Supermarket refrigeration systems across seven European countries were disrupted in a coordinated-looking cyberattack, with intruders remotely changing settings, triggering defrost cycles and forcing stores to discard spoiled food. The affected countries include Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland, according to reports compiled by the BBC. The incident follows a similar attack that struck hundreds of French supermarkets in October. [1]
Belgium appears to have suffered the largest reported impact. About 40 Delhaize stores in Belgium and Luxembourg were affected, while Carrefour said 15 Belgian locations were hit and Colruyt reported problems at five shops. In Sweden, several ICA and Coop stores reported compromised refrigeration systems; Ireland’s Musgrave Group said 13 SuperValu supermarkets were affected. Danfoss told Dutch broadcaster NOS that systems at at least 17 Dutch businesses, including butcher shops and small retailers, were attacked. One Belgian store estimated that it lost about €100,000 in food. [1]
The apparent attack abused the normal remote-management functions used to operate connected refrigeration equipment. Sabcobel, a Belgian refrigeration company, said affected evaporators were switched into defrost mode, causing units to warm rapidly. Some stores reported temperatures reaching 50 degrees Celsius, or 122 degrees Fahrenheit. In Sweden, one ICA store said its refrigerators and freezers had been set to that level overnight. The same technique was reported during the French incident, in which attackers reportedly manipulated refrigeration controls for hours and retailers discarded millions of euros of stock.
The equipment is linked to Danish manufacturer Danfoss, whose refrigeration-control products were also implicated in France. Danfoss has said many affected systems were obsolete, had reached end of life or were running outdated firmware, and advised customers to update supported systems, migrate legacy equipment and remove exposed controllers from the public internet. Sabcobel said some installations require physical changes rather than a software update alone. Retailers using internet-connected operational technology should isolate controllers, restrict remote access to authenticated secure connections, preserve logs and verify independent temperature alarms before reconnecting systems.
No CVE identifier, CVSS score or public proof-of-concept has been verified for the weakness described in these incidents, and the available reporting does not establish that a single software vulnerability caused every case. There is also no confirmed threat-actor attribution or public claim of responsibility. French prosecutors opened a cybercrime investigation into the October attack, while Belgian and Swedish authorities were monitoring the latest reports. The incidents therefore point to a serious exposure in legacy cold-chain infrastructure, but not yet to a named campaign or officially confirmed exploit.
For supermarkets, the immediate risk is both operational and public-health related: refrigeration can be altered without disrupting checkout systems, while food may become unsafe before staff notice. Operators should inventory every remotely managed controller, identify unsupported firmware, segment refrigeration networks from corporate IT, disable unnecessary internet exposure and test manual override and alarm procedures. The latest wave shows that warnings issued after the French attack did not reach, or were not implemented by, every exposed site. [16][20]
References
- Shop freezers in seven European countries hit by cyber-attack – BBC
- Hackers tamper with fridges at 17 Dutch firms as attacks spread – DutchNews.nl
- Fridge cyberattack hits supermarkets across Europe – afp.com
