Hundreds of supermarkets leave refrigeration systems online
Researchers counted 26 directly accessible systems in the Netherlands and warn of outdated security.
Follow-up to: French freezer hack puts Dutch systems on alert Thursday, 15 October 2026, 12:47
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Hundreds of supermarket refrigeration systems are still directly accessible via the internet. According to measurements by The Shadowserver Foundation, there are 26 such systems in the Netherlands, while a vulnerability makes it possible to log in with a password based on the date.
The Shadowserver Foundation counted hundreds of Danfoss refrigeration systems worldwide that are accessible from the internet. On 7 October, there were almost 550 according to the foundation; by now, 365 remain visible. In the Netherlands, 26 systems were observed. The measurement does not indicate whether all those systems are vulnerable or actually in use.
The systems regulate the temperature of refrigeration and freezing installations in supermarkets and elsewhere. If an attacker gains access, they can alter the settings. This makes security relevant to the food chain: a digital incident could affect not only websites or tills, but also the storage of perishable products.
According to Security.NL, some Danfoss systems have a vulnerability that allows authentication to be bypassed. In addition to user-set passwords, the system generates a password each day derived from the date. Anyone who knows the underlying algorithm could therefore potentially gain access.
According to reports, Danfoss released an update for the problem about a year and a half ago. Yet many systems had still not been updated. The cause may be overdue maintenance, unclear responsibility between supermarket and installer, or the fact that older equipment remains operational.
Earlier this week, the French cyber authority CERT-FR warned of the compromise of systems from Danfoss, Copeland and Dixell. The agency advises organisations to remove public internet access, update firmware and allow administration only via a secure VPN or a protected network.
The measurements do not prove that the 26 Dutch systems have been hacked. They do show that systems controlling physical functions are still directly accessible. For supermarkets, the key question therefore concerns not only changing passwords, but also closing down old management interfaces and checking the entire installation.
Also show where in Europe and in the world
One story, several perspectives
What is established
- Hundreds of refrigeration systems are accessible via the internet.
- 26 systems were observed in the Netherlands.
- Cyber authorities advise isolation, updates and secure connections.
Left
Arguments The food chain is vital infrastructure and must not depend on the voluntary security choices of individual companies. Manufacturers and retailers must bear legal responsibility for updates throughout the lifetime of equipment.
Values Food safety, public protection and the responsibility of large companies.
Consequences Mandatory security standards may burden small businesses, but reduce the risk of large-scale disruption.
Centre
Arguments Targeted standards for internet-connected industrial systems are defensible, provided they take existing installations into account and offer clear transition periods.
Values Risk-based policy, practicality and continuity.
Consequences A phased approach prevents abrupt outages, but does require oversight and transparency about who is responsible for updates.
Right
Arguments Companies managing critical equipment must put their own security in order. New rules must not result in a generic system that immediately renders every outdated installation unusable.
Values Individual responsibility, freedom to operate and proportionality.
Consequences More scope for tailored solutions can limit costs, but makes security less uniform and harder to monitor.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The figures and technical warnings were checked against Security.NL and the French cyber authority. The article explicitly distinguishes between internet accessibility and actual compromise.
- confirmed According to Shadowserver, there were 26 directly accessible refrigeration systems in the Netherlands. — Security.NL reports this figure based on Shadowserver's scan. source
- confirmed The number of visible systems fell from almost 550 to 365. — These figures are mentioned in the same report. source
- confirmed Some systems use a daily password derived from the date. — Security.NL describes this as part of the vulnerability. source
- confirmed CERT-FR advises removing internet access and routing administration through a VPN or a protected network. — These recommendations appear in the official warning. source
- uncertain The Dutch systems have not all been hacked. — The scan only indicates that systems are accessible; complete information about the status of individual systems is unavailable. source
Editor's note
The number of systems visible online comes from a scan by Shadowserver and does not prove a hack. The vulnerability, affected product series and recovery advice were described by Security.NL and CERT-FR.Sources
The story so far
- Thursday, 15 October 2026, 12:47 French freezer hack puts Dutch systems on alert
- Thursday, 15 October 2026, 19:39 Hundreds of supermarkets leave refrigeration systems online (this article)
More on this in Dutch media
- Tweakers — „cybersecurity supermarkten”
- AD — „cybersecurity supermarkten”
- RTL Nieuws — „cybersecurity supermarkten”