A new wave of cyberattacks targeting supermarket refrigeration systems has disrupted food storage operations across several European countries, forcing some retailers to remove chilled and frozen products from their shelves.
The attacks occurred overnight into Monday, November 2, when attackers remotely altered refrigeration control settings at supermarkets in Belgium, Sweden, Estonia and other European countries. By manipulating the systems, they caused refrigerators and freezers to warm up, potentially putting large quantities of perishable food at risk.
Although no supermarket chain reported more than several dozen affected stores, some retailers were forced to discard chilled and frozen products or temporarily remove them from sale.
Danfoss, a Danish manufacturer of refrigeration control systems, confirmed that its products were involved in the incidents. The company had also been linked to a similar attack approximately three weeks earlier, when cybercriminals targeted hundreds of French supermarkets.
As of Monday evening, no individual or group had claimed responsibility for the latest incidents. Authorities and affected businesses had also not established whether the attacks were connected to the earlier incidents in France.
How Hackers Manipulated Supermarket Refrigeration Systems
Refrigeration controls are computer-based systems responsible for managing the temperature and operation of supermarket refrigerators and freezers. Many are connected to the internet, allowing refrigeration contractors to monitor equipment, identify technical problems and perform maintenance remotely.
However, these remote-access capabilities can also create security risks when systems are improperly protected or accessed without authorization.
In Belgium, attackers reportedly switched refrigeration units into defrost mode, according to Stephan Moelans, chief executive of refrigeration contractor Sabcobel. The company manages refrigeration systems for the Delhaize supermarket chain.
Defrost mode is normally used to remove accumulated ice from cooling equipment. However, manipulating these settings caused the affected units to warm up instead of maintaining the temperatures required for safe food storage.
In Sweden, an ICA supermarket in Sjöbo, southern Sweden, reported that attackers had changed the temperature settings of its refrigerators and freezers to 50°C. Store employees were forced to dispose of affected products after the equipment stopped maintaining the necessary cooling conditions.
A similar incident occurred at a Selver supermarket in Estonia. According to Jann Mutso, chief executive of refrigeration supplier Kitman Coldtech, hackers changed a freezer’s temperature setting to 50°C. Fortunately, the actual temperature increased by only around 2–3°C. The issue was resolved within approximately 10 minutes, and no products were damaged.
Danfoss Systems Previously Linked to Similar Attacks
The involvement of Danfoss refrigeration controls has drawn attention because the manufacturer’s products were also reportedly involved in the earlier cyberattacks against French supermarkets.
Danfoss had not published a specific security advisory addressing the latest incidents on its security advisories page when checked by The Hacker News on November 3.
Meanwhile, one of the most detailed sets of recommendations available to refrigeration system operators remained an October security alert published by CERT-FR, part of France’s national cybersecurity agency.
The incidents highlight the risks associated with internet-connected industrial and commercial equipment. While remote monitoring and management make refrigeration systems easier to maintain, unauthorized access can disrupt essential operations and cause significant financial losses.
Which Companies Reported Being Affected?
Different supermarket operators and refrigeration service providers have described the incidents in their own terms, and not every company has officially classified what happened as a cyberattack.
Nevertheless, the incidents across Belgium, Sweden, Estonia and other European countries demonstrate how unauthorized changes to connected refrigeration systems can disrupt supermarket operations, threaten food supplies and create additional costs for retailers.
As investigations continue, supermarket operators and refrigeration providers face renewed pressure to strengthen the security of remotely accessible control systems and prevent similar incidents.
| Country | Company | Stores affected | What the company or its supplier said |
| Belgium, Luxembourg | Delhaize | Several dozen, mostly in Belgium and a few in Luxembourg | An “IT incident” affected refrigeration. The range of fresh and frozen food was temporarily limited. |
| Belgium | Carrefour | 15 of more than 700 | A cyberattack on its refrigeration, with very limited impact. |
| Belgium | Intermarché | 10 to 15 | Problems with its fridges. |
| Belgium | Spar, under Colruyt Group | 5, run by independent owners | Their fridge systems were attacked. |
| Belgium | IKEA | 1, in Mons | A cyber incident hit the store’s fridges and freezers. No other IKEA store in Belgium was affected. |
| Sweden | ICA | A limited number. No count given | An incident affected refrigeration and freezer systems. ICA did not confirm a cyberattack. |
| Sweden | Coop | 6 (to TT and AFP) or 7 (to Reuters and Bloomberg), of about 800 | A cyber incident in which someone tampered with its refrigeration without permission. |
| Ireland | Musgrave, owner of SuperValu | 13 of 223 | A “cyber incident” limited to one refrigeration model. |
| Estonia | Selver, through supplier Kitman Coldtech | 1 | An attack on an older Danfoss system. |
| Netherlands | Businesses not named | At least 17 businesses, including butchers and small local shops | Attacked, according to Danfoss. |
| Finland | Kesko | A few smaller stores | Unusual temperatures. The cause was under investigation. The stores’ equipment is outside Kesko’s central protections. |
| Portugal | Intermarché, Mosqueteiros group | 7 | A cyberattack that appears to have targeted an outside company managing the refrigeration, according to AFP. |
| Italy | Coop supermarkets run by Radenza Group | At least 4, in Sicily | An attack on its remote control system for frozen food sections, according to AFP. |
Supermarkets and Businesses Count the Cost of Refrigeration Cyberattacks
The latest wave of refrigeration cyberattacks has caused financial losses for businesses across Europe, with some retailers forced to discard valuable food products after attackers manipulated the temperature settings of their cooling systems.
At a De Laet & Van Haver butcher shop in Hove, south of Antwerp, Belgium, attackers reportedly raised refrigerator temperatures to as high as 18°C. Owner Luc De Laet told Reuters that approximately €15,000 worth of meat had been spoiled as a result of the incident.
In Ireland, supermarket operator Musgrave took precautionary action at 13 SuperValu stores by removing chilled and frozen products from sale. The company confirmed on Monday afternoon that the incident had been resolved and that restocking operations were underway.
Which Refrigeration Systems Were Targeted?
Investigations have identified Danfoss equipment in several of the affected locations, although the manufacturer was not named in every reported incident.
An ICA spokesperson told AFP that all affected ICA stores were connected to an external refrigeration control system supplied by Danfoss. In Estonia, attackers reportedly gained access to the control computer of an older Danfoss system, according to Jann Mutso of Kitman Coldtech.
However, Danfoss was not the only equipment manufacturer mentioned in connection with the incidents. An affected Belgian butcher told Dutch broadcaster NOS that refrigeration equipment manufactured by Copeland had also been targeted. Copeland did not provide a clear response when approached by NOS for comment.
Musgrave’s statement about the affected SuperValu stores did not identify the manufacturer of the refrigeration equipment involved.
Outdated Software and Weak Network Security Raise Concerns
Security weaknesses in older refrigeration systems appear to have played an important role in several of the incidents.
A Danfoss spokesperson told NOS that the Dutch systems affected were not connected through secure networks and were still using default passwords. Although most businesses had strengthened their security following the earlier French attacks, some had not implemented the recommended measures and subsequently became targets.
Danfoss also told Belgian broadcaster VTM that outdated software was a major vulnerability, with customers who had not installed available updates among those affected.
Sabcobel, a Belgian refrigeration contractor, identified approximately 20 affected units among the hundreds of systems it manages. According to its chief executive, Stephan Moelans, attackers accessed the refrigeration systems inside individual supermarkets rather than the contractor’s own systems.
The company had previously advised its customers to secure their internet connections. While many businesses followed the recommendations, some had not completed the necessary changes.
In Estonia, Mutso said attackers were targeting older controllers that had not received software updates. Selver also confirmed that the affected supermarket was the last location in its network that had not yet been transferred to a newer refrigeration system.
ICA, meanwhile, told NBC News that its central systems were not affected. The compromised stores relied on an external supplier and were connected to a separate network outside ICA’s central infrastructure.
Belgium’s Centre for Cybersecurity said it had no additional information about the incidents when contacted by reporters on Monday. Sweden’s National Cybersecurity Centre also did not disclose how the attackers gained access.
How Businesses Can Protect Refrigeration Systems
The French national cybersecurity agency’s CERT-FR has issued technical guidance covering several refrigeration control systems, including Danfoss AK-SM and AK-SC series controllers, as well as Copeland xweb and Dixell xweb equipment.
The agency warned that cyberattack campaigns targeting these devices could still be ongoing. Its recommendations provide important security measures for businesses operating connected refrigeration equipment.
For systems that have not been compromised, operators are advised to:
- Restrict internet access: Ensure refrigeration controllers cannot be accessed directly from the internet, particularly through publicly accessible IP addresses. Businesses should also consider their contractual arrangements with refrigeration service providers before disconnecting remote monitoring services.
- Review system configurations: Examine the complete configuration of refrigeration equipment, paying particular attention to defrost schedules and temperature settings that could have been manipulated.
- Use secure remote connections: Allow remote access only through a properly secured VPN or protected network. Temporary firewall restrictions on contractors’ IP addresses may provide an additional emergency measure, but should not replace a permanent security solution.
- Update software and strengthen passwords: Follow manufacturers’ security recommendations, install available firmware updates and replace default passwords. Danfoss users are also advised to configure the security level to Strict.
For equipment that has already been compromised, CERT-FR recommends restarting the affected Danfoss device or restoring it to factory settings, followed by a complete reconfiguration before returning it to operation.
The agency also warned that end-of-life refrigeration controllers that no longer receive security updates are particularly vulnerable when connected to the internet. Simply restoring factory settings does not eliminate the underlying security risk.
During the October attacks in France, Danfoss said that many affected units were older models no longer supported with security updates, including the AK-SM 800 and AK-SC 355.
On October 13, Danfoss advised Dutch customers to disconnect their refrigeration systems from the internet and reconnect them only through secure networks. The company also said it was working with customers to implement corrective security measures.
Sweden’s National Cybersecurity Centre has issued similar recommendations, urging organizations to identify all internet-connected devices, determine whether each one genuinely requires an internet connection, and ensure that necessary connections are protected through regular updates and multiple layers of security.
Moelans stressed that installing software updates alone may not be sufficient because some refrigeration installations require physical modifications to improve their security. According to him, establishing a secure internet connection for remote refrigeration management is one of the most straightforward solutions. Many of Sabcobel’s customers adopted this approach following the earlier attacks in France.
Who Is Responsible for the Cyberattacks?
Although the incidents in France, Belgium and Estonia appear to share similarities, investigators have not established whether they were carried out by the same individuals or criminal groups.
Danfoss described the Dutch incidents as similar to the earlier attack in France. Sabcobel also identified similarities in the methods used in Belgium, while Kitman Coldtech reported comparable techniques in Estonia.
However, similarities in attack methods do not necessarily establish a common source or identify those responsible.
Belgium’s Centre for Cybersecurity said that the identity of the attackers remained unknown and acknowledged that investigators might never establish who was behind the incidents.
Belgium’s federal prosecutor’s office has opened a criminal investigation, confirming the development to broadcaster VRT.
Meanwhile, Sweden’s National Cybersecurity Centre said it was monitoring the incidents and exchanging information with cybersecurity agencies across Nordic and other European countries.
As investigations continue, the attacks serve as a warning to supermarkets, food retailers and other businesses that rely on internet-connected industrial equipment. Weak passwords, outdated software and unsecured remote connections can turn essential operational systems into entry points for cybercriminals, potentially resulting in damaged goods, financial losses and widespread business disruption.
Source: thehackernews Edited by Bernie
