TL;DR - Overnight on 2 November, someone got into the remote systems that control supermarket refrigeration across Europe and cranked freezers up to 50°C. Dozens of stores in Belgium, Sweden, Ireland, Luxembourg, the Netherlands and Estonia threw out food, and the BBC's count reached seven countries with Finland. It's the second attack of its kind in a month. The lesson for your house is uncomfortable and simple: anything in your home that an app can control, someone other than you holds a key to. What you need to do: change the default passwords on your smart devices, turn off remote access you never use, and move the gadgets onto your guest network. Thirty minutes, this weekend.
This is a C-letter story. The C in S.E.C.U.R.E. is Control Access, and there has never been a clearer picture of why that matters than a freezer in Sweden set to 50 degrees by a stranger.
Here is what happened. On the night of Monday 2 November, refrigeration systems at supermarkets across Europe started misbehaving. Around 40 Delhaize stores, most of them in Belgium, and 15 Carrefour stores there were hit. Thirteen SuperValu shops in Ireland. ICA and Coop stores in Sweden, where one store found its freezers had been set to 50°C, which is about 68 degrees warmer than a freezer should ever run. Stores in Luxembourg, the Netherlands and Estonia were affected too, and some outlets counted Finland as a seventh country. The company that services Delhaize's systems said the units had been switched into defrost mode, which quietly warms them. Staff arrived to cabinets of ruined chilled food and dumped it in skips, and one Belgian Delhaize store told local media it had lost about 100,000 euros of produce.
And this is the second time. Last month it was 250 to 350 supermarkets in France, and I wrote about that one: the investigation there landed on refrigeration controllers that had passed their end-of-life date years ago. This time the affected chains are different, the countries are different, and the shape is the same. Nobody walked store to store picking locks. Someone got access to the systems that manage the fridges, and that one access reached into every store at once.
Nobody has said who did this or exactly how they got in. The defrost-mode detail describes what was done once inside. It doesn't say how anyone got inside, and the investigations are open. Treat anyone who claims otherwise as a guess. But you don't need the answer to that question to learn the lesson, because the lesson sits in the design of the thing, and the same design is sitting in your kitchen.
The feature is the door
Modern refrigeration controllers in supermarkets are connected to the internet so that maintenance companies can remote in. If a cabinet drifts warm at 6am on a Saturday, the contractor checks it from their desk before sending a van. Sensible. Economical. The same logic put a camera in your doorbell and a screen on your fridge.
Your smart TV, video doorbell, robot vacuum, heat pump, baby monitor and fridge all work this way. Each one runs its own software, connects to your home network, and phones home to a cloud service run by the manufacturer or their contractor. That cloud, and the account that controls it, can reach into your house. In Europe this week it reached into dozens of supermarkets and turned a dial.
Which is why the stupidest thing about this attack is also the most useful thing. The attackers, as far as anyone can tell, did not steal card data and did not leave a ransom note. They turned the freezers up. Connected means controllable. Whoever holds the keys to the management platform holds the dial, and you need to know who holds the keys to yours.
Default passwords: the mistake that refuses to die
Now, the part my friend Seeton flagged when he sent me this story: default passwords.
Plenty of smart devices ship with a username and password printed in the manual. Admin, 1234. Admin, password. Every model of a given device ships with the same one, and the manuals are all online, so an attacker with your device's model number has its factory password in ten seconds. Industry surveys have found default credentials still active on millions of devices worldwide, and security researchers keep finding whole product lines where the password cannot be changed at all.
Important honesty: nobody has confirmed default passwords were the way into the supermarket systems, this week or last month. The investigations are open. But changing default passwords at install is on the vendor's own checklist for the refrigeration kit involved, it's the single most common IoT failure going, and it costs you nothing to fix.
Admin, admin
Let me make this concrete, because abstract advice about passwords has never changed anyone's behaviour.
In early 2022 I assessed a customer site that had a remote management module: a box that let an administrator control the power and reach the server from anywhere. The kind of gear that exists so the IT person doesn't have to drive in at 2am. Sensible, economical, the same logic as the supermarket fridges.
I typed its address into a browser from home and the login page loaded. From my kitchen. The module was sitting directly on the open internet, with no VPN in front of it and nothing filtering who could knock on the door.
Then the login. I typed admin. The password, I typed admin. I was in.
Think about what that means. The box that controls the power to the server, and opens a path onto the server itself, the digital keys to the whole site, was guarded by the two words that ship with the hardware by default and are printed in a manual that anyone can download. I could switch the power off. I could log into the server. All of it, because someone, at some point, was meant to change two words and never did.
I rang the client. The conversation took about ten minutes and the fix took about ten seconds: change the password, close the internet exposure. The scary part is how ordinary the call was. Every security person I know has a version of this story, and the client is never a fool. The module was installed by a contractor, the default login worked, nothing complained, and it sat there for years doing its job while the factory combination guarded it the whole time.
That is the exact shape of Europe's freezer night, shrunk to one building. One exposed management interface, one unchanged default, one stranger typing the world's most obvious password. The difference is scale: the supermarket attack was that story repeated across a whole continent at once.
Here is your thirty-minute list. Do it this weekend.
- Find the things in your house with an app. TV, doorbell, cameras, vacuum, heater or heat pump, fridge, washer, lights, baby monitor, speaker. Walk room to room with your phone and open the app you use for each one. This list is your real attack surface, and most people are surprised by its length.
- Change every default password. If a device came with a password printed in a manual or on a sticker, change it now to something long and unique. Where a device won't let you change its password, check whether the manufacturer has a fix, and if they don't, that device should lose its internet connection.
- Turn off remote access you never use. Every one of those apps has a settings page. If you only check the laundry from the laundry, the washer does not need to be reachable from work. Remote access off means the door is closed even if the password leaks.
- Put the smart gear on your guest network. Your router almost certainly has a guest network option. Move the gadgets onto it. Then, if one of them gets taken over, the attacker is in the guest network with your telly instead of standing next to your laptop and your work files.
- Update the ones you keep. Those apps nag about firmware updates for a reason. Install them.
That's it. None of this needs technical skill. It needs a weekend half hour and the willingness to walk around your own house naming things, which is the same muscle as every habit in the S.E.C.U.R.E. checklist.
The supermarkets had contractors and service checklists. Your place just needs a weekend half hour.
Get my free Personal Security Quick-Start Guide - the practical handbook for busy people who want to protect their families without becoming cybersecurity experts.
Plus: join 158+ Australians getting one 5-minute security briefing every Friday.
The bigger picture, briefly
The businesses running those supermarkets have harder versions of the same problem, and I went deep on that in the earlier piece: end-of-life gear nobody can patch, and contractors with remote access into hundreds of buildings. If you run a business, that article is your checklist. This one is the household version, because the same product category that cooked a French supermarket's cold room last month is humming away in your hallway.
One more thing worth saying. Nobody was hurt in either attack. The damage was food, money and a lot of Monday-morning cleanup. That's exactly what a rehearsal looks like. The same category of device, the same access pattern, sits next to things that matter more than frozen peas: door locks, baby monitors, heaters. Fixing it now, while the stakes are skips full of yoghurt, is the cheap version of this lesson.
Key Takeaways
- Freezers were sabotaged at supermarkets across Europe overnight on 2 November, at least six countries wide: Delhaize and Carrefour in Belgium, SuperValu in Ireland, ICA and Coop in Sweden, with one Swedish store finding its freezers set to 50°C.
- It's the second attack of its kind in a month, after 250 to 350 French supermarkets were hit through their refrigeration controllers in October. The shared shape: one access path reaching many buildings at once.
- Nobody has confirmed who did it or how. The method, including any claim about default passwords, is unconfirmed. The lesson doesn't wait on the investigation.
- Anything in your home that an app can control, someone other than you holds a key to. That's the C in S.E.C.U.R.E. - Control Access.
- The 30-minute fix: change default passwords, turn off remote access you don't use, put smart devices on the guest network, install updates.
FAQ
Could this happen to my fridge?
The honest answer is that your fridge, like those supermarket systems, is reachable through its manufacturer's cloud. The realistic risk to a household is smaller than to a supermarket chain, but the fix is the same and takes half an hour: change default passwords, switch off remote access you don't use, isolate the gadgets on your guest network.
Does my fridge even have a default password?
Many smart devices do, printed in the manual or on a sticker, and the manual is online. Check the app and the manufacturer's support page for your model. If the device won't let you change its password, that's a reason to keep it off the internet or replace it when the time comes.
What's a guest network and where do I find mine?
It's a separate network your router offers for visitors, and it keeps your gadgets away from your computers and phones. Log in to your router's settings page (the address and password are usually on the router itself) and look for "guest network". Every smart device then joins the guest network instead of your main one.
Is this related to the French supermarket attack last month?
The affected chains and countries are different, and no connection between the two has been announced. What they share is the target: the remote systems that manage commercial refrigeration. I covered the French attack and what businesses should audit in last month's piece.
My Take
The thing I can't shake about this story is how little it took. No stolen database, no ransom note, no dramatic breach video. Someone with access to a management platform turned a dial from however many degrees to fifty, across a whole continent, in one night, and walked away from thousands of euros of ruined food.
That's the whole argument for controlling access in one act. The dial exists because remote control earns its place, and a useful thing rarely comes with an off switch you've looked at lately. Yours haven't either. Thirty minutes this weekend: passwords changed, remote access off where you don't need it, gadgets on the guest network. Then the dial in your house belongs to you.
Mathew Clark Founder, SecureInSeconds Currently: walking around the house opening apps to find out how many things here phone home, and the answer is too many Drafted with AI assistance - read, verified, and fixed by a human.
Further Reading
- BBC: Shop freezers in seven European countries hit by cyber-attack - the store-by-store counts and the ICA 50°C detail
- The Guardian: Supermarket freezers across Europe hit by second suspected cyber-attack - the Europe-wide picture and what it means for connected devices
- French supermarket fridges at 50C: auditing the gear nobody can patch - the business-side version of this story: end-of-life controllers, contractor remote access, and the afternoon audit
- An AI agent deleted an entire TV season and the restore failed - the Control Access habit applied at home: least privilege for everything with an app
- Your Router Security Risk and How to Fix It in 10 Minutes - where to find the guest network this checklist keeps mentioning
