Hackers Turned Up the Heat: How Europe's Supermarket Fridges Became an ICS/OT Battleground
In the early hours of November 2, 2026, threat actors remotely manipulated industrial refrigeration controllers across supermarkets in Belgium, Sweden, Estonia, Ireland, the Netherlands, Finland, Portugal, and Italy. Attackers exploited internet-exposed Danfoss AK-SM and AK-SC series controllers—many running outdated firmware with default credentials and no VPN protection—switching units into defrost mode or raising setpoints to 50°C. Dozens of stores across chains including Delhaize, Carrefour, ICA, Coop, and SuperValu were forced to discard or pull chilled and frozen goods, with one Belgian butcher estimating €15,000 in losses. The attack mirrored a nearly identical campaign against hundreds of French supermarkets three weeks prior. This second wave confirms that ICS/OT attacks on retail cold-chain infrastructure are becoming a repeatable, scalable playbook. Attackers require no sophisticated zero-day—only internet-exposed legacy controllers with default passwords. As regulators across the EU accelerate NIS2 enforcement and critical-infrastructure owners expand OT connectivity, the window for unprotected industrial devices to be weaponized for economic disruption is widening rapidly.
Kill Chain
