Reports say supermarket freezers were hit again; 'same method as France' is attributed to one installer

Hit again 21 days after the alert, and a same method claim with one voice

CERT-FR, the French government's computer emergency response team, published an alert on 12 October 2026 telling owners of Danfoss AK-SM and AK-SC refrigeration controllers, and of Copeland and Dixell xweb supervisors, to take their management interfaces off the Internet. Its first version is 21 days (derived) before the night of 1 to 2 November, when stores in Belgium, Sweden, Ireland, Estonia and the Netherlands, and on some reports Luxembourg and Finland, reported refrigeration driven to extreme heat, with 50 degrees Celsius the figure most often printed. The gap is a measure of time and not a finding. No source read says that any unit hit on 2 November is a model, a firmware version or an Internet exposure that the October advice covered.

Press reports call this a second wave and say it used "exactly the same mechanism" as France's. Four of the seven reports read for this briefing carry that claim or its twin: Euronews, BleepingComputer, Tom's Hardware and Help Net Security. Traced back, they cite two things: Belga, the Belgian news agency, and the chief executive of Sabcobel, a refrigeration company, speaking to Belga and to the Belgian outlet RTL. No retailer, equipment maker, prosecutor or agency is quoted saying it. The Record says it is not known whether the same people were behind both. Sabcobel installs and manages units for retailers, so its account is informed but not independent: a remedy that needs physical modification is work for an installer (inference). It may well be right. What it cannot yet be is confirmed.

Read between 15:46 and about 16:05 UTC on Monday 2 November 2026, while the story is moving. Read at source: CERT-FR's alert and Copeland's bulletin, both in full, and the news pages of Ahold Delhaize, Musgrave and the Belgian Public Prosecution Service, which carried nothing about the incident at the time. Read as press reports: The Record, Euronews, Help Net Security, BleepingComputer, Tom's Hardware and NBC News. The Register was not read, because its robots file does not allow this newsroom's user agent. Not read: Danfoss's website and the Centre for Cybersecurity Belgium (CCB) answered with an access block, ICA's site did the same, Helsinki Times refused, and The Guardian's terms bar machine use, so none was fetched past the robots file. Nothing was bypassed. So every statement here by a retailer, a prosecutor or the CCB is second hand, and each is attributed to the report that relays it.

Zoom

What the October wave established, as the primaries put it

The primaries are about France in October, not about 2 November, and they are worth reading closely because the second wave is being described by reference to them. CERT-FR's alert, first published on 12 October and last updated on 16 October, says in its summary that the team "a connaissance de nombreuses compromissions" of Danfoss AK-SM and AK-SC remote controllers and of Copeland xweb and Dixell xweb ones (this site's translation: is aware of numerous compromises). It adds that exposing a management interface to the Internet is contrary to good practice. It names no CVE, no actor and no entry path. Its risk field reads "Non spécifié par l'éditeur". On 13 October it added other targeted equipment, and on 16 October it updated its recommendations.

Its warning is the line that matters for 2 November. For equipment with no security fix (end of life), it says that keeping it on the Internet exposes it to "une très forte probabilité de compromission" (a very high probability of compromise), and that a factory reset alone is not enough, because the unit stays vulnerable and "sera certainement de nouveau compromis" (will certainly be compromised again). It also says attack campaigns are probably still under way. Copeland's own bulletin of 14 October acknowledges a vulnerability in a discontinued generation of its XWEB EVO controllers that has reached end of life, and tells owners to remove every XWEB EVO from the public Internet at once.

The Record adds that the Paris prosecutor's office told it there were around 700 victims in October's attack, and that after the French attack Danfoss and Copeland said the affected devices were mainly discontinued products that no longer received security updates. That is a press relay and not a primary; Danfoss's own pages could not be read today. For what the French wave did and did not establish when it broke, see this site's earlier briefing, written on 12 October before CERT-FR's updates. Nothing from it is restated here without a page read today.

Who counted what: the stores, by country and by source

The reports disagree on counts and on place names. The Record, published at 13:34 UTC, says more than 50 stores in Belgium and over a dozen others in Ireland, Estonia, the Netherlands and Luxembourg together. BleepingComputer, at 14:28 UTC, lists named chains from statements to it: ICA at least 4, Coop 7, Ahold Delhaize about 40 (Belgium and Luxembourg), Carrefour 15, Spar 5, Intermarche about 15, SuperValu 13 and Selver 1, with at least 17 in the Netherlands, and says more than 115 stores in all. Adding its own figures gives 100 for the named chains and 117 with the Dutch 17 (derived), so its total is consistent with its list. Euronews, updated at 15:12 UTC, gives 75 for Belgium, which equals 40 + 15 + 15 + 5 (derived), yet it also names a butchery group and an IKEA store that, it says, bring "the total to 75". Whether those two are inside the 75 or outside it cannot be told from the page. That the numbers rise with the time stamps is an inference: later reports may simply know more.

Zoom

The retailers' own words are the firmest part. Carrefour told Euronews and BleepingComputer that 15 of its 700 stores in Belgium were affected, that it "only concerns a few refrigeration units, mainly freezers" and that all stores stayed open. Ahold Delhaize spoke of "several dozen stores" and an "IT incident". Coop's statement to BleepingComputer is the least expected: the problems "ranged from completely shut-down refrigerators and freezers to partially functioning units, and in one case, the system beginning to generate heat". That is not a wave of uniform heating, and it sits oddly with a headline of 50 degrees everywhere. It is one retailer's account of its own stores, and the 50 degree figure comes from other stores.

What is said about the mechanism, and by whom

Every statement about how the freezers were heated comes through the press. The table sets each against its speaker, and says what kind of evidence it is.

Sabcobel's role is itself described four ways: an installer (Euronews, The Record), a refrigeration fitter (Tom's Hardware), a company that manufactures and installs industrial refrigeration equipment (Help Net Security), and the vendor of refrigeration systems across several of the impacted locations according to RTL (BleepingComputer). BleepingComputer says it contacted Sabcobel and was waiting for a response. The difference matters, because a manufacturer's remote service and an installer's remote access are different doors.

Zoom

Stated and not stated: the record, line by line

"Not stated" means not found in what was read. It does not mean the information does not exist.

Five labels doing the work of findings

Each phrase below is true as a description of what a source said. Each can be mistaken for a finding.

What to do, in the order worth doing

For facility and security teams at retailers and food businesses. Items marked as this site's suggestion are not in any primary. Defender level only: this lists what to find and harden, not how anything is broken.

Technical details

What the primaries publish is advice, and what the press publishes is quotation. Neither CERT-FR nor Copeland, the two primaries read, covers the 2 November incidents, and no source read gives a CVE, a hash, a domain, an address or a command line for the second wave. There are therefore no indicators to defang. The blocks below are copied exactly from saved pages. French text is the primary's own, with this site's translation in the prose above each block.

The header of CERT-FR's alert. This tells a defender which products the team names, that its risk field is unspecified, and when each version was written. The label and value pairs are joined with a colon by this site; every value is as printed.

Référence: CERTFR-2026-ALE-012
Date de la première version: 12 octobre 2026
Date de la dernière version: 16 octobre 2026
Risque: Non spécifié par l'éditeur
Systèmes affectés: Copeland xweb
Systèmes affectés: Danfoss série AK-SC
Systèmes affectés: Danfoss série AK-SM
Systèmes affectés: Dixell xweb
12 octobre 2026: Version initiale
13 octobre 2026: Ajout d'autres équipements ciblés
16 octobre 2026: Mise à jour des recommandations

The summary and the warning. The first sentence is the alert's whole factual claim. The last paragraph is the one for owners of end of life units: a factory reset removes what an intruder left behind but leaves the unit open.

Le CERT-FR a connaissance de nombreuses compromissions des controleurs à distance d'installation de réfrigération Danfoss série AK-SM, AK-SC ainsi que Copeland xweb et Dixell xweb.
De manière générale l'exposition d'une interface de gestion sur Internet est contraire aux bonnes pratiques.

ATTENTION : Des campagnes d'attaques sont probablement toujours en cours visant ces équipements. Maintenir une exposition Internet à un équipement sans correctif de sécurité (End of Life - EOL) est l'exposer à une très forte probabilité de compromission. N'effectuer qu'un Reset Factory est dans ce cas insuffisant, les persistances d'une instance compromise seront supprimées mais l'équipement restera vulnérable et sera certainement de nouveau compromis.

The actions for units that are not compromised. Note the second line, on insurance, and the third, which asks owners to check the whole configuration and in particular the defrost windows (plages de dégivrage). The compromised case adds a restart or a restore.

Si les équipements ne sont pas compromis :
Sortir de la zone de danger :
Supprimer l’exposition Internet des unités concernées et de toutes les unités exposées sur une adresse IP publique.
Vérifier les conditions contractuelles d’assurance avant de couper la remontée des données Internet vers le prestataire frigoriste.
Vérifier l’intégralité de la configuration, notamment les plages de dégivrage.
Rétablir le service :
Rétablir l’accès uniquement via un VPN sécurisé ou un réseau protégé.
Dans l'urgence, un simple filtrage des IP sources des prestataires frigoristes sur un pare-feu est possible, mais cette solution ne doit pas être considérée comme pérenne.
Mettre en place les bonnes pratiques recommandées par le constructeur (mise à jour du firmware, etc.).
Exemple pour les équipements Danfoss : mettre à jour le firmware, configurer le niveau de sécurité en mode Strict, s'assurer que les mots de passe par défaut ont été changés, etc.

Copeland's bulletin, dated 14 October 2026 on its letterhead and hosted on the French Dixell site. The first block is its acknowledgement and its summary. It concerns XWEB EVO, a generation Copeland says is discontinued and at end of life. It is a defender document and prints no exploit detail.

Nous reconnaissons l’existence de la vulnérabilité identifiée sur une génération de contrôleurs XWEB EVO dont la
commercialisation est arrêtée et qui est parvenue en fin de vie. Une enquête approfondie a été engagée ; les
recommandations qui suivent permettent de remédier à cette vulnérabilité et de garantir la sécurité des systèmes de
nos clients.
Recommandations pour une utilisation sûre des superviseurs XWEB
Synthèse
Retirez immédiatement toutes les unités XWEB EVO de l’Internet public, puis recherchez toute activité suspecte depuis le
réseau local et restaurez les appareils si nécessaire.
Le présent avis énumère des mesures complémentaires permettant de réduire le risque de cybersécurité lié aux superviseurs
XWEB EVO et explique comment remettre en état une unité ayant pu faire l’objet d’un accès non autorisé.

The immediate measures, which Copeland says apply to every XWEB EVO whether or not unauthorised access is suspected. These are the closest thing any primary offers to a precise exposure rule.

Mesures immédiates de réduction des risques
Appliquez ces mesures à chaque XWEB EVO, que vous soupçonniez ou non un accès non autorisé.
• Retirez les unités XWEB EVO de l’Internet public. Aucune redirection de port, aucune DMZ et aucune adresse
IP publique directe.
• Restreignez l’accès physique au seul personnel autorisé (par exemple, en limitant l’accès aux locaux techniques
et en utilisant des serrures à clé lorsque c’est possible).
• Utilisez un service VPN pour l’accès à distance, afin que le XWEB ne soit joignable qu’au travers d’un tunnel
chiffré et restreint.

Copeland's network and exposure advice, including a check an owner can run from outside the site without any tool, and the alarm test. Both are for defenders. Neither reveals how an attacker proceeds.

Accès à distance
• Utilisez un service VPN. Consultez votre service informatique pour mettre en œuvre le service VPN approuvé par
votre organisation.
Réseau
• Placez le XWEB sur un segment réseau dédié (VLAN), distinct des réseaux bureautiques, des réseaux des points
de vente et des réseaux Wi-Fi invités.
• N’autorisez que le trafic sortant nécessaire au XWEB (par exemple, serveur de messagerie, DNS, NTP et serveur
de mises à jour Copeland) et bloquez tout le reste.
• Vérifiez l’exposition depuis l’extérieur : à partir d’une connexion extérieure au réseau du site, par exemple un
téléphone dont le Wi-Fi est désactivé, saisissez l’adresse IP publique du site dans un navigateur. La page de
connexion du XWEB ne doit pas s’afficher.

7. Vérifiez la gestion des alarmes.
o Des catégories d’alarme existent et sont affectées aux variables d’alarme des appareils.
o Le cas échéant, les catégories d’alarme sont associées à un niveau qui déclenche l’envoi de notifications
par e-mail ou SMS, ou l’activation de relais d’alarme.
o Les destinataires des notifications par e-mail et SMS sont renseignés et corrects.
o Déclenchez une alarme de test pour vérifier que les notifications sont effectivement reçues.

The statements of 2 November that matter most, as printed in English by the reports that carry them. These are press quotations and are not primaries. Each line is a full paragraph of its report.

The chief executive of refrigeration installer Sabcobel, which manages Delhaize's fridges and freeze systems, told the Belga news outlet that the Belgian attack involves exactly the same mechanism as the previous French cyberattack.
He said the incident happened when the units' evaporators were switched to defrost mode.
The refrigeration executive said a software update alone is not enough to address the vulnerability, with physical modifications required instead.

Danfoss, the company that supplied the software for the refrigeration systems affected in both the latest incident and the one in France in October, said customers who had not updated their software were affected.
In the Netherlands, the freezing and cooling systems of at least seventeen companies were attacked last night, according to a spokesperson for supplier Danfoss. The identities of the companies were not disclosed.

“We can confirm that we have been informed of an incident overnight affecting a small number of ICA stores operating outside ICA’s central network,” stated ICA’s press officer.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores,” the company's communications department said, adding that the company "immediately took the necessary measures to keep our stores operational."
"We can confirm that a small number of stores were affected overnight into Monday - specifically 7 out of more than 800 stores," Coop told BleepingComputer.
"The impact at Carrefour is very limited: currently 15 of our 700 stores are affected, both in Flanders and Wallonia," Carrefour stated.
An ICA store manager told TV4 that temperature settings had been changed overnight to +50°C (122°F) and could not be modified, forcing the store to discard frozen food.

In Ireland, food wholesaler Musgrave said that a cyber incident had affected refrigeration systems in 13 of its SuperValu stores, forcing it to remove some chilled and frozen products from sale.
“Our monitoring systems alerted us to the issue and we took immediate action,” it said in a statement. “Our investigation is ongoing.” The company did not immediately respond to a request for comment from NBC News.
In Estonia, a company that makes the affected technology said that one of its clients had been hit by a cyberattack in which attackers accessed a computer controlling refrigeration and also turned up the temperature to 122 degrees Fahrenheit, public broadcaster ERR reported.

The arithmetic behind the counts and the gap, so a reader can re-run it. Every line is derived by this site from the figures printed by the sources named.

Gap: CERT-FR first version 12 October 2026 to the night of 1 to 2 November 2026 = 19 days to 31 October + 2 = 21 days
Gap: CERT-FR last version 16 October 2026 to 2 November 2026 = 17 days
Gap: Copeland bulletin 14 October 2026 to 2 November 2026 = 19 days
Euronews Belgium: 40 + 15 + 15 + 5 = 75
BleepingComputer Belgium: 40 + 15 + 5 + 15 = 75 (the 40 for Delhaize covers Belgium and Luxembourg)
BleepingComputer named chains: 4 + 7 + 40 + 15 + 5 + 15 + 13 + 1 = 100
BleepingComputer with the Netherlands: 100 + 17 = 117 (its text says more than 115)
Sweden, BleepingComputer: 4 + 7 = 11 or more
Temperature: (122 - 32) x 5 / 9 = 50 degrees Celsius

What could not be verified, and what was checked and set aside

The question that exposes the gap

CERT-FR told owners in plain words, 21 days before this, that a management interface on the Internet was the problem and that an end of life unit left there would very probably be compromised. Whatever the second wave turns out to be, that advice stood for three weeks. A retailer cannot find out from the press whether it applies to its own cabinets. Only an inventory can.

Which of your refrigeration controllers can be reached from the Internet today, who could say so without checking, and what would tell a person at midnight that one had started to heat?

Key facts