Somebody Else Installed It. You Own It.

Refrigeration failed at more than 115 supermarkets across six European countries after temperature settings were changed from outside. Nothing was stolen and no accounts were broken into — the loss was the stock in the freezers. The question it leaves behind fits a thirty-person office as well as it fits a grocery chain: what is on your network that your IT company never installed?

On November 2 refrigeration failed at more than 115 supermarkets across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Temperature settings had been changed from somewhere other than the shop floor. One Swedish store reported its freezers forced up to 122 degrees Fahrenheit and locked there. Nothing was stolen. No accounts were broken into. The loss was the stock. Our interest, and it is not a flattering one. If a refrigeration contractor connected a controller to your network five years ago, we probably do not know it is there either — our picture of your network is made of what somebody told us about. And the inventory this article recommends is work we would bill you for. The technical part — you can skip this box *Reported November 2, 2026 by Bill Toulas at BleepingComputer. The report describes refrigeration failures at more than 115 stores across six countries and says attackers "remotely changed temperature settings on freezers and cooling systems," and that "in some cases, hackers shut down refrigerators or activated defrosting systems, causing temperatures to rise." A store manager at the Swedish chain ICA told the broadcaster TV4 that temperature settings had been changed overnight to plus 50 degrees Celsius, which is 122 degrees Fahrenheit, and could not be changed back. How the equipment was reached has not been published, and no specific flaw has been named. Stephan Moelans, director of the refrigeration supplier Sabcobel, is quoted saying the attacker "leveraged the same vulnerability used in similar attacks last month in France," and that "a simple software update is not enough, as refrigerators also require physical modifications." Of those earlier French incidents the report says hundreds of stores were affected and names the refrigeration controllers involved, citing a French government advisory. We have now read that advisory. It is CERTFR-2026-ALE-012, issued by France's national cyber agency, first published October 12, 2026 and last updated October 16, and it names four controller families: Danfoss AK-SM, Danfoss AK-SC, Copeland xweb and Dixell xweb. It names no vulnerability and no catalogue number at all. Its risk field reads "Non spécifié par l'éditeur" — not specified by the vendor — and it frames the problem as exposure rather than a software flaw: "De manière générale l'exposition d'une interface de gestion sur Internet est contraire aux bonnes pratiques," which is to say that exposing a management interface to the internet is generally contrary to good practice. Its instructions are to remove internet exposure from the affected units and from every unit on a public address, to restore access only through a secure encrypted connection or a protected network, to check the whole configuration and the defrost settings in particular, and to confirm that default passwords have been changed. It warns that "des campagnes d'attaques sont probablement toujours en cours visant ces équipements" — attack campaigns are probably still ongoing against this equipment — and that restoring a unit to factory settings is not sufficient on its own, because it remains vulnerable afterwards. Note the tension, because we are not going to paper over it: the Belgian supplier quoted above says the attacker used "the same vulnerability" as in France, and the French government's own advisory on those French attacks says there is no named vulnerability. Both statements are here, attributed, and neither settles the other. Nothing we read says the stores hit this week used the same equipment as the French ones, and we are not claiming they did. Nobody has confirmed a cause and nobody has claimed responsibility. The report is careful about this itself: "it is unclear whether they were hit in a coordinated attack or targeted individually." The chains' own language is cooler than the headlines — ICA called it "an incident overnight affecting a small number of ICA stores operating outside ICA's central network," and Ahold Delhaize said "We have identified an IT incident affecting the refrigeration systems in several dozen stores." * This is an unfinished story and the details may change. What that actually means Equipment that is not a computer can still be on your network. A walk-in cooler with a temperature controller, a thermostat you reach from your phone, a camera recorder, a door-entry panel — each is a small computer with a login. Somebody installed every one of them, and it was usually not your IT company. It came with the fit-out, the lease or the alarm contract. Which means nobody was ever asked who would maintain it. Not through carelessness. Nothing in the process of installing a freezer asks who updates its software in 2029. The part that is actually good news The fix is a notepad, not a product. This is one of the rare security problems where the first and most valuable step costs nothing but a walk around your own building. And a short list changes the conversation permanently. Once the equipment is written down, every future question about it has somewhere to live. The caveat, which is a check rather than a fear Nobody has said how these particular attackers got in, so there is no specific thing to go and close today. Anyone telling you otherwise this week is ahead of the evidence. The check is the list itself. You are not looking for a flaw. You are looking for equipment whose maintenance nobody has claimed. What to do in ten minutes Walk the building with a notepad. Write down everything with a screen or a login that your IT company did not install. Beside each one, write who updates it. If you cannot name a person or a company, that is the finding. Ask each contractor one question: does your remote access come in through our network, or through your own connection to the equipment? Both answers are workable. Not knowing is not. Do not go unplugging things. France's advisory tells operators to check their insurance terms before cutting a contractor's data feed, because monitoring is sometimes a condition of cover. If we manage your network, ask us for the list we already have — and expect it to be shorter than your walk.