Cyberattacks Hit Supermarket Fridges Across Europe Despite Warnings

At an ICA supermarket in Stockholm, staff arrived on Monday morning to find that the freezers had reached 50°C. Engla Ingwall, the store’s sales manager, told Reuters the attack began at about 2 am on 2 November.

By the time employees discovered it, frozen products had to be discarded.

Reports of interference came from Belgium, Luxembourg, Ireland, Estonia and the Netherlands. Retailers described temperature changes, prolonged defrosting and disruptions to the systems that manage commercial fridges and freezers.

Investigators have not identified those responsible for the November incidents. Nor have they established whether the attacks were connected to the October operation in France.

How the attacks spread across Europe

In Belgium, around 40 Delhaize stores experienced refrigeration problems, mainly smaller Proxy Delhaize and Shop & Go outlets. Carrefour reported incidents at 15 of its approximately 700 Belgian stores, while five Spar shops associated with Colruyt Group were affected. A Belgian IKEA outlet also reported disruption.

Sweden’s Coop said seven of its roughly 800 stores had suffered unauthorised interference. ICA confirmed problems at a limited number of locations. At its Sjöbo supermarket in southern Sweden, employees emptied freezers after the temperature settings were raised to 50°C.

In Ireland, Musgrave Group reported an incident involving refrigeration equipment at 13 SuperValu supermarkets. Its monitoring systems detected irregularities and staff removed chilled and frozen products from sale as a precaution. The company said the problem had been resolved by Monday afternoon and restocking had begun.

At a Selver supermarket in Estonia, attackers accessed a computer controlling refrigeration equipment and changed the temperature setting to 50°C. Jann Mutso, chief executive of supplier Kitman Coldtech, told public broadcaster ERR that technicians stopped the interference within minutes. No significant damage was reported.

Danfoss, a Danish refrigeration technology manufacturer, said at least 17 businesses in the Netherlands were affected. These were primarily butcher’s shops and small food retailers, rather than major supermarket chains.

The total cost of the November disruption had not been established by the end of 2 November. Delhaize said its distribution centres continued operating and deliveries to stores had not been interrupted. Its spokesperson said customers might find a temporarily reduced range of fresh and frozen products at affected branches. The company did not report a wider interruption to supplies.

France’s October attack: Hundreds of stores affected

The previous wave began overnight on 11–12 October.

Refrigeration systems were manipulated at stores belonging to Intermarché, Carrefour, Coopérative U, E.Leclerc, Monoprix and other retailers.

Le Monde initially identified about 300 Intermarché and Netto stores, around 100 Coopérative U outlets, 80 Carrefour supermarkets and 30 Monoprix locations. The Paris prosecutor’s office subsequently reported around 700 victims of the attack.

At an Intermarché in Gradignan, near Bordeaux, owner Charles Dezon said a delivery driver discovered water in the storeroom at about 4 am. The attack had apparently begun around 11 pm. The temperature in a cold room had risen to 50°C, activating a sprinkler system.

Dezon told Le Monde that the store lost €21,000 worth of goods, valued at purchase price. At another Intermarché, in La Haye in Normandy, equipment reportedly melted after temperatures reached approximately 80°C.

Two supermarkets in Alsace reported combined losses of €270,000. Other stores closed temporarily to empty freezers, assess damaged equipment and arrange new deliveries. The nationwide losses were estimated at several million euros, potentially tens of millions, although no final total was available.

The Paris prosecutor’s office confirmed food losses and fires. French Prime Minister Sébastien Lecornu instructed the national cybersecurity agency ANSSI to investigate. The incidents also affected businesses outside supermarket chains. Le Monde reported problems at meat-processing and wholesale companies, while food wholesaler Metro said a service provider had been targeted and it had checked the storage conditions of its goods.

Further incidents were reported on 13 October. At one store near Bordeaux, technicians discovered a freezer control setting had been altered from -22°C to 150°C. This was the programmed setting, not a measured food temperature. Staff intervened before stock was lost.

How supermarket refrigeration systems became vulnerable

Commercial fridges are commonly linked to central controllers. These devices manage cooling, schedule automatic defrosting and send alerts when temperatures change. Maintenance contractors can often adjust them remotely instead of visiting each store.

Some management interfaces are connected directly to the public internet. If an attacker obtains access, they can alter operating settings without entering the premises or compromising the retailer’s payment systems.

In the French incidents, attackers reportedly lengthened defrost cycles from one hour to eight hours. Some alarm settings were also changed, delaying warnings while food was warming.

In August, cybersecurity company Claroty published research into the Danfoss AK-SM 800A controller. Its researchers found weaknesses in the web management software, including a way to bypass normal login checks and a flaw that could permit unauthorised commands. They identified thousands of exposed management interfaces.

Danfoss released software to address the vulnerabilities. Claroty recommended firmware version R4.3.1 or later and restricting remote access. The researchers did not investigate individual supermarket intrusions. Investigators have not established that these particular weaknesses were used in either wave of attacks.

Danfoss said some French premises were using older controllers that no longer received routine security updates. Others had supported equipment but had not installed the latest software. France’s cybersecurity authorities also identified compromises involving equipment supplied under the Copeland and Dixell names.

A refrigeration controller can remain in operation after software support ends. Replacing one may require work by specialist contractors and changes to the existing installation. In franchise networks, maintenance decisions may also rest with individual shop operators rather than a central technology department.

Spoiled food, damaged equipment and financial losses

Refrigeration failures require stores to establish how warm products became and how long they were exposed to unsuitable conditions.

Britain’s Food Standards Agency recommends keeping chilled food at 5°C or below. In England, Wales and Northern Ireland, many chilled foods must legally be stored below 8°C. Frozen products are generally kept at -18°C.

A controller set to 50°C does not mean every item immediately reaches that temperature. Retailers must assess actual storage conditions before deciding whether food is safe to sell. Restoring the normal cooling setting does not resolve questions about food that may already have warmed. That assessment requires information about time and temperature, not simply confirmation that a freezer is functioning again.

In Belgium, Luc De Laet, owner of the De Laet & Van Haver butchery business, told Reuters he was called at around 3.30 am. At his premises south of Antwerp, refrigeration temperatures had risen to 18°C. He estimated that €15,000 worth of meat had been spoiled.

The financial consequences also include damaged machinery, emergency repairs, cleaning, staff time and replacement deliveries. The French incidents involved fires at some sites, according to prosecutors.

No Europe-wide interruption to supermarket distribution had been reported on 2 November. The documented damage was concentrated in individual stores and businesses. European Agriculture Commissioner Christophe Hansen described the attacks as attempts to disrupt food supplies and undermine consumer confidence; the full consequences were still being assessed.

Why earlier warnings failed to prevent further attacks

France’s computer emergency response team, CERT-FR, issued an alert on 12 October and updated it on 13 and 16 October. It identified compromised Danfoss, Copeland and Dixell refrigeration controllers and told operators to remove their management interfaces from direct internet access.

The agency recommended checking configurations, particularly defrost schedules; installing software updates; replacing default passwords; and allowing remote maintenance only through protected connections.

A virtual private network, or VPN, is one way to provide authorised technicians with access without publicly exposing the controller.

CERT-FR also addressed compromised equipment. Restarting a controller or restoring factory settings might remove malicious changes, but would not repair vulnerabilities in an unsupported product. Equipment reconnected directly to the internet could remain accessible to attackers.

The UK’s National Cyber Security Centre similarly advises organisations to identify internet-connected control equipment, restrict access and keep supported software updated. Separate temperature monitoring can provide an additional warning if the main controller or its alarms are compromised. It does not replace the need to secure access to the controller itself.

In Estonia, technicians stopped the November interference within minutes. In Ireland, Musgrave said monitoring equipment alerted staff, although some products still had to be removed from sale.

In Belgium, refrigeration contractor Sabcobel began mobilising engineers during the night; its chief executive said some installations needed physical modifications.

No group has claimed responsibility for either wave. Belgium’s Centre for Cybersecurity said the perpetrators had not been identified. Investigators have not publicly established the precise access method used at every affected business.

New EU rules will not secure older equipment

The EU’s Cyber Resilience Act introduces security obligations for manufacturers of products containing digital components.

Since 11 September 2026, manufacturers have had to report certain actively exploited vulnerabilities and serious security incidents. The main requirements, covering product security and vulnerability management, are due to apply from 11 December 2027.

Those rules do not automatically update refrigeration controllers already operating in shops. Owners and maintenance providers still have to identify unsupported equipment and arrange protection or replacement.

The Netherlands provides an example of the warnings preceding November’s incidents. Danfoss told Dutch broadcaster NOS that it had contacted customers on 13 October, after the attack in France. It advised them to disconnect vulnerable controllers from the internet and reconnect only through secure networks.

By 2 November, at least 17 Dutch businesses had reported interference. A Danfoss spokesperson said most customers had followed the earlier advice but a smaller number had not. According to the manufacturer, the affected systems were still outside secure networks and continued using default passwords.