Supermarket freezer hack and the Borchardt booking breach: why AI makes old vulnerabilities dangerous

The short answer first: neither attack cracked a high-security system. Both hit technology that had been sitting on the internet, unnoticed, for years. In the supermarket refrigeration attacks, most of the controllers ran outdated firmware, according to the security firm Sekoia[1]. In the case of the Reservision booking system, used among others by Borchardt in Berlin, a security flaw let unauthorised parties pull guest data automatically from 8 November onwards[2]. There is no public evidence that the attackers used AI in either case. AI does, however, change the economics behind them: finding flaws, analysing firmware and writing convincing phishing emails now costs a fraction of what it used to[1][3]. In our assessment, systems that were safe mainly because attacking them was not worth the effort are no longer safe.

Disclosure: Avolang builds local AI agents and looks after websites, Microsoft 365 and IT systems for businesses, so we have a commercial interest in this topic. The situation is still developing: investigations are ongoing, and statements by authorities and companies may change. We rely on official alerts, analyses by security firms and media reports, cite a source for every statement and label our own assessments as such. All information as of 11 November 2026. This article does not constitute legal advice.

Supermarket freezer hack: what happened in the stores

On the night of 11 to 12 October 2026, unknown attackers in France went after the refrigeration controllers of supermarkets. The targets were Danfoss system managers of the AK-SM and AK-SC series, which centrally control a store's chilled counters, cold rooms and freezers. The attackers switched the units to continuous defrost and set setpoints of up to 50 °C; in some freezers the temperature rose above 25 °C[4]. At Les Mousquetaires, the group behind Intermarché, around 150 stores were hit, at Carrefour around 80[4].

The scale has since grown considerably. The Hacker News reports around 700 affected retail sites in France, food losses of several tens of millions of euros and at least 15 to 20 fires[5]. According to Sekoia, the attackers set three cold rooms of the French blood service to 110 °C[1]. To keep anyone from stepping in in time, they changed alarm thresholds as well as setpoints and defrost cycles[1][9].

Second wave: freezers hacked in Germany too

On the night leading into 2 November, a second wave followed, this time across about a dozen countries, including Belgium, the Netherlands, Sweden and Germany[1][6]. In Belgium, reports say around 60 Delhaize, Carrefour and Spar branches were affected, in Ireland 13 supermarkets; in Estonia an old system that had never been updated was hit[10]. Attempts against Coop in Switzerland failed[10].

In Germany, three stores reported damage: an Edeka store in Reisbach in Lower Bavaria, a Rewe store in Raesfeld in Westphalia and a CAP store in Wuppertal[6][11]. In Reisbach and Raesfeld the units were set to up to 50 °C. In Raesfeld the refrigeration was switched to defrost in the morning without triggering an alarm; meat, sausage, cheese, yoghurt and frozen pizza spoiled. According to the store operator, the controller there comes from Danfoss, and he had no cyber insurance[6]. The maintenance service reportedly knows of further cases in Germany that have not been named[6]. According to the dpa news agency, intelligence services are now looking into the attacks[12].

Who is behind the supermarket hack?

On 9 November, the French government attributed the attacks to the "Shahid Kaveh" unit of Iran's Revolutionary Guards, which operates under names such as CyberAveng3rs and Cyber Isnaad Front. The ministry calls it the first offensive cyber campaign on French soil carried out purely for sabotage and has requested arrest warrants[5]. The joint fact sheet by CISA, the FBI and other US agencies names no actor[13]. For operators, the attribution changes little: the method is now publicly described, and Sekoia expects copycats[1].

Exhibit 1: Timeline of the attacks on refrigeration systems (as of 11 November 2026)

Why are supermarket fridges connected to the internet?

Many people are asking this right now. The answer is mundane: refrigeration is a supermarket's largest power consumer, remote monitoring reports faults around the clock, many faults can be fixed remotely, and the temperature records required for food hygiene are kept automatically. Danfoss cites up to 30 per cent fewer technician call-outs[10]. The problem is not connectivity itself but how it is implemented: management interfaces that are directly reachable from the internet, and mobile access for service companies that bypasses the store's IT monitoring[4]. The French agency CERT-FR states that management interfaces directly reachable over the internet pose a considerable security risk[4].

Borchardt and Reservision: the booking system hack

At almost the same time, restaurants were hit. Reservision is an external online booking system for restaurants and hotels, used among others by Borchardt in Berlin. The restaurant confirmed that its booking system Reservision had fallen victim to a cyberattack and that the restaurant's internal data was safe[7]. The Frankfurt restaurant Tiger und Palmen also warned its guests and informed the data protection authority[7], and the restaurant Tim Raue confirms a phishing incident at its external provider[16].

What exactly was taken is described in a notice from the Munich restaurant Wirtshaus am Bavariapark, which also uses Reservision: from 8 November 2026, unauthorised parties used a security flaw to retrieve data from the system automatically. All guest data stored there is considered potentially affected, meaning name, email address, phone number, company details where given, and booking details. The system does not store bank or card data, and none was taken. The hosting provider blocked the attackers' accounts, and the restaurant changed its email sending passwords and informed the supervisory authority[2].

What the booking phishing emails look like

The attackers used the data to send emails that are hard to tell apart from genuine booking confirmations. According to the Berliner Kurier, one asks on behalf of "your reservations team" to confirm details via a link. Another claims that a booking for three people has not been fully confirmed and threatens automatic cancellation unless contact details are entered within 24 hours. Genuine addresses of other restaurants, including ones in Frankfurt and Switzerland, appeared as senders. Reservision makes clear that payment requests by email come neither from the restaurant nor from the system[7].

Avolang's assessment: The fact that the emails came from genuine restaurant addresses and that restaurants changed their email sending passwords suggests that sending accounts were misused too. Such emails pass technical sender checks and do not end up in spam. The usual advice to check the sender then falls short. A simple rule is more reliable: never pay or enter card details via a link in an email.

Received a phishing email: what guests should do now

• No links, no payment: Do not click links in the email and do not pay anything. Affected restaurants give exactly this advice and do not request payments by email[2].
• Ask directly: If in doubt, call the restaurant using the number on its official website, never the contact details in the email.
• Block your card: If you entered card details, block the card immediately (in Germany via the card-blocking hotline 116 116), inform your bank and check your transactions[7].
• Report it: File a police report; in Berlin this can be done online through the police's internet reporting portal[7].
• Stay alert (Avolang's assessment): The attackers know your name, phone number and booking date. Expect further targeted emails, text messages or calls.

The common pattern: legacy systems nobody feels responsible for

At first glance, a chilled counter and a booking form have little in common. The pattern is the same, though: a specialist system set up by a service provider, which runs reliably and is therefore left untouched for years. Sekoia describes exactly this gap between owners, integrators, maintenance firms and vendors in the refrigeration case: the systems were exposed because nobody had clear responsibility for their security[1]. A Danfoss spokesperson told the Dutch broadcaster NOS that the affected systems in the Netherlands were not in a protected network and still used default passwords[6]. Sekoia observed login attempts with the password "12345"[1].

The technology itself was old as well. According to Sekoia, most of the controllers attacked ran outdated firmware[1]. The French agency CERT-FR considers devices that no longer receive vendor support particularly at risk and says a factory reset is not enough[5][6]. Newer firmware offers a strict security mode, but a compatibility mode still allows old protocols, and some updates can only be installed on site[4].

Flaws in this device family had been known for a long time. In May 2025, the US agency CISA published an advisory on three vulnerabilities in Danfoss system managers, including an authentication bypass via a date-based password and a command injection; updates were already available[14]. In August 2026, Claroty showed how the daily access code can be reconstructed[15]. Which flaw the attackers exploited in October is not yet fully clear in public. Sekoia describes a previously undisclosed vulnerability that allowed the administrator account to be renamed without logging in[1]. In our assessment, this makes little difference to operators: a controller updated since 2025 and not directly reachable from the internet would have been far harder to attack.

Exhibit 2: Two attacks, one pattern (Avolang's assessment based on the sources cited)

In SMEs, systems like these are almost everywhere: the old Windows server in the basement, the NAS with remote access, the VPN appliance without updates, a website with outdated plug-ins, building services, time tracking or machine controls with remote maintenance access. Each of them is a legacy system in the true sense: it works, but nobody knows exactly what state it is in or who updates it.

What role does AI play in these attacks? Five reasons old vulnerabilities are now dangerous

First things first: there is no public evidence that the attackers used AI against the refrigeration systems or Reservision. What is documented, however, is that AI lowers the cost of exactly the steps that used to make such attacks expensive. We see five reasons.

1. Finding vulnerabilities costs next to nothing

Germany's BSI counted 10,803 newly disclosed vulnerabilities in the first quarter of 2026 and 17,539 in the second. The agency writes that the sharp rise could be due to AI-driven vulnerability discovery[17]. Anthropic shows how far this discovery reaches: when it presented Claude Mythos Preview in April 2026, the company reported that the model had found, among others, a 27-year-old flaw in OpenBSD and a 16-year-old one in FFmpeg, in a line of code that automated testing tools had run five million times without catching the bug[18]. Anthropic is deliberately not releasing the model widely until safeguards against misuse are ready, and expects such capabilities to spread[18].

2. From update to attack in hours rather than weeks

Every security update reveals where the flaw was. Turning the difference between the old and new version into an attack used to take experts and time. According to the Microsoft Digital Defense Report 2026, the mean time between disclosure of a flaw and its exploitation is now well under 24 hours; AI-assisted binary analysis speeds up the path from patch to exploit[19]. Microsoft expects around 72,000 new vulnerability records (CVEs) in 2026[19]. In our assessment, a system that is only updated months after a patch is practically open during that time.

3. Local AI without guardrails: uncensored and abliterated models

Commercial providers such as Anthropic, OpenAI and Google use safeguards, detect misuse and can block accounts; this is exactly why Anthropic is holding back Claude Mythos Preview[18]. That does not prevent misuse entirely: in May 2026, Google reported the first observed zero-day exploit developed by criminals with the help of AI, a two-factor authentication bypass in a widely used open-source web administration tool. It was detected and stopped before it could be used at scale[20].

Anyone who wants to avoid this oversight entirely uses open models whose refusal behaviour has been removed. The technique is called abliteration; the results circulate as "abliterated", "uncensored" or "unfiltered" models. In July 2026, ThreatDown counted more than 6,000 such models on Hugging Face, with more than 22 million downloads in a single 30-day period. Run locally, according to ThreatDown, they leave nothing that could be monitored, logged, intercepted or restricted[8]. Flare counted a rise in criminal forum posts about abliterated DeepSeek, GLM and Kimi models from 11 (as of late January) to 93 (as of mid-October 2026), including a guide to pointing an AI agent backed by an abliterated GLM-5.3 at IoT devices to find and attack them[21].

The dual role is striking: Sekoia used the same model, GLM 5.3, on the defensive side to understand the attack on the refrigeration controllers[1]. And according to Microsoft, open models trail the strongest commercial models by only about seven months[19]. What is available today only behind safeguards will therefore soon be available without them.

4. Phishing with real data looks real

In the AI security study by the BSI and the TÜV association, 17 per cent of more than 500 companies surveyed reported an AI-related attack or fraud attempt. Of these, 90 per cent involved deceptively genuine phishing emails, 40 per cent automated scripts searching for vulnerabilities and 11 per cent deepfakes. Only 11 per cent of companies have AI-specific incident processes[3]. The Reservision case shows why this matters: anyone who knows the name, date, time and party size of a real booking no longer needs any skill to write a convincing email; a language model writes it flawlessly, thousands of times over. Whether AI was used here is not known.

5. Security through effort no longer works

Many legacy systems were never really secure, just unattractive: proprietary protocols, firmware nobody had taken apart, and a payoff that did not justify the effort. AI is eroding exactly this protection. Sekoia fed firmware images of the refrigeration controllers to a language model and was able to confirm the purpose of the exploit within minutes; the researchers warn that language models lower the bar for reliable mass exploits and for copycats[1]. Microsoft reports that AI models autonomously carried out a 32-step takeover of a network domain in a lab[19]. This is what is meant by old vulnerabilities that only become exploitable with AI: technically they were always there, but exploiting them used to be too expensive.

Local AI is not the problem, missing guardrails are

These figures invite a wrong conclusion: that local AI is dangerous. What is dangerous is AI that nobody controls. An abliterated model on an attacker's computer has no rules, no logs and nobody accountable. A local AI agent in a business should be the opposite: it runs on servers whose location and operator are known, it only has the rights someone has given it, and every action with consequences requires approval.

For us, "local" means entirely in Germany, separated from other customers, in one of three operating models: hosted by Avolang, on a dedicated server or on premises on your own hardware. Our local AI agent Alwisr Company OS follows this principle: an isolated area per company, each connection individually and only with the rights it needs, sending, deleting, changing and running commands only after approval, and no training on your content by us. In a business, guardrails are therefore less about a model refusing questions and more about the system around it enforcing rights, approvals and traceability. Which open models are suitable is shown in our tier list of local AI models; for the comparison with ChatGPT and Claude, see ChatGPT and Claude versus a local AI agent.

Checklist: hardening legacy systems against AI-assisted attacks

The following points are derived from the recommendations of the BSI, CERT-FR and the security firms cited. They apply far beyond refrigeration.

How Avolang helps: hardening against AI, maintaining and modernising legacy systems

We work with AI every day and build local AI agents. That is why we know how attackers use AI: to find flaws, analyse updates and write convincing emails. We put this knowledge to work for you on the defensive side.

• Hardening against AI-assisted attacks: an inventory of every reachable system, access path and account, followed by a prioritised plan for what is switched off, isolated, updated or monitored.
• Maintaining and managing legacy systems: we take over support and updates, from website maintenance and Microsoft 365 to servers and networks.
• Bringing systems up to date: modernising or replacing outdated systems step by step with as little disruption as possible, with local IT infrastructure in Germany if you wish.
• Specialist technology together: for refrigeration, building or machine technology, we work with your specialist provider and take care of the network, access and monitoring.
• AI with guardrails: if you use AI yourself, do it as a local AI agent with rights, approvals and a location in Germany.

Frequently asked questions about the supermarket freezer hack, Borchardt and AI

Conclusion

The freezers in Reisbach and the booking data of Borchardt's guests have one thing in common: the attacks hit technology that worked and that nobody looked at any more. According to what is known today, AI did not demonstrably carry out these attacks. But it makes analysing old firmware, evaluating updates and convincing phishing so cheap that even small targets become worthwhile. Businesses should therefore not ask whether a system is interesting enough for attackers, but whether they know where it is, who maintains it and whether it can be reached from the internet. In our assessment, anyone who can answer these three questions for every system is far better prepared for the next wave.