Cyberattacks on supermarket freezers reach Estonia and Finland

Hackers turned up the heat in supermarket freezers across Europe on the night to November 2, 2026, and Estonia was among the countries hit, ERR reported. Finland also had freezer faults, Yle reported. In Estonia the store hit was Selver's last one still on its old system; in Finland the failed freezers sat outside the retailer's central protection, and a hack has not been ruled out. France's CERT-FR had warned 21 days earlier that these brands' remote controls were being compromised.

The same night, cold rooms storing blood plasma at three sites of France's blood service were also disrupted. Two Russian hacktivist groups have posted claims of hacking Danfoss, but no formal attribution has been made.

France's warning came on October 12, and the second wave landed 21 days later

Hundreds of French supermarkets, among them Intermarche, Carrefour, Leclerc and Cooperative U, found their freezers in heating mode on the night of October 11 to 12, Clubic reported. France's national CERT, CERT-FR, first warned on October 12 that the remote controls of these brands were being compromised. It names Danfoss AK-SM and AK-SC controllers and Copeland and Dixell xweb supervisors as the compromised remote-control equipment.

CERT-FR warned that campaigns against these devices were "probably still underway", and that a device with no security fix still on the internet faces a strong likelihood of compromise. The alert's last version is dated October 16. Danfoss said most of the French units were older models it no longer updates, The Hacker News reported.

The second wave came overnight into Monday, November 2. In Belgium the cooling units were switched to defrost mode, and an ICA store in Sjobo, Sweden, had its freezers set to 50°C. The Hacker News found that no chain reported more than a few dozen affected stores.

Supermarket freezers are online so contractors can run them remotely

Freezer controllers can be connected to the internet. That lets refrigeration contractors watch them and fix faults remotely, The Hacker News reported. A contractor does not have to visit every store. The same report framed a secure internet connection as the simplest answer, citing Sabcobel's chief executive.

AirVeto's own read, not from the sources: the same connection likely does everyday jobs too. It can send an alarm when a freezer warms up, keep the temperature records stores need for food safety, and schedule defrosting and energy use. That would explain why these units are online at all.

CERT-FR describes the same set-up. It tells operators to cut the data feed that goes over the internet to the refrigeration contractor, after checking their insurance terms, and allows filtering the contractor's IP addresses in an emergency.

The connection became a way in when it was left open. CERT-FR says exposing a management interface on the internet goes against good practice. It says an end-of-life device left online is likely to be compromised, and that a factory reset alone is not enough. It also tells operators to check that default passwords were changed.

The cases match this. Danfoss said most French units were older models it no longer updates. Its spokesperson said the Dutch systems were not on a secure network and still used default passwords. Kitman Coldtech, Selver's refrigeration supplier, said an older type of controller was reached.

At least nine EU countries reported freezer problems, and the count varies by outlet

Regionu zinios listed Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. Euronews counted at least 11 European countries, with Germany among them. AP named at least half a dozen and added an Athens butcher, who told Skai TV that a unit was set to 150°C.

The scale per country was small. Musgrave took chilled food off sale in 13 SuperValu stores in Ireland, Al Jazeera reported, and said that afternoon the incident was resolved and restocking was under way, The Hacker News reported. Swedish Coop counted seven of its 800 stores, and Carrefour Belgium about 15 of 700, Al Jazeera reported.

Italian counts differ. Euronews reported about 20 stores nationwide, including 4 of Coop Sicily's 300, and said the government called the impact "highly limited". Regionu zinios put it at about 20 in Sicily, citing Federdistribuzione's Giovanni Arena, and reported a separate probe in Emilia-Romagna. Alfredo Mantovano, the cabinet's deputy secretary, met the heads of Italy's intelligence services and cybersecurity agency on November 3, Regionu zinios reported.

In Estonia and Finland, the stores hit sat outside the newest protection

At a Selver supermarket in Estonia, intruders reached the control computer of an older Danfoss refrigeration system and set a freezer to 50°C, ERR reported. Selver's communications chief, Mariann Jarvela, said: "This was the last Selver store where the new system had not yet been taken into use." Kitman said other Estonian clients were hit too. The freezer warmed by only two to three degrees before staff restored it in 10 to 15 minutes, and no products were damaged.

Finland's case is thinner. A few smaller K-market stores had cold-equipment faults overnight, Kesko's security chief Petri Kayhko told Yle. Their equipment was outside Kesko's central protection, and network interference was not ruled out. A Helsinki merchant said some units were down for one to two hours and some fresh produce was lost. The National Cyber Security Centre's Roni Kokkola said it was hard to tell how large the number of affected stores was.

In both accounts the equipment that failed was not yet covered by the owner's newer or central setup, as the sources describe it. In the Netherlands, The Hacker News reported, a Danfoss spokesperson told NOS the systems hit were not on a secure network and still used default passwords.

Some of the headline temperatures are settings, not readings. The Estonian freezer was commanded to 50°C and warmed by a few degrees in minutes, and the blood-service rooms were set to 110°C against a normal minus 30°C. A Belgian butcher in Hove, south of Antwerp, did see fridges raised to as high as 18°C, which ruined about €15,000 of meat, Al Jazeera reported.

Blood plasma freezers in France were reached on the same night

France's blood service, the Etablissement francais du sang (EFS), confirmed on November 3 that a refrigeration contractor had suffered a "cybersecurity incident", franceinfo reported. The supervision and control systems of cold rooms at three EFS sites were disrupted, with temperature and defrost thresholds pushed to extreme values. The rooms held plasma bags for transfusion and for fractionation, the step that turns plasma into medicines.

Le Canard Enchaine named the contractor as Coolworld, franceinfo said. The cold rooms were programmed to rise to 110°C instead of minus 30°C, tv3.lt reported from AFP. Clubic added that 110°C was the setpoint sent to the machines, not the temperature the plasma reached.

EFS said no health impact had been identified and no blood product was lost. Its alarms flagged the anomaly, and the products were moved to other cold rooms. Health Minister Stephanie Rist's office said technical investigations continue and that monitoring and alarm systems kept the blood stocks safe. Coolworld said the vulnerability concerned a component supplied by a third party and that only a limited number of units were affected.

EFS does not publicly link the incident to the supermarket waves, and Clubic reported that nothing yet connects the perpetrators.

No government has named an actor, and the one reported claim is disputed

The BBC reported that the Russian hacktivist groups NoName057(16) and Z-Pentest Alliance posted that they had hacked Danfoss, which fed speculation that they were behind the freezers. Analysts questioned it. The French firm Sekoia said: "To date, we have no technical evidence indicating the involvement of Russian-speaking groups." The BBC also reported that Sekoia's customer report suggested the nature of the incident aligned with the activity of Russian hacktivists or the Russian government. Sekoia added that NoName057(16) is not known for operations beyond DDoS floods and has a record of false attributions. Sekoia also named Iranian-aligned actors as a possibility, given earlier incidents involving the same equipment in Israel and the US.

Official voices diverge. European Commissioner Christophe Hansen, quoted by Euronews, called the incidents "a deliberate attempt to disrupt our food supply chain". The Commission's spokesperson, Thomas Regnier, declined to say who is responsible and left that to the 27 national authorities, AP reported.

Belgium's Centre for Cybersecurity said the perpetrators "may never be determined". Romania's cybersecurity director, Dan Cimpean, told Euronews: "It seems semi-amateurish. We do not suspect, under any circumstances, that it is a state actor."

Lupovis, a Scottish security firm, saw probing of its fake freezer traps only in Europe, none in Africa, South America or Ukraine, the BBC reported. Previdian's Ryan Dewhurst said the simultaneous timing points to planning and coordination.

The freezer incidents fell in the same days as Latvia's second drone alert and Poland's border operation

On Monday, November 2, the freezer incidents reached Estonia and Finland, and Poland's police chief confirmed a special operation on the Kaliningrad border after a warning of possible sabotage. At 00:10 on November 3, Latvia declared an air threat over Balvi and Ludza, its second drone event in 29 hours.

These are separate events with separate sources. In September, Poland's digital affairs minister said the modus operandi of the Starlink station fire was "clearly Russian". For the freezers, AP reported that the Commission's Regnier declined to say who was responsible.

The next wave will find whichever devices are still exposed

CERT-FR's October alert told operators to remove internet exposure and restore access only through a VPN. It said an end-of-life device left online is likely to be compromised, and a factory reset alone is not enough. Sabcobel's chief executive, Stephan Moelans, said a software update is not enough for old installations, which need physical changes that cost money, The Hacker News reported.

AirVeto's Finland hub and the NATO eastern flank hub cover the airspace side of the same border. CERT-FR's last version, dated October 16, said the campaigns were probably still underway. The November 2 incidents followed it.

AirVeto's live map follows airspace and border incidents across the EU's eastern border as they are reconstructed.