution.
In Estonia, technicians reacted within minutes and a freezer warmed only 2 to 3 degrees. In Sweden, alarms went unnoticed for hours and everything was lost. Monitoring with real people on call matters as much as any patch.
Danfoss control panels visible on the internet in France (Censys).
Bar = exposed Danfoss panels on Nov 2. Green part = share running patched firmware (4.3.1+). Censys.
US stores run the same kinds of controllers that were hit in Europe, from the same vendors. What's lower is how many sit naked on the internet compared with Europe before France's cleanup.
Canadian grocers buy from the same global refrigeration vendors, but nobody has published how many Canadian stores use these controllers or how many are reachable online.
Store counts are minimums from retailer statements and press reports as of Nov 2, 2026. Where sources disagreed, the lower number is used and the gap noted. Sources include Reuters, AFP, Bloomberg, AP/ABC, BleepingComputer, The Register, The Hacker News, Censys, Forescout, CERT-FR and Health Canada food safety guidance. Key links: Censys, Reuters via CNBC, Euronews, The Hacker News, Nextgov, Forescout via Hackread.