Summary: On 2 November 2026, attackers raised the temperature of supermarket fridges and freezers in at least six European countries, three weeks after about 700 stores in France were hit. Nobody broke into the fridges. The refrigeration controllers were reachable from the internet, still used the factory login and ran software that no longer got updates. Those three weak points exist in most connected products, and the fixes are design decisions made before the first unit ships.
What happened
The attacks came in two waves. In mid-October about 700 supermarkets in France were hit. Overnight on 2 November it happened again, this time across several more countries:
| Date | What happened |
|---|---|
| 11–12 Oct 2026 | About 700 supermarkets in France hit. |
| 13 Oct 2026 | The controller vendor advises customers to take the controllers off the internet. |
| 2 Nov 2026 | Stores in Sweden, Estonia, Belgium, Luxembourg, Ireland and the Netherlands hit overnight. |
Sweden’s Coop says six of its stores were affected. Estonia’s public broadcaster ERR reported at least one store where the freezers had been set to 50 °C. A freezer at 50 °C is not a data breach. It is a physical effect in a real store, caused by changing one setting remotely.
According to reports, the targets were refrigeration controllers, mostly from Danfoss. Danfoss said the Dutch systems hit on 2 November were not on a secure network and still used the default password. After the French attack, it said most of the affected systems were outdated and no longer received security updates.
Nobody had to break the fridge
There was no clever exploit here. The controller had a login page on the open internet, the login was the one it shipped with, and the software behind it hadn’t been updated in years. Anyone who found the page could sign in and change the setpoints.
It is easy to blame the operators: they should have changed the password, put the controllers behind a firewall, replaced the old units. All true. But a supermarket chain runs refrigeration, not a security team for every device in every store. If the safe setup depends on each customer doing the right thing at each site, some of them won’t, and the attackers only need to find those.
That is why this is a product design problem first, and a network problem second.
This isn’t a fridge problem
Refrigeration controllers are just the devices that got hit this time. Most connected products can end up with the same three weak points:
- A login that ships the same on every unit. One default password, printed in the manual, shared by every device of that model. Once one is known, all of them are.
- A service page reachable from the internet. Remote access is convenient for support, so someone opens a port or enables remote login, and the device’s web page is now visible to anyone scanning the internet.
- Firmware that stops getting updates long before the device stops working. A controller keeps running for many years. If security updates stop early, the device spends most of its life with known holes.
We wrote about the same pattern a few weeks ago, when researchers found 8,547 control systems at European solar and wind parks reachable from the internet. Different industry, same three weak points.
What protects a fleet is decided before the first unit ships
None of the fixes below can be added cheaply once thousands of units are in the field. They belong in the architecture, the factory process and the update plan:
- A unique credential per device, set at the factory. Every unit gets its own identity and its own secret during production, never a shared default. If one device is compromised, the others are not.
- No open login page on the internet. The device connects out to your own secured cloud; nothing on the internet can open a connection to it. Remote actions go through the cloud, with user accounts, permissions and a log of who did what. A local web page is fine, but only on the local network.
- Signed updates for the whole time the product is in the field. The device accepts only firmware signed by you, and you keep shipping security fixes for as long as you support it. Customers should know the end-of-support date before they buy, not after.
- A way to switch a risky feature off across the whole fleet in one release. When a weakness is found, you want to disable a service or close an interface on every unit at once, not write to each customer and hope they act.
Over-the-air updates are what make the last two points work. On LaMetric we’ve shipped 250 releases over the air to a fleet of about 75,000 devices online. A fix reaches every unit without anyone visiting a site, and that only works because the update path was designed in from the start.
What the Cyber Resilience Act changes
The EU Cyber Resilience Act turns this list into law for new products with digital elements. Products have to be secure by default, so no shared default passwords. Manufacturers have to provide security updates for the support period they declare. And since 11 September 2026, they have to report actively exploited vulnerabilities within 24 hours.
That last point matters for incidents like this one. A manufacturer that has to report an exploited weakness within a day also needs a way to fix it across the fleet quickly. Reporting without a working update path only documents the problem.
To see where your own product stands, take the 5-minute CRA readiness check.
A quick test for your own product
If someone found your device’s login page today, what would it take them to get in? Four questions give a fast answer:
- Does every unit leave the factory with its own credential, or do they share one?
- Can anything on the internet open a connection to the device, or does it only connect out?
- How long will you ship signed security updates, and do your customers know that date?
- If a feature turned out to be risky tomorrow, could you switch it off on every unit in one release?
If any answer is “it depends on how the customer set it up”, that is where to start.
How we help
At Smart Atoms we harden connected devices and their update path, from the first prototype to the fleet: unique device identity from the factory, outbound-only connectivity, secure boot and signed OTA updates. See how we approach device hardening. To review your product before the next unit ships, talk to an engineer.
Source: NL Times on the 2 November attacks and Danfoss’s statement.
