Cool Hackers, Warm Freezers: The Belgian Supermarket Hack Explained

On Monday morning 2 November 2026, store managers of dozens of Belgian supermarkets woke up to alarms on their phones. The temperature in their fridges and freezers was rising. Delhaize confirmed an "IT incident" in the refrigeration systems of about 40 stores, in Flanders and in Wallonia. Carrefour and Spar reported the same problem.

This did not come as a surprise, it was actually expected by many OT security experts we know. Three weeks ago, the same type of attack hit hundreds of French supermarkets, and we already wrote about it here. Back then, Patrick Coomans found 111 Danfoss refrigeration interfaces open on the internet in Belgium.

In this article we build up the story step by step, from simple to technical, so everyone can follow and specialists still learn something. Of course, we link it to our security education and research offering, because knowledge and awareness are golden.

Get in touch with our Cybersecurity Team!

Quick facts

/
About 40 Delhaize stores, 15 Carrefour stores and 5 Spar stores in Belgium were hit in the night of 1 to 2 November 2026
/
Temperatures went up to 15 °C, with reports of settings up to 70 °C
/
The French attack of 11 to 12 October 2026 hit hundreds of stores and caused tens of millions of euros in damage
/
Thousands of refrigeration controllers are still openly reachable on the internet in Europe
/
Patches for the known Danfoss vulnerabilities existed since 2025

From Simple to Technical: The Hack in Four Levels

Level 1: What happened?

Hackers took remote control of the computers that manage supermarket refrigeration. They put the cooling into defrost mode, so the temperature kept rising.

Belgium, night of 1 to 2 November: about 40 Delhaize stores (mostly Shop & Go, Proxy and some supermarkets), 15 Carrefour, 5 Spar and butcher De Laet & Van Haver. Temperatures up to 15 °C, reports of settings up to 70 °C (source: VRT NWS).
Also hit: stores of the Swedish chain ICA and Delhaize stores in Luxembourg (source: Euronews).
France, night of 11 to 12 October: hundreds of stores of Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc. Six hours up to 50 °C, some fires, tens of millions of euros in damage (source: Al Jazeera).

Both attacks started on a Sunday night. That is no coincidence: in weekends and on holidays there are fewer people at work, alerts get noticed later and the damage grows. And November 2nd was a day off for many in Belgium.

Level 2: IT versus OT, why fridges are vulnerable

A fridge is not a laptop. It belongs to OT, Operational Technology: technology that controls physical devices like freezers, air conditioning, solar panels, all sorts of machines in factories and port infrastructure. Other rules apply there than in classic office IT.

Long life: OT systems run 10 to 20 years. As long as it works, nobody touches it.
Rare updates: every change stops something, and downtime costs money. So updates are delayed as long as possible.
Managed by others: supermarkets usually buy refrigeration through installers, who manage it remotely over the internet. Who is responsible for security is often unclear (source: SecureWorld).
Physical impact: an IT hack steals or encrypts data. An OT hack spoils food, starts fires or stops production.

Level 3: The devices and their exposure online

The attacks target central refrigeration managers. One box per store controls all compressors, temperature settings, alarms and defrost cycles. It has a web interface, so technicians can log in from anywhere. In France, the French cyber agency CERT-FR named these devices:

Danfoss AK-SC 355: end of life since 2016, no more security updates.
Danfoss AK-SM 800: end of life since May 2021, no more security updates. Most of the hit units were these older models.
Danfoss AK-SM 800A: current product, patched in 2025, but some hit units ran old firmware.
Copeland and Dixell XWEB: also named by CERT-FR.

These devices are easy to find. Search engines like Shodan and Censys scan the whole internet. On 12 October, researchers counted 2,752 Danfoss systems online, 1,590 of them in France (source: BleepingComputer). Other scans found more than 2,600 open login pages of Danfoss and XWEB controllers (source: The Register). The exact numbers differ, but the message is the same: thousands of controllers are open on the internet.

Level 4: Deep technical, vulnerabilities and attack path

Claroty Team82 published research on the Danfoss AK-SM 800A under the telling title Freeze the Controller, Defrost the Food. Three vulnerabilities stand out. Danfoss fixed all three in firmware 4.3.1, released in August 2025:

CVE-2025-41450: a hidden "code of the day" login that derives the admin password from the date. Fixed in version 4.2 (Danfoss DSA-2025-03-01).
CVE-2025-41451: command injection after login, which lets an attacker run own code on the device. Fixed in 4.3.1 (Danfoss DSA-2025-08-01).
CVE-2025-41452: a web server configuration issue that can lead to denial of service. Fixed in 4.3.1.

The likely attack path is simple:

Scan: search Shodan or Censys for Danfoss or XWEB login pages.
Log in: use the "code of the day" bypass, default passwords or weak passwords. Old end-of-life models get no patch at all.
Act: force a continuous defrost cycle with a high temperature setting.
Timing: strike on a Sunday night, so the damage builds up for hours before anyone reacts.

Updating is not easy either. An AK-SM 800A must go from version 3.x to 4.x before it can reach 5.3.x, and 5.3.x cannot be downgraded (source: Hard2bit). As Finite State puts it in its firmware analysis: a patch that is available does not mean a fleet that is protected.

What is not (yet) confirmed

Many news articles present assumptions as facts. For France, Danfoss is confirmed, but no official source has named the vulnerability that was used. For Belgium, Delhaize has not named any vendor or device yet (source: Cypro). Nobody has claimed the attacks. And there is no sign so far of a link with the earlier IT incident at Ahold Delhaize. We will update this article when more is known.

Knowledge and Awareness Is Golden

Every step of this attack could have been stopped by someone who knew what to look for. The vulnerabilities were known, the patches existed, the devices were easy to find. What was missing, was knowledge about OT and the will to act on it. These are the lessons I also shared with the press and LinkedIn today:

Know the difference between IT and OT. Treat OT as a separate security domain, not as "just another computer". Separate them with firewalls and segmentation techniques.
OT is critical, but still treated as a second-class citizen. The warnings were public: Danfoss advisories in 2025, the American CISA in May 2025, Claroty research. Not everyone acted in time.
Get it off the internet. A management interface should never be directly reachable. Use a VPN or filtered access, as the French agency ANSSI urged. This blocks the whole attack, patched or not.
Know what you have. Keep a list of OT devices, firmware versions and end-of-life status. You cannot protect what you do not know. Ever heard of NIS2, CRA and the Machine Regulation?
Ask your installer. Make security part of the contract: who patches, who has remote access, how are passwords managed?
Compliance is more than ticking boxes. NIS2 raised some awareness, but a checklist does not change a firmware version.
Find the weak spots before the hacker does. Ethical penetration tests on OT infrastructure show what is exposed and what to fix.

What does Howest University of Applied Sciences do?

Our Bachelor Cybersecurity gives students not only IT but more and more OT knowledge.
Through security projects and services, our students, teachers and researchers carry out ethical penetration tests on the OT infrastructure of companies, followed by a report with the weak spots and the needed measures. It is much better that our students, lecturers and researchers in collaboration with your IT/OT specialists find the weak spots than a hacker, who usually has less ethical intentions.
As part of our life-long learning offering, we regularly invite experts to talk about topics like this. On December 1st, OT security specialists Nick Foulon (NVISO) and Tijl Deneut (e-BO Enterprises) explain the importance of OT Security in Critical Infrastructure. Check out the evening event programme here.
Our 8-day masterclass "Industrial Security" goes from PLCs, SCADA systems and OT protocols up to regulation like NIS2, CRA and MR, with specific attention to assessing and improving the security of industrial systems.

Sources and further reading

Become the OT Security expert that companies are looking for

Incidents like this show that companies need people who understand both IT and OT. That is exactly what our 8-day Industrial Security Masterclass is about: from network segmentation and secure remote access to IEC 62443, NIS2 and the CRA, with a strong focus on practice. Unfortunately for some, it is in Dutch this time.

The next edition starts on February 11th, 2027, weekly every Thursday from 15h till 20h30.

Authors

/
Patrick Van Renterghem, Community Builder @Cyber3Lab (AI + CyberSecurity + Web3 + Immersive Tech)

Want to know more about our team?

Visit the team page

Last updated on: 11/2/2026

TIOZ Howest