Hackers overheated supermarket freezers across Europe and in Finland – business owners should check their equipment’s security
Finland’s National Cyber Security Centre has confirmed that a cyberattack caused disruption at a few small K Group shops. Experts say business owners should make sure their refrigeration control panels cannot be seen from the open internet.
Martti Asikainen | 5.11.2026 | Photo by Adobe Stock Photos
Finland’s National Cyber Security Centre (NCSC-FI) confirmed on Wednesday 4 November that the disruption to supermarket refrigeration equipment on Monday 2 November was caused by a cyberattack.
Disruption was reported in Finland and at least ten other European countries, according to Finland’s public broadcaster Yle and the news agencies AFP and Reuters. The attackers raised the temperatures of the refrigeration units, and large quantities of food spoiled.
A similar attack hit hundreds of French supermarkets in October.
The final close was oversubscribed and came swiftly after the fund’s launch in March. Intera says it is the largest Finnish buyout fund to date.
Disruption at small K Group shops in Finland
In Finland, disruption was reported at a few smaller shops belonging to the K Group, one of the country’s largest retail groups. According to Juha Tretjakov, a specialist at the centre, the remote management and control system for the refrigeration equipment had been interfered with from outside.
“The devices have been reachable via the internet, and they were then attacked from outside,” Tretjakov said.
The centre identified 30 devices in Finland that were visible online and therefore exposed to attack. Tretjakov says cyber security at Finnish shops is generally in good shape. He did not comment on the details of the attack. The centre has also been in contact with foreign authorities.
In France, hackers also reportedly struck refrigeration equipment at blood banks. The centre has been in contact with Finnish healthcare providers and the Finnish Red Cross Blood Service, and the security of refrigeration equipment used in the health and social care sector has been checked.
Freezers set to 50C across Europe
In Sweden, ICA said some of the fridges and freezers in its shops were set to 50C.
Axfood and Coop also reported disruption. According to Coop, the equipment in seven of its shops was connected to older 4G networks, and the chain is speeding up its move to 5G networks and newer modems.
In Belgium, dozens of shops across several chains reported refrigeration faults, and the public prosecutor’s office has opened a criminal investigation. In Ireland, 13 SuperValu stores removed chilled products from sale.
Reports from Italy say about 20 supermarkets were hit. On Tuesday, disruption was also reported in Germany, Romania and Britain.
What is known about the equipment
Cyber security expert Markus Hölsä says he has also found vulnerabilities in Finland. Because the attacks hit hundreds of refrigeration units within a short time, he believes they were automated.
The attacker may have scanned the internet to find vulnerable devices, and there may also have been weaknesses in how the devices were secured.
Three vulnerabilities were found in 2025 in the systems of certain refrigeration models made by the Danish company Danfoss. They affect AK-SM 8xxA controllers, and the manufacturer fixed them with software updates in 2025. Authorities have not confirmed that the attackers exploited these particular flaws.
According to Hölsä, anyone using these devices should make sure the control panel cannot be seen from the public internet.
Danfoss said it had been in close contact with customers over the past three weeks, and has recommended that its systems should not be accessible directly from the internet. The company said the systems hacked in the Netherlands were not on a protected network and were using a default password.
Who is behind it?
The perpetrator is not known to the centre, and police are investigating. The motive is also unknown. Dan Cimpean, head of Romania’s cyber security agency, said the attack appears semi-amateurish and that he does not suspect a state actor.
According to Sweden’s SVT and Italy’s Ansa, two pro-Russian hacker groups, Noname057(16) and Z-Pentest, have boasted of the attacks on the dark web. The groups say they exploited built-in features of the systems and did not need malware. The claims have not been verified.
EU Agriculture and Food Commissioner Christophe Hansen warned on Monday that the attacks aim to disrupt food supplies and undermine consumer confidence.
“Although food safety is not at risk, food waste and the effects on businesses are real problems,” Hansen said.
The European Commission has said it is developing a joint response with national authorities.
What business owners should do
According to experts and the equipment manufacturer’s guidance, owners of shops and other businesses with refrigeration equipment should:
- Find out whether the device is visible on the internet. Ask the refrigeration maintenance company or equipment supplier whether the control system is connected to the public network.
- Take the device off the public network. Frank Groenewegen, a cyber security specialist at Deloitte, says that anyone who does not know should take the devices off the public network immediately. This does not fix the root cause, but it isolates the system.
- Allow remote access only through a secure connection, for example a VPN.
- Update the software. For Danfoss AK-SM 8xxA controllers, version 4.3.1 or later fixes the vulnerabilities.
- Change default passwords.
- Replace devices that are no longer supported. According to Danfoss, the vast majority of the devices hacked in France were older models or were running older software versions.
