{"id":3940,"date":"2026-11-03T10:49:06","date_gmt":"2026-11-03T10:49:06","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3940"},"modified":"2026-11-03T10:49:06","modified_gmt":"2026-11-03T10:49:06","slug":"new-wave-of-refrigeration-cyberattacks-hits-supermarkets-across-europe-forcing-stores-to-pull-food","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3940","title":{"rendered":"New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food"},"content":{"rendered":"
\n
<\/a><\/div>\n

Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers.<\/p>\n

No chain reported more than several dozen affected stores, and some had to throw away chilled and frozen food or take it off the shelf. Danfoss, a Danish maker of refrigeration controls, said its products were involved<\/a>, as they were three weeks earlier when attackers hit hundreds of French supermarkets.<\/p>\n

No one had claimed the attacks by Monday night, and it was not known whether they were linked to the attack in France.<\/p>\n

Refrigeration controls are computers that run a store’s fridges and freezers. They can be connected to the internet, allowing refrigeration contractors to monitor them and fix faults remotely.<\/p>\n

In Belgium, attackers switched cooling units into defrost mode, Stephan Moelans, chief executive of the refrigeration contractor Sabcobel, told Belgian media<\/a>. Defrost mode is meant to clear ice, but in these attacks it made the units heat up instead of keeping food cold. Sabcobel manages refrigeration systems for the Delhaize supermarket chain.<\/p>\n

In other cases, the temperature setting was raised. An ICA store in Sj\u00f6bo<\/a>, in southern Sweden, said its fridges and freezers had been set to 50\u00b0C and that staff were throwing out the affected goods.<\/p>\n

At a Selver supermarket in Estonia<\/a>, a freezer was set to 50\u00b0C, said Jann Mutso, chief executive of the refrigeration supplier Kitman Coldtech. Its temperature rose by only about 2-3\u00b0C, and the problem was resolved within about 10 minutes, with no products damaged.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Danfoss’s security advisories page<\/a> listed no advisory about the attacks when The Hacker News checked on November 3. The most detailed steps for operators are still those in an October alert from CERT-FR<\/a>, part of France’s national cybersecurity agency.<\/p>\n

<\/p>\n

Which Companies Say They Were Hit<\/h3>\n

Each company described the incident in its own words, and not all of them called it a cyberattack.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Country<\/th>\nCompany<\/th>\nStores affected<\/th>\nWhat the company or its supplier said<\/th>\n<\/tr>\n
Belgium, Luxembourg<\/td>\nDelhaize<\/td>\nSeveral dozen, mostly in Belgium and a few in Luxembourg<\/td>\nAn \u00abIT incident\u00bb affected refrigeration. The range of fresh and frozen food was temporarily limited.<\/td>\n<\/tr>\n
Belgium<\/td>\nCarrefour<\/td>\n15 of more than 700<\/td>\nA cyberattack on its refrigeration, with very limited impact.<\/td>\n<\/tr>\n
Belgium<\/td>\nIntermarch\u00e9<\/td>\n10 to 15<\/td>\nProblems with its fridges.<\/td>\n<\/tr>\n
Belgium<\/td>\nSpar, under Colruyt Group<\/td>\n5, run by independent owners<\/td>\nTheir fridge systems were attacked.<\/td>\n<\/tr>\n
Belgium<\/td>\nIKEA<\/td>\n1, in Mons<\/td>\nA cyber incident hit the store’s fridges and freezers. No other IKEA store in Belgium was affected.<\/td>\n<\/tr>\n
Sweden<\/td>\nICA<\/td>\nA limited number. No count given<\/td>\nAn incident affected refrigeration and freezer systems. ICA did not confirm a cyberattack.<\/td>\n<\/tr>\n
Sweden<\/td>\nCoop<\/td>\n6 (to TT and AFP) or 7 (to Reuters and Bloomberg), of about 800<\/td>\nA cyber incident in which someone tampered with its refrigeration without permission.<\/td>\n<\/tr>\n
Ireland<\/td>\nMusgrave, owner of SuperValu<\/td>\n13 of 223<\/td>\nA \u00abcyber incident\u00bb limited to one refrigeration model.<\/td>\n<\/tr>\n
Estonia<\/td>\nSelver, through supplier Kitman Coldtech<\/td>\n1<\/td>\nAn attack on an older Danfoss system.<\/td>\n<\/tr>\n
Netherlands<\/td>\nBusinesses not named<\/td>\nAt least 17 businesses, including butchers and small local shops<\/td>\nAttacked, according to Danfoss.<\/td>\n<\/tr>\n
Finland<\/td>\nKesko<\/td>\nA few smaller stores<\/td>\nUnusual temperatures. The cause was under investigation. The stores’ equipment is outside Kesko’s central protections.<\/td>\n<\/tr>\n
Portugal<\/td>\nIntermarch\u00e9, Mosqueteiros group<\/td>\n7<\/td>\nA cyberattack that appears to have targeted an outside company managing the refrigeration, according to AFP.<\/td>\n<\/tr>\n
Italy<\/td>\nCoop supermarkets run by Radenza Group<\/td>\nAt least 4, in Sicily<\/td>\nAn attack on its remote control system for frozen food sections, according to AFP.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

At a De Laet & Van Haver butcher shop in Hove, south of Antwerp, the fridges were turned up as high as 18\u00b0C, owner Luc De Laet told Reuters<\/a>. He estimated that about \u20ac15,000 worth of meat was ruined.<\/p>\n

At the 13 SuperValu stores, Musgrave took chilled and frozen products off sale as a precaution<\/a>. The company said on Monday afternoon<\/a> that the incident had been resolved and restocking was under way.<\/p>\n

What Companies Say About the Equipment and the Way In<\/h3>\n

Several of the systems that were hit were made by Danfoss. All of ICA’s affected stores were connected to an outside refrigeration control system supplied by Danfoss, an ICA spokesperson told AFP<\/a>. In Estonia, attackers reached the control computer of an older Danfoss system, Mutso said.<\/p>\n

Danfoss is not named in every case. Musgrave’s statement did not name the maker of the affected model.<\/p>\n

An affected Belgian butcher told Dutch broadcaster NOS that equipment from a second maker, Copeland, was also attacked in Belgium. Copeland gave NOS no clear answer to questions about the attacks.<\/p>\n

The Dutch systems that were hit were not on a secure network and still used default passwords, a Danfoss spokesperson told NOS<\/a>. Most shops there had taken measures after the French attack, but a few had not, and those were the ones hit.<\/p>\n

Danfoss also told Belgian broadcaster VTM that the weakness lies mainly in outdated software and that customers who had not updated were affected, Euronews reported<\/a>.<\/p>\n

Sabcobel knows of about 20 affected units among the hundreds it manages in Belgium. In the Belgian cases, attackers got into individual supermarkets’ systems, not those of refrigeration contractors, Moelans told Belgian media. Sabcobel had advised stores to secure their internet connections, and many but not all had done so.<\/p>\n

Mutso said old controllers that had not been updated were being targeted. Selver said the store that was hit was the last one it had not yet moved to a new system. ICA told NBC News<\/a> that its own systems were not affected and that the affected stores used an outside supplier and were connected to a network outside ICA’s central network.<\/p>\n

Belgium’s Centre for Cybersecurity told reporters on Monday that it had no further information. Sweden’s National Cybersecurity Centre did not say in its notice how attackers got in.<\/p>\n

What Operators Can Do<\/h3>\n

CERT-FR’s alert covers Danfoss AK-SM and AK-SC series controllers, as well as Copeland xweb and Dixell xweb. It says attack campaigns against these devices are probably still underway. When The Hacker News checked on November 3, the alert had last been updated on October 16.<\/p>\n

For devices that have not been compromised, the steps are:<\/p>\n

    \n
  1. Make sure the devices cannot be reached from the internet, including any device on a public IP address. Check your insurance contract before cutting the data feed to your refrigeration contractor.<\/li>\n
  2. Check the whole configuration, especially the defrost schedules.<\/li>\n
  3. Restore access only through a secure VPN or a protected network. In an emergency, you can filter the contractors’ IP addresses at a firewall, but this should not be a lasting fix.<\/li>\n
  4. Follow the maker’s good practices, such as updating firmware. For Danfoss devices, set the security level to Strict and make sure default passwords have been changed.<\/li>\n<\/ol>\n

    For a device that has been compromised, two more steps follow: restart the Danfoss device or reset it to factory settings, then reconfigure it before putting it back into service.<\/p>\n

    End-of-life devices that no longer get security fixes are very likely to be compromised if they stay on the internet, CERT-FR warns. A factory reset alone leaves them open to attack again. In October, Danfoss said most of the units hit in France were older models it no longer updates, the AK-SM 800 and AK-SC 355.<\/p>\n

    Danfoss advised Dutch customers on October 13 to disconnect their systems from the internet and reconnect them only through a secure network. It had also been working with customers to put fixes in place<\/a>.<\/p>\n

    \n
    \"Cybersecurity\"<\/a><\/div>\n<\/div>\n

    Sweden’s National Cybersecurity Center advised organizations<\/a> to list which devices are connected to the internet, decide whether each one needs to be connected, and keep any that remain connected updated and protected with multiple layers of security.<\/p>\n

    Moelans said a software update alone is not enough, because the installations need physical changes that cost money. The simplest answer is a secure internet connection for managing the fridges, which most of Sabcobel’s customers adopted after the French attack.<\/p>\n

    Who Is Behind It<\/h3>\n

    Danfoss said the Dutch attacks were the same kind as the one in France, Sabcobel said the same method was used in Belgium, and Kitman said the method in Estonia was similar. A shared method does not show that the same people carried out both attacks.<\/p>\n

    Belgium’s Centre for Cybersecurity said on Monday that it was not known who was behind the attacks and that \u00abit may never be determined\u00bb.<\/p>\n

    Belgium’s federal prosecutor’s office has opened a criminal investigation, it confirmed to VRT<\/a>. Sweden’s National Cybersecurity Centre said on Monday that it was following the incidents and sharing information with agencies in other Nordic and European countries.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers. No chain reported…<\/p>\n","protected":false},"author":1,"featured_media":3941,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1437,1019,4032,4031,825,2510,4030,193,3839,386],"class_list":["post-3940","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-cyberattacks","tag-europe","tag-food","tag-forcing","tag-hits","tag-pull","tag-refrigeration","tag-stores","tag-supermarkets","tag-wave"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3940","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3940"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3940\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3941"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3940"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3940"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3940"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}