Supermarket freezer hacks: is your walk-in cooler open to the internet?

On Monday, November 2, 2026, supermarkets in at least 10 European countries found their fridges and freezers warming up for no reason. Attackers had reached the remote controllers that run the refrigeration and changed the settings, in some stores to as high as 50°C (122°F). Stock had to be thrown out. Nothing like this has been reported in New York or New Jersey, but the same kind of equipment sits in plenty of restaurant kitchens and corner markets here. Here’s what happened, why it matters for a walk-in cooler, and a short checklist to run with your refrigeration vendor this week.

What happened in Europe

The BBC reports (opens in a new tab) problems at supermarkets in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany and Sweden. It came three weeks after a separate attack disrupted as many as 700 grocery stores in France. No one has claimed responsibility, and officials have been careful not to blame anyone.

What matters for a business owner is how the attackers got in. Italy’s government said the affected businesses were “mostly still equipped with obsolete security systems, with interfaces directly exposed to the internet and inadequate authentication mechanisms.” In Portugal, one chain said the attack appeared to target an outside service provider that manages its refrigeration systems. In other words, these were remote-control panels left reachable from the open internet, often set up and logged into by a third party.

After the French incident, France’s national computer emergency team, CERT-FR, published an alert (opens in a new tab, in French) naming the controllers it had seen compromised: Danfoss AK-SM and AK-SC series units, plus Copeland and Dixell XWEB units. Its advice was blunt. Exposing a management interface on the internet goes against basic good practice.

Why a restaurant should care

Most restaurants don’t run a supermarket-sized refrigeration system, but many have a walk-in cooler or freezer with a controller that the refrigeration company can check remotely. That’s convenient when it works. It also means there may be a small web page or app login for your walk-in sitting on the internet, with a password nobody on your team has ever seen.

A warm walk-in on a Friday night is lost product, a scramble for replacement deliveries, and possibly a food safety problem. And because the equipment is often installed and managed by the refrigeration vendor, it rarely shows up on anyone’s IT list. The POS gets attention, the Wi-Fi gets attention, and the box that keeps the fish cold gets forgotten.

A five-question check with your refrigeration vendor

You don’t need to touch the equipment yourself. Call or email the company that services your walk-in and ask:

1. Is the controller reachable from the internet? If they connect to it remotely, ask how. The answer you want is “through a VPN” or “through our secure cloud portal,” not “we open a port on your router.”
2. Who has the login, and is it still the default password? Every controller should have a unique, strong password, and old technician accounts should be removed.
3. Is the firmware up to date? CERT-FR recommends applying the manufacturer’s updates and security settings. For Danfoss units, that includes setting the security level to Strict.
4. What changes if remote access is turned off? CERT-FR also warns to check your service contract and insurance terms before cutting the data feed to your refrigeration provider, since some contracts depend on it.
5. Will you get an alert if temperatures drift? An independent temperature alert, separate from the controller itself, tells you about a problem even if the controller has been tampered with. CERT-FR also suggests checking the full configuration, including defrost schedules, for changes you didn’t make.

What to do on your own network

• Find it. Ask whoever manages your network to list every device connected to it. Refrigeration controllers, camera recorders, and building systems are often on there without a clear label.
• Close open doors. Check your router or gateway for port forwards and automatic port opening (UPnP). Anything forwarding traffic to a refrigeration controller should be removed and replaced with a VPN.
• Keep it separate. Put refrigeration, cameras, and other building equipment on their own isolated network, away from your POS, office computers, and guest Wi-Fi.
• Write it down. Keep a short note of who services each piece of equipment, how they connect, and who to call if something looks wrong.

Where Overwatch One fits

This is the kind of quiet check that gets skipped until it’s a problem. Our restaurant IT work covers Wi-Fi, POS networks, cameras, and cooler and freezer temperature alerts. With IT as a Service, businesses across New York City and Bergen County, NJ get monitoring, updates, and a team that keeps equipment like this on its own locked-down network. Our cybersecurity work looks for exactly these open doors. If you’d like us to look at your setup, start with a cybersecurity assessment, get in touch, or Ask Scott, our AI assistant.

Sources

1. BBC News: Europe on alert after supermarket freezers hit by cyber-attacks in 10 countries, Nov 3, 2026 (opens in a new tab)
2. CERT-FR: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (CERTFR-2026-ALE-012), Oct 2026, in French (opens in a new tab)

Details are from the linked sources as checked on November 3, 2026 and may change. This guide is independent and isn’t sponsored or reviewed by Danfoss, Copeland, Dixell, the BBC, or CERT-FR. Product and agency names belong to their owners.