Cyberattacks on commercial refrigeration systems have disrupted supermarkets and food businesses across several European countries, in some cases raising freezer temperatures, forcing food withdrawals and causing significant losses. The latest incidents, reported overnight on November 1-2, followed a much larger French attack in October that reportedly affected about 700 stores.
Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia were among the countries reporting confirmed or suspected refrigeration-system compromises. The incidents share a common concern: remotely managed industrial controllers exposed to the public internet without adequate security protections.
- Belgium and Luxembourg: dozens of Delhaize stores reported refrigeration disruption, while Carrefour confirmed 15 affected stores in Belgium.
- Netherlands: at least 17 companies, primarily smaller food businesses, had refrigeration settings changed.
- Sweden: ICA and Coop reported problems; one ICA store in Sjöbo said refrigerators and freezers had been set to 50°C.
- Ireland: 13 SuperValu stores were affected, with some chilled and frozen products removed from sale as a precaution.
- Estonia: one Selver store was affected, although a rapid response reportedly limited the damage.
In the Netherlands, Danish refrigeration supplier Danfoss said attackers changed settings at systems used by at least 17 businesses. One affected cold-storage facility was intended to operate at -20°C, but its setting was changed to -10°C before staff intervened. Major supermarket chains, including Albert Heijn, did not report refrigeration failures in that wave.
Danfoss had warned customers after the French incident and advised them to remove controllers from the public internet and use secure connections. According to the company, compromised Dutch systems were not on secured networks and were still using default passwords.
France exposed the scale of the risk
The most extensive known incident occurred in France overnight on October 11-12. Attackers reportedly took control of refrigeration installations at hundreds of supermarkets, extending defrost cycles and altering temperature settings. In some cases, temperatures reached 50°C, while defrosting was extended from one hour to eight hours and alarms were affected, delaying detection.
The disruption led to the destruction of meat, dairy and frozen goods, with losses estimated in the tens of millions of euros. Fires were also reported at some stores. The affected retail groups included:
- Intermarché
- Netto
- Carrefour
- E.Leclerc
- Monoprix
- Coopérative U
France’s CERT-FR cybersecurity authority issued an alert on October 12, later updated, naming several affected controller families: Danfoss AK-SM, Danfoss AK-SC, Copeland and Dixell XWEB.
Internet exposure turns maintenance tools into attack paths
These incidents involve commercial and industrial cooling installations rather than consumer smart refrigerators. A centralized controller can manage display cases, freezers and cold rooms across a site, allowing technicians to monitor temperatures, receive alerts and change settings remotely.
That remote-management capability becomes a direct operational risk when an administrative interface is publicly reachable, unpatched or protected by default credentials. Reported attacks have targeted operating temperatures, defrost cycles and alarm systems—changes that can render perishable inventory unsafe before staff spot the problem.
The controllers were connected through GSM routers with fixed IP addresses, directly accessible from the internet, and were running fairly old software versions.
Dan Cîmpean, director of Romania’s National Cyber Security Directorate
CERT-FR recommends removing direct internet access, using secured VPN connections, changing default passwords and installing firmware updates. For systems no longer receiving security patches, a reset alone does not eliminate underlying vulnerabilities. Investigations are continuing, and there is no public evidence yet that every incident was coordinated by the same attacker or group.
