Unknown actors altered supermarket refrigeration controls across Europe

Intruders remotely adjusted cooling settings at grocery stores across Belgium, Sweden, Estonia and additional European states overnight ahead of Monday, November 2, pushing temperatures higher inside refrigerators and freezers.

The second wave affected Ahold Delhaize, Colruyt’s Spar banner, ICA, Coop, Carrefour and SuperValu. Carrefour said 15 of its 700 Belgian stores were affected by a cyber attack on refrigeration systems and described the impact as extremely limited. Colruyt Group said five Spar stores were attacked, while SuperValu said 13 of its 223 stores were affected, including locations in Ireland running a specific refrigeration model.

Musgrave took chilled and frozen goods off the shelves at 13 SuperValu stores as a precaution on Monday, and said restocking was underway after the incident ended. Ahold Delhaize described the event as an overnight IT incident affecting refrigeration at stores in Belgium and Luxembourg. The Parliament said the incident hit supermarket refrigerators in at least 10 European countries this week, and losses reached the hundreds of thousands of euros.

The BBC reported that dozens of supermarkets were hit in seven countries including Belgium, Luxembourg, Estonia, Ireland, Sweden and Finland. Tech Insider’s published store counts total 33 stores for Carrefour, Spar and SuperValu, which is a floor rather than a ceiling. Reports that have not been confirmed put the total above 100 stores, while one technical report estimated more than 115 locations; retailers and authorities have not confirmed those figures.

An ICA store in Sjoebo, in southern Sweden, reported that coolers and freezers showed 50 degrees Celsius, or 122 degrees Fahrenheit, leading staff to throw away affected goods. Coop Sweden said some affected refrigerators used 4G mobile connections, increasing exposure to remote access. Kitman Coldtech CEO Jann Mutso said a Selver supermarket freezer in Estonia reached 50 degrees Celsius.

Mutso said the Estonian incident lasted about 10 minutes, with temperatures rising only about 2-3 degrees Celsius and no products damaged. Selver said the affected store was the last one still on the old system, and Mutso said attackers were targeting old, unupdated controllers. The incident turned fridges at a De Laet & Van Haver butcher shop in Hove, south of Antwerp, up to as high as 18 degrees Celsius. Owner Luc De Laet estimated that the temperature change ruined about EUR 15,000 of meat.

Sabcobel CEO Stephan Moelans said intruders in Belgium switched cooling units into defrost mode, heating units instead of keeping food cold. Sabcobel estimates that the incident affected about 20 of the hundreds of units it manages in Belgium. Moelans said attackers entered individual supermarkets’ systems rather than refrigeration contractors’ systems.

Software updates alone will not work because installations require physical changes that cost money, Moelans said. The simplest fix is a secure internet connection for managing fridges, and most Sabcobel customers adopted it after the French cyber attack, he said. ICA confirmed that Danfoss supplied its refrigeration systems and played a role in the earlier French incidents too.

ICA said stores using an external supplier were affected, with connectivity outside its central network, so core systems were not the entry point. Musgrave’s public statement left out the manufacturer of the affected unit. Danfoss confirmed its products played a role in the November 2 intrusions and in attacks on hundreds of French supermarkets three weeks earlier.

The first wave in October struck more than 700 stores, primarily in France, with Belgium, Germany, the Netherlands, Portugal, Poland and Spain also affected. In October, Danfoss said older models no longer updated, specifically the AK-SM 800 and AK-SC 355, made up most affected French units. Copeland’s undated statement alluded to a cybersecurity incident affecting refrigeration systems in France and tied it to a discontinued generation of supervisory controllers.

Researchers including France’s CERT linked the intrusions to internet-connected refrigeration controllers made by Danfoss of Denmark, Dixell of Italy and Copeland. Researchers at Claroty disclosed three vulnerabilities in Danfoss AK-SM 800A controllers and two in Copeland controllers in August 2026. Aviatrix.ai says unpatched Danfoss and Copeland security flaws went public in August 2026, and default credentials remain widespread, leaving adversaries with almost no barrier to entry.

Danfoss told VTM that outdated software is the main weakness and that unupdated customers were affected. On October 13, Danfoss told Dutch customers to disconnect systems from the internet and reconnect only through a secure network. According to NOS, a Danfoss spokesperson said affected Dutch systems lacked a secure network and still used default passwords. The company said it was working with customers to put fixes in place.

Copeland advised limiting remote connectivity, replacing default passwords, auditing settings and retiring hardware that vendors no longer patch.

A CERT-FR alert covers Danfoss AK-SM and AK-SC controllers along with Copeland xweb and Dixell xweb, says campaigns are likely underway and was last updated October 16. The agency says controllers should not be reachable from the internet, including devices on public IP addresses, and advised disconnecting refrigeration controllers from direct internet access, reviewing their settings and installing updates. Access should be restored only through a secure VPN or a protected network, according to CERT-FR. The Hacker News found no advisory on Danfoss’s security advisories page on November 3, while CERT-FR’s October alert has the most detailed operator steps.

CERT-FR advises checking configurations, particularly defrost schedules, updating firmware, setting Danfoss security to Strict and changing default passwords. For compromised devices, CERT-FR advises restarting or factory-resetting the Danfoss device and reconfiguring it before putting it back into service. CERT-FR warns that end-of-life devices without security fixes are likely compromised if they remain online, and a factory reset by itself will not block a repeat attack. CERT-FR warned that resetting an old controller without fixing the underlying weakness leaves it exposed to another attack.

Configuration errors and poor security hygiene make up most of the threat surface, according to John Gallagher of Viakoo. Default passwords, vendor-shared service codes and static credentials reused at hundreds of sites make brute-forcing easy, Gallagher said. Gallagher said the attacker probably searched the internet for controller fingerprints linked to Danfoss, Dixell and Copeland.

Gallagher said an automated script exploited known web flaws or pushed default credentials to flip units into defrost mode all at once. Gallagher said the same methods could work on nearly any operational technology (OT) and internet of things (IoT) system, which are often run outside IT with porous borders.

No group has claimed credit, no malware family has been identified, no ransom demand has appeared and investigators have confirmed no motive. Belgium’s federal prosecutor opened a criminal investigation, and the country’s Centre for Cybersecurity says it does not know who is behind the attacks. European authorities are investigating the attacks. The Hacker News says the November and French attack linkage is unknown, and a shared method does not prove one group was behind both.

Sweden’s National Cybersecurity Centre said on Monday that it was following the incidents and sharing information with other Nordic and European agencies. The centre advised organizations to list internet-connected devices, determine which require a connection, and keep connected devices updated with layers of security. Belgium’s Centre for Cybersecurity said, “it may never be determined.”

Connected operational technology maintains exact environmental conditions for drug storage and delivery, food-distribution centers and industrial plants, according to Sean Tufts of Claroty. Tufts warned that interfering with drug storage may expose temperature-sensitive medications to risk, and that food-distribution problems can cause product loss and distribution interruptions. Tufts recommended a VPN, strong authentication or a centralized secure-access tool with session tracking wherever organizations need remote access.

Tufts also called for replacing default passwords, updating firmware and segmenting networks. The main problem was refrigerators connected directly to the internet, said Sven Herpig of Interface. Herpig said attackers knew a standard username used across devices, one guessable and exploitable remotely at scale.

Europe has enough cybersecurity regulation but implementation is lagging, Herpig said, and critical entities that fail to implement proper IT security standards should be fined. AI tools are not needed for these attacks, Herpig said; the weakness was credentials and absent multifactor authentication. IoT devices such as smart TVs, refrigerators and ovens face risk when connected to the internet without adequate security controls, Herpig said.

The Cyber Resilience Act will bring better vendor support and device security over time, Herpig said. Plausible scenarios include state-based signalling or a lone-wolf hacker acting for personal reasons, said Rafe Pilling of Sophos, according to the Guardian. UK officials warned that AI-assisted tools lower the skill needed for such operations, while the NCSC assessment on AI-powered malware and critical infrastructure looks ahead to 2028.

Unexplained failures at military commissaries across at least six US bases in early August raised questions about whether attackers were targeting refrigeration systems. Aviatrix.ai says two waves of attacks in under three weeks hit European cold-chain infrastructure affecting over 700 stores, signaling automated OT sabotage campaigns operating at scale.

Aviatrix.ai says regulatory scrutiny under NIS2 and food-safety implications make OT network segmentation, remote-access controls and firmware patching urgent priorities. Weak remote-access problems exist in pharmaceutical storage, food distribution centers and industrial temperature-control systems, not only supermarkets, security experts say.