Refrigeration Systems Targeted in Europe-Wide Cyberattacks

An ICA store in Sjöbo, in southern Sweden, said its fridges and freezers had been set to 50°C and that staff were throwing out the affected goods.

What unfolded across Belgium, Sweden, Estonia and beyond

Attackers remotely changed settings on supermarket refrigeration controls overnight into Monday, November 2, warming fridges and freezers in Belgium, Sweden, Estonia and other European countries, The Hacker News reported. No chain reported more than several dozen affected stores. Some retailers removed chilled and frozen products from sale or discarded goods that may have been spoiled.

Incidents ranged in severity. At a De Laet & Van Haver butcher shop in Hove, south of Antwerp, owner Luc De Laet told Reuters fridges were turned up as high as 18°C and he estimated roughly €15,000 of meat was ruined. Musgrave said 13 SuperValu stores took chilled and frozen products off sale as a precaution and later reported the incident had been resolved and restocking was under way. In Estonia, a Selver freezer was set to 50°C but its temperature rose only about 2–3°C and the issue was resolved within about 10 minutes with no products damaged, Kitman Coldtech chief executive Jann Mutso said.

Equipment, vendors, and the technical entry points

Several affected systems used refrigeration controllers made by Danfoss, and CERT-FR's October advisory names Danfoss AK‑SM and AK‑SC series controllers as well as Copeland xweb and Dixell xweb devices. Danfoss was not named in every incident; an affected Belgian butcher told NOS that equipment from Copeland was also attacked, while Musgrave's statement did not name the maker of the affected model.

Refrigeration controls are computers that run fridges and freezers and can be connected to the internet so contractors can monitor and fix faults remotely. Danfoss told NOS that the Dutch systems hit were not on a secure network and still used default passwords. Danfoss also told Belgian broadcaster VTM that the weakness lies mainly in outdated software and that customers who had not updated were affected. In October, Danfoss said most of the units hit in France were older models it no longer updates—the AK‑SM 800 and AK‑SC 355.

Guidance from CERT‑FR and vendor actions

When The Hacker News checked on November 3, Danfoss's security advisories page listed no advisory about the recent attacks; the most detailed steps for operators remained those in an October alert from CERT‑FR, last updated October 16. CERT‑FR warned attack campaigns against these devices are probably still underway and listed practical measures.

• For devices not yet compromised: ensure they cannot be reached from the internet (including public IP addresses); check configurations and defrost schedules; restore remote access only via secure VPN or protected network; and follow maker guidance such as updating firmware and changing default passwords. For Danfoss devices specifically, CERT‑FR advises setting the security level to Strict.
• For compromised devices: restart the Danfoss device or reset it to factory settings, then reconfigure before returning it to service.
• CERT‑FR highlighted that end‑of‑life devices that no longer receive security fixes are very likely to be compromised if they remain on the internet, and that a factory reset alone leaves them exposed.

Danfoss had previously advised Dutch customers on October 13 to disconnect their systems from the internet and to reconnect only through a secure network, and said it was working with customers to put fixes in place.

Responses from chains, contractors, and national agencies

Sabcobel, the refrigeration contractor that manages systems for the Delhaize chain, said attackers switched cooling units into defrost mode in Belgium. Defrost mode is intended to clear ice but in these attacks it made the units heat up instead of keeping food cold, Sabcobel chief executive Stephan Moelans told Belgian media. Sabcobel said it knew of about 20 affected units among the hundreds it manages in Belgium and that, in the Belgian cases, attackers accessed individual supermarkets' systems rather than refrigeration contractors' networks. Sabcobel had advised stores to secure their internet connections; many did but some had not.

ICA told AFP that all of its affected stores were connected to an outside refrigeration control system supplied by Danfoss; ICA also told NBC News that its own systems were not affected and that the impacted stores used an outside supplier on a network outside ICA's central network. Sweden's National Cybersecurity Centre said it was following the incidents and sharing information with agencies in other Nordic and European countries. Belgium's Centre for Cybersecurity said it had no further information, and Belgium's federal prosecutor's office confirmed to VRT that a criminal investigation has been opened.

What this means for retailers, refrigeration contractors, and national authorities

Retailers with internet‑connected controllers must verify whether devices are exposed to public networks and whether firmware and configurations—especially defrost schedules—are current. Refrigeration contractors will need to prioritize inventorying devices, segregating contractor access onto secure VPNs or protected networks, and replacing end‑of‑life controllers that no longer receive fixes. National cybersecurity agencies and prosecutors are already involved: CERT‑FR continues to maintain guidance and Belgium's federal prosecutor has opened an investigation, while national centres in Sweden and Belgium are sharing information with counterparts.

The immediate picture is one of targeted disruption using widely available remote access to refrigeration controllers: multiple European retailers and suppliers reporting incidents, CERT‑FR warning that campaigns may be ongoing, and national authorities initiating investigations. Whether the new wave of incidents is linked to the series of French supermarket attacks three weeks earlier remains unknown; by Monday night no group had claimed responsibility and Belgium's Centre for Cybersecurity said attribution "may never be determined."

Source: The Hacker News — Second wave of cyberattacks hits supermarkets across Europe