European supermarket refrigeration controls hit in cyberattacks
Cyberattacks on supermarket refrigeration controls disrupted stores in Belgium, Sweden, Estonia and several other European countries overnight into November 2. Some retailers removed chilled and frozen products from sale or discarded stock after attackers remotely changed settings on fridges and freezers.
The incidents affected no more than several dozen stores at any one chain, based on company statements. Danfoss, the Danish manufacturer of refrigeration controls, said its products were involved, as they had been during attacks on hundreds of French supermarkets three weeks earlier. No group had claimed responsibility by Monday night, and investigators had not established whether the campaigns were connected.
Temperature settings changed remotely
Refrigeration controllers are computers that operate a store's cold-storage equipment. They may be connected to the internet so contractors can monitor systems and address faults remotely. That operational convenience can create an exposed route into equipment that directly affects food safety and store availability.
In Belgium, Sabcobel chief executive Stephan Moelans said attackers switched cooling units into defrost mode. The mode is intended to remove ice, but it caused units to warm rather than preserve food. Sabcobel manages refrigeration for Delhaize, where several dozen stores, mainly in Belgium and a few in Luxembourg, experienced an IT incident that temporarily limited fresh and frozen ranges.
Other retailers reported more limited impact. Carrefour said 15 of more than 700 Belgian stores were affected, while Intermarché reported problems at 10 to 15 stores and Spar reported five independently operated stores. IKEA said one store in Mons was affected. In Sweden, an ICA store in Sjöbo said fridges and freezers had been set to 50°C and staff were disposing of affected goods.
At an Estonian Selver supermarket, a freezer on an older Danfoss system was set to 50°C. Kitman Coldtech said the temperature rose only about 2–3°C, the problem was resolved within roughly 10 minutes, and no products were damaged. A Belgian butcher estimated that refrigeration set as high as 18°C ruined about €15,000 of meat.
Older, exposed systems are a recurring risk
Danfoss told Dutch broadcaster NOS that affected Dutch systems were not on a secure network and still used default passwords. The company also told Belgian broadcaster VTM that outdated software was a principal weakness. In Estonia, Kitman Coldtech said old controllers that had not been updated were being targeted, and Selver said the affected site was its last store not yet migrated to a new system.
ICA said affected stores used an outside Danfoss control system connected to a network outside ICA's central environment. Musgrave, owner of SuperValu, said 13 of its 223 stores were affected by an incident limited to one refrigeration model; it removed chilled and frozen goods as a precaution and began restocking after resolving the issue.
Operator actions highlighted by CERT-FR
CERT-FR's October alert covers Danfoss AK-SM and AK-SC controllers, along with Copeland xweb and Dixell xweb systems, and says attack campaigns against the devices are probably still under way. It advises operators to prevent direct internet reachability, review configurations including defrost schedules, update firmware, change default passwords and restore remote access only through a secure VPN or protected network.
For Danfoss equipment, CERT-FR recommends setting the security level to Strict. A compromised device should be restarted or reset to factory settings and reconfigured before returning to service. The agency warns that end-of-life devices without security fixes are very likely to be compromised if left online, and that a factory reset alone does not prevent renewed compromise.
The practical business implication is that retailers and refrigeration contractors should treat connected cold-chain controllers as operational technology assets: identify every internet-facing device, remove unnecessary exposure, modernize unsupported systems, and ensure remote maintenance uses protected access rather than default or public-facing connections.