Another attack on shop refrigeration: when do we take action?

Monday morning, four o'clock. Delhaize store managers receive a text message: something is wrong with the refrigeration. In Sweden, a freezer is set to +50 °C and the store manager cannot bring it down. In Belgium and the Netherlands, butchers and shopkeepers throw away their stock.

It is the second time in three weeks. "Companies have really been asleep here," ethical hacker Sijmen Ruwhof told the Dutch broadcaster NOS. That raises one question: when do we take action?

What happened

This is what was known on 2 November 2026. The investigation is ongoing, so the figures may change.

• Scale. BleepingComputer counts more than 115 shops in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Finland is also mentioned.
• Belgium. RetailDetail reports at least 76 shops, including some forty Delhaize stores, mainly smaller neighbourhood and convenience stores.
• The Netherlands. At least seventeen businesses, mainly butchers and small neighbourhood shops. As far as is known, no large chains were hit here.
• Method. The refrigeration units themselves are not broken. They received the wrong instructions through the digital controls, for example to start defrosting.
• Damage. The total is not yet known. A Belgian butcher estimates the damage at €10,000 to €15,000, and a Delhaize in Hoepertingen had to throw away at least €60,000 worth of food, according to NOS.
• Attackers. Unknown. Because no ransom appears to have been demanded and many different chains were hit, this does not look like an attack on one company. According to NOS, there is no evidence of a link with last month's attack on Albert Heijn.

It did not come out of nowhere

The painful part is how long this has been known. The control units connect the refrigeration to the internet, so that an installer can see faults remotely. Their weak spots were no secret:

• 2025: researchers find flaws in a widely used Danfoss control unit. The manufacturer issues a warning and a software update.
• August 2026: the researchers publish their findings.
• 11 and 12 October 2026: up to 700 supermarkets are hit in France. We wrote about it at the time in from cold store to server room.
• 12 October 2026: the French government warns that attacks are probably continuing, and advises taking the Danfoss, Copeland and Dixell units off the internet. Danfoss also writes to its customers.
• Night of 1 to 2 November 2026: the second wave.

A three-week warning is short for a large chain, but long enough to switch off one connection. Even so, there were still open units on 2 November.

Have companies been asleep?

Partly, yes. According to the French government, a management screen on the open internet goes against good practice. And anyone who receives a warning has to act on it.

But look at who was hit as well. In the Netherlands, mainly butchers and neighbourhood shops. At Spar, independent entrepreneurs with their own refrigeration. At Delhaize, mainly smaller stores. And the Swedish chain ICA reports that it concerned shops with a connection outside the central network.

The picture is still provisional, but the pattern is clear enough to take seriously. A butcher has no IT department. The control unit was once installed by the refrigeration installer and sits out of everyone's sight. Does a letter from the manufacturer reach the person who can do something about it? That is not just being asleep. That is a unit that belongs to nobody.

An update does not always solve it either. Many units are so old that the manufacturer no longer makes updates. And according to the Belgian refrigeration company Sabcobel, some installations also need a change to the equipment itself.

Why this also concerns your building

You may not have a freezer full of meat. But the question is the same. In an office or commercial building, climate control, lifts, access, cameras and meters are increasingly connected to a network. A supplier can often reach them remotely. That is convenient, and that is exactly why it has grown this way.

We are not saying these systems are being attacked now. We are saying that the same three things can be missing:

• An overview. Which installations can be reached from the internet? Often that is not written down anywhere.
• An owner. The landlord thinks of installations, the tenant of their own IT, the installer of maintenance. The connection falls in between.
• A plan. Who gets the alarm at four in the morning, and what do they do then?

When do we take action? How to start

Today

• Call your refrigeration or installation technician. Ask: can our control unit be reached from the internet?
• Is the answer yes? Have it taken off the open internet. The French government advises access only through a secure connection (VPN) or a protected network.
• Have the settings checked, especially the defrost schedules.
• Check your insurance first if you disconnect the technician's connection. The French warning points this out too.

This week

• List all installations with remote access: refrigeration, climate control, lifts, access, cameras and meters.
• Note for each installation who can reach it, and who is responsible.
• Ask whether the equipment still receives updates and whether the default passwords have been changed.

This month

• Replace equipment that no longer receives updates, or take it off the internet for good.
• Separate the building systems from the office network.
• Record in the contract or lease who manages the connection.
• Arrange an alarm and an emergency plan: who gets called, and where can the stock go? Some Delhaize stores used refrigerated trucks.

Do not wait for the law

European cybersecurity rules under NIS2, which apply in the Netherlands through the Cyberbeveiligingswet, mainly cover larger organisations. A butcher or neighbourhood shop usually falls outside them. And the European requirements for new products only apply from December 2027, so not to the unit that has been there for ten years.

For many shops and buildings, nobody is requiring you to do anything tomorrow. This is not legal advice, but it is the conclusion: you have to want it yourself.

What the IT-Label can do here

First, what it is not. A label does not stop an attack. Nor does the IT-Label assess how secure your refrigeration or building management system (BMS) is. It is not a hacking test.

What it does do is make the building visible. That is where action starts:

• The free Self-Scan gives you a first picture of your building in a few minutes.
• The IT-Label shows the state of the digital infrastructure, and also looks at which smart building systems are present and whether the BMS is connected to the IT network.
• The IT-Label Security Audit goes a step further. An auditor checks on site whether your network is separated from guests, other tenants and the building systems, and advises on how to improve this.

Nobody can secure a control unit that nobody knows about. Whoever knows what is in the building can act on the next warning in time.

Frequently asked questions

Who is behind the attack on the refrigeration systems?

That is not yet known. Nobody has claimed the attack and, as far as is known, no ransom was demanded.

How do I know whether my refrigeration can be reached from the internet?

Ask your refrigeration technician or installer. Also ask how they log in remotely and whether an old connection is still active, for example through a 4G modem.

Is a software update enough?

Not always. Many old units no longer receive updates. So at the very least take them off the open internet and ask your supplier about replacement.

Can my installer still reach the refrigeration once internet access is removed?

Yes, if this happens through a secure connection, such as a VPN or a protected network. Discuss this with your installer and also check what your insurance requires.

Does this also apply to offices?

The attack hit shops and refrigeration systems. But offices have comparable systems with remote access, such as climate control and access. So the same questions are useful there too.

Does the IT-Label assess the security of my refrigeration?

No. The IT-Label looks at which smart building systems are present and whether they work together, not how secure they are. The Security Audit checks whether your network is separated from the building systems. For a real test of the security, you need a specialist company.

Sources: NOS, BleepingComputer, Help Net Security, RetailDetail, Reformatorisch Dagblad, CERT-FR (CERTFR-2026-ALE-012), CISA (ICSA-25-140-03) and Wikipedia. Status: 2 November 2026. The investigation is ongoing.