Hackers hit supermarket fridges across Europe again, three weeks after France

Grocery stores in at least nine European countries opened on Monday, November 2, to fridges and freezers that had been pushed to warm temperatures overnight, in what several retailers and the European Commission are calling a cyberattack. AFP counted at least nine countries: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. The BBC later added Germany, where a Rewe store in the west of the country reported disruption, and the UK confirmed its own cases on Tuesday.

The incidents came three weeks after an attack on the night of October 11 to 12 forced refrigeration units into defrost mode at hundreds of French supermarkets. Nobody has claimed responsibility for either wave, and investigators have not said whether the two are connected. SecurityWeek, which counted more than 100 affected stores this time, described the new incidents as closely resembling the French ones. BleepingComputer put the figure at more than 115.

Where the stores were hit

Belgium was among the hardest hit. Delhaize said an IT incident affected refrigeration in several dozen stores, mostly in Belgium with four in Luxembourg, and that its distribution centers were running normally. Carrefour Belgium said 15 of its more than 700 stores were affected and that no hypermarket was among them. Its spokesman Mich Vergauwen told AFP it was a cyberattack and there was no other explanation. Colruyt said about five franchised Spar shops were affected, and an Ikea store in Mons reported rising freezer temperatures. Belgium's federal prosecutors have opened an investigation.

In Sweden, ICA said a limited number of stores outside its central network were affected. An ICA Kvantum store in Sjöbo said on Facebook that its fridges and freezers had been set to 50C (122F) and that staff were discarding affected products, according to the Associated Press. One ICA store manager told broadcaster TV4 that the settings had been changed overnight and could not be changed back, so frozen food had to be thrown out. Coop Sweden confirmed a cyber incident at a handful of its roughly 800 stores. AFP reported six affected stores and BleepingComputer quoted the company at seven.

Ireland's Musgrave Group pulled chilled and frozen products from 13 SuperValu stores and said later on Monday that the incident was fully resolved. In Estonia, refrigeration supplier Kitman Coldtech told public broadcaster ERR that attackers accessed a computer controlling a client's system and raised the temperature to 50C, and that the attack was addressed within minutes. Portugal's Mosqueteiros group confirmed incidents at seven Intermarché stores. Italy's national cybersecurity agency was alerted to at least four Coop supermarkets in Sicily and one business in Tuscany, and Finland's Kesko said a few smaller stores saw irregular temperatures.

In the Netherlands, Danfoss told broadcaster NOS that at least 17 businesses were hit, mainly butcher shops and small grocers. In the UK, the National Cyber Security Centre said on Tuesday it was aware of a small number of cases and that the impact so far was minimal. The Guardian reported that the UK victims were meat processing firms rather than grocery chains. The British Association of Independent Meat Suppliers (Aims) told the BBC that one member's cold unit reached as high as 100C while two others began to defrost. The units were empty and no produce was lost.

How the attack worked

The common thread is the controller that manages a store's refrigeration. Stephan Moelans, chief executive of Belgian refrigeration firm Sabcobel, told Belgian media including the Belga agency and RTL that attackers forced evaporators into defrost mode, the same technique used in France. He said a software update alone does not close the gap, because the equipment also needs physical changes, and that the simplest fix is to manage the units through a secure internet connection. Sabcobel had started securing its installations after the French attack, but some had not yet been upgraded.

Danfoss, the Danish maker of the AK-SM and AK-SC controllers named in France's CERT-FR alert, said its products were involved again. The company told NOS that on October 13 it advised customers to cut their systems' internet connections and reconnect only through a secure network, and that most stores did so but a small number did not. Danfoss has described most of the hacked units as legacy products that no longer receive security updates. CERT-FR later extended its alert to Copeland and Dixell XWEB controllers.

Officials have not publicly explained how the attackers got in. The UK's NCSC said the attackers were not using AI and relied on vulnerabilities that have been known for a long time. Deception security firm Lupovis said that between October 20 and 30 it logged 256 attempted attacks from 91 sources against decoy Danfoss controllers, peaking on October 26, and that most login attempts used the factory default credentials the manufacturer documents publicly. Chief executive Xavier Bellekens said the firm could not yet attribute the activity to a group.

Exposure data points at the same gap. Censys found just over 1,000 Danfoss StoreView interfaces reachable from the internet worldwide, with France still first, followed by Belgium and the United States. French exposures fell from 1,825 on October 11 to 220 at the latest count, and Censys estimates that 41% of those still online run patched firmware. Belgium had 138 exposed interfaces with 68% patched, Sweden 50 with 58% patched, and the Netherlands 51 with 37% patched. Censys did not say whether patched devices were among those hit on Monday.

What officials are saying

Christophe Hansen, the EU commissioner for agriculture and food, said the bloc was taking the incidents very seriously and called them a deliberate attempt to disrupt the food supply chain and undermine consumer confidence. He added that Europe's food security is not under threat for now. Commission spokesman Thomas Regnier said the incidents showed how cyberattacks can disrupt essential services and were not isolated, while declining to assign blame. Italy's government called a meeting with its intelligence services for Tuesday and said the affected businesses were mostly running obsolete security systems.

What it means for retailers and food processors

For store operators, the practical guidance has not changed since October. CERT-FR advises removing refrigeration controllers from the public internet, restoring remote access only through a secure VPN, checking configurations including defrost schedules, applying firmware updates and changing default passwords. Greece's National Cybersecurity Authority adds multi-factor authentication for remote access and replacing equipment the manufacturer no longer supports. It identified more than 300 internet-reachable industrial systems in the country in mid-October, most of them commercial refrigeration controllers from Danfoss, Copeland/Dixell and Carel, and noted that exposure does not by itself mean compromise.

The French wave showed the cost of waiting. Intermarché chief executive Thierry Cotillard put losses at tens of millions of euros in a single day, and one store in Normandy reported temperatures of 80C and melted equipment. Three weeks later, with the same controller families involved, the question for any retailer running remote-managed refrigeration is whether those controllers are still reachable from the open internet.