Supermarket refrigeration attacks hit 115+ stores in Europe; CISA/FBI warn, pro-Russian groups claim, Iran also suspected, Danfoss involved

Linha do tempo

1. wired.com ↗ · pub. 07/11/2026 10:00 · coletado 07/11 11:00

   Internet-exposed refrigeration controllers hacked across Europe and US bases; French blood bank cold rooms heated

   ler a análise desta fonte ocultar

   Three sites of the Établissement Français du Sang (EFS) storing blood and plasma bags were briefly affected on 2 November 2026 by a wave of attacks against internet-connected refrigeration systems; EFS confirmed cold rooms were raised to very high temperatures but said alarms and staff fail-safe measures prevented damage to the samples. The same wave hit supermarket chains in at least 11 European countries, forcing large volumes of food to be discarded, after an October campaign against hundreds of French stores and August incidents at roughly six commissaries and grocery stores on US military bases, now under Pentagon investigation with French law enforcement (Reuters). Attribution remains open: Russian hacktivists claimed some attacks without credible evidence and the Kremlin denied involvement, while US officials reportedly suspect Iran-linked actors for the military base freezer incidents (NextGov/FCW). Many intrusions abuse weaknesses in temperature controllers from the Danish vendor Danfoss, which states affected systems were running outdated firmware. The operational risk is physical and immediate — spoiled food and threatened cold-chain goods — rather than data theft.

   Technical Details

   The October French wave is attributed to exploitation of unpatched refrigeration controllers exposed to the internet, including software versions said to use weak, date-derived passwords. CISA warned on Thursday that attacks on cold storage systems can leverage authentication bypasses, arbitrary code injection and weak configurations. France's CERT-FR alert CERTFR-2026-ALE-012, first published 12 October 2026 and updated 16 October, names the affected equipment as Danfoss AK-SM and AK-SC series, Copeland xweb and Dixell xweb remote refrigeration controllers (cert.cyber.gouv.fr). The specific units reported hit in France are the AK-SM 800 and AK-SC 355, both end-of-life and no longer receiving security fixes, and no CVE has been tied to these compromises (brandefense.io, citing CERT-FR and Danfoss statements to AFP). Similar sabotage is not new: 16 supermarkets in Russia were targeted at the start of the full-scale war in Ukraine in 2022, and 40 stores in Israel the same year, per a 2025 Danfoss report.

   Remediation

   CERT-FR recommends updating Danfoss firmware, setting the security level to Strict mode and ensuring default passwords have been changed (cert.cyber.gouv.fr). Sweden's National Cyber Security Center advises organisations to inventory internet-connected devices, disconnect them where possible and keep any that must remain online access-controlled, patched and monitored. Operators should also verify that temperature alarms and manual fail-safe procedures work, as these limited the impact at EFS.

2. unit42.paloaltonetworks.com ↗ · pub. 06/11/2026 18:15 · coletado 06/11 19:00

   Pro-Russian hacktivists claim attacks forcing refrigeration controllers into defrost mode across European supermarkets and medical sites

   ler a análise desta fonte ocultar

   Unit 42 reports on the wave of cyberattacks against refrigeration controllers in Europe, in which unidentified threat actors gained unauthorized access to internet-exposed units and set them to defrost mode, spoiling stock in hundreds of supermarkets. The first wave struck overnight on Oct. 11–12, 2026, hitting roughly 700 supermarkets in France; a second wave overnight on Nov. 1–2, 2026 reached at least 10 additional European countries and over 100–115 retail locations. French authorities later disclosed that refrigeration systems at medical facilities were also affected, with no evidence so far that blood products were spoiled. Multiple sources report temperatures driven as high as 50°C (122°F), in some cases causing fires. On Nov. 3, 2026 the pro-Russian hacktivist groups NoName057(16) and Z-Pentest claimed responsibility on Telegram, though the claims remain unverified.

   Technical Details

   The initial access vector remains unconfirmed. Speculation centres on vulnerable software versions and manufacturer default credentials on exposed controllers. CISA issued an advisory on Nov. 5, 2026 warning of potential exploitation via authentication bypass, arbitrary code injection and weak configurations; press reporting describes it as a joint advisory with the FBI, HHS and other agencies covering retail grocery and cold storage operators (scworld.com). CERT-FR's advisory of mid-October named compromises involving Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers (esecurityplanet.com); no CVE has been attributed to this activity. Between Nov. 5–6, 2026, Unit 42 observed over 5,000 internet-exposed devices from the manufacturers listed by CERT-FR using Cortex Xpanse, noting that exposure does not imply vulnerable firmware. French exposure declined markedly from 1,853 devices in the Oct. 1–15 period.

   Remediation

   Remove refrigeration and building-management controllers from direct internet exposure, replace default manufacturer credentials, restrict administrative interfaces, update controller firmware and monitor control-plane traffic for anomalous setpoint or defrost commands. Unit 42 points to Cortex Xpanse for external exposure discovery, Device Security for OT/IoT visibility and weak-configuration detection, and Frontier Virtual Patching with Advanced Threat Prevention for inline blocking of exploit attempts and code injection.

3. hipaajournal.com ↗ · pub. 06/11/2026 11:27 · coletado 06/11 12:00

   FBI, CISA, HHS Warn of Attacks on Refrigeration and Cold Chain Controllers After European Supermarket and Blood Bank Incidents

   ler a análise desta fonte ocultar

   A joint fact sheet from the FBI, CISA, HHS, USDA and DOT warns that malicious actors are targeting unpatched or internet-exposed temperature controllers and commercial refrigeration controllers. The warning followed attacks that began in mid-October 2026 in Europe. Attackers remotely raised temperatures and triggered defrost cycles. Hundreds of French supermarkets discarded produce, and the French blood bank EFS nearly lost blood products. In one case, parameters were set that would have pushed temperatures to 150°C. Attribution is unconfirmed. The bulletproof hosting used has previously been linked to Russia-linked operations, but that alone does not prove state sponsorship. Many intrusions used the manufacturer's default credentials.

   Technical Details

   • Attackers gained remote access to internet-exposed controllers, often with default credentials, and altered temperature and defrost thresholds.
   • The fact sheet also cites authentication bypass, arbitrary code injection and weak configurations as possible attack paths (cisa.gov).
   • Reported impacts: food spoilage, inventory loss, fire hazards and hardware damage.
   • Sectors named: healthcare and public health, food and agriculture, chemical, and transportation (cisa.gov).
   • Stores in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported refrigeration problems (cisa.gov).
   • The article and the CISA release name no CVEs, malware or IOCs.

   Remediation

   • Remove control systems from direct internet exposure.
   • Change default passwords and use strong passwords.
   • Apply patches and firmware updates promptly.
   • Retire and replace end-of-support devices.
   • Monitor for unexpected activity.
   • Report suspicious activity to the FBI, CISA or, for healthcare entities, HHS (cisa.gov).
4. securityweek.com ↗ · pub. 06/11/2026 10:02 · coletado 06/11 12:00

   US agencies warn of attacks on internet-exposed refrigeration controllers after European supermarket and blood bank incidents

   ler a análise desta fonte ocultar

   CISA, the FBI, HHS, USDA and DoT issued a joint advisory urging healthcare, chemical, food and transportation organizations to harden commercial refrigeration and cold chain controllers. Attackers have been tampering with monitoring systems in European supermarkets and blood banks. On October 11 they set fridges to 50°C and freezers to defrost at hundreds of supermarkets, spoiling food and in some cases causing fires. A second wave this week hit more than 100 supermarkets and a blood bank. Only the supermarkets suffered losses. Separately, the French Blood Establishment (EFS) said quick action by its staff prevented the compromise of blood products and samples. Attribution is unconfirmed. Russian hacktivist groups Noname057(16) and Z-Pentest Alliance reportedly claimed to have hacked Danfoss, but Iranian hacktivists or state-sponsored actors may also be responsible (BBC, as cited by the article). The campaign is rated critical because the attacks are ongoing, have caused mass physical and financial damage, and target exposed controllers.

   Technical Details

   The agencies say the actors may exploit authentication bypasses, code injection, weak configurations, and unpatched or internet-accessible controllers. They use these to change settings remotely, force continuous heating and defrost cycles, or cause denial-of-view conditions. The article names no CVEs. Censys counted 6,695 internet-exposed controllers on October 9. On November 5, 3,124 (47%) were still reachable. Copeland/Dixell XWEB exposure fell 35% (3,708 to 2,420). Danfoss StoreView exposure fell 76% (3,004 to 708).

   Remediation

   • Take the control systems off the internet. If web access is needed, put them behind a firewall or edge device.
   • Isolate OT devices and restrict access to trusted identities.
   • Enforce strong passwords and phishing-resistant MFA.
   • Keep systems updated and maintain offsite backups.
   • Enable logging and monitoring.
5. malwarebytes.com ↗ · pub. 06/11/2026 09:02 · coletado 06/11 10:01

   CISA, FBI warn on industrial refrigeration attacks after Danfoss-linked supermarket and French blood-service cold-storage intrusions

   ler a análise desta fonte ocultar

   On November 5, CISA, the FBI and three other US federal agencies warned operators to secure industrial refrigeration and cold-chain monitoring systems. The warning follows attacks on supermarket refrigeration systems in Europe, including at least 17 mostly small businesses in the Netherlands on November 2. France's national blood service also confirmed that monitoring and control systems at three cold-storage sites were affected. Staff intervened before any blood products or samples were compromised. The article names no threat actor, malware or CVE. This summary draws on the article alone, and no web research was done.

   Technical Details

   • Danfoss said the affected systems were reachable through unsecured connections and used default passwords (per NOS, cited by malwarebytes.com).
   • The agencies warn that attackers may exploit authentication bypass flaws, code-injection vulnerabilities or weak configurations in refrigeration controllers. Successful attacks could change temperatures or force equipment into continuous heating or defrost cycles.
   • Danfoss told Dutch customers on October 13, after the first attacks in France, to disconnect systems from the public internet. Most stores followed the advice, and major Dutch chains were reportedly unaffected.

   Remediation

   • Keep control panels off the public internet and isolate operational equipment from business networks.
   • Change default passwords and use strong authentication.
   • Patch firmware and replace unsupported devices.
   • Set safe operating limits, with alerts for temperatures outside them.
6. infosecurity-magazine.com ↗ · pub. 06/11/2026 08:50 · coletado 06/11 10:01

   CISA, FBI warn of attacks on internet-exposed industrial refrigeration controllers after Danfoss, Copeland/Dixell and Coolworld incidents

   ler a análise desta fonte ocultar

   CISA, the FBI and other federal agencies published a joint advisory on November 5, 2026. It warns of malicious activity targeting industrial refrigeration and cold chain monitoring systems globally. Attackers exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles. This can cause widespread inventory loss and equipment hazards. The warning follows European incidents: supermarkets hit through systems administered by Danfoss (reported October 11), a similar incident on November 1 affecting supermarkets in at least nine European countries, and a cyber-attack on Coolworld that reportedly pushed cold storage rooms at France's blood service (EFS) to 110°C. No threat actor has been attributed.

   Technical Details

   • The agencies list three access paths: authentication bypass, arbitrary code injection and weak configurations on internet-exposed systems (infosecurity-magazine.com).
   • Sectors highlighted in the advisory: healthcare, chemical, food and agriculture, and transportation (infosecurity-magazine.com).
   • Censys data from November 5 shows a 53% drop in internet-exposed controllers across Danfoss StoreView and Copeland/Dixell XWEB, the products compromised in the October 11 and November 2 incidents respectively. The drop is consistent with provider action or owners disconnecting devices (infosecurity-magazine.com).
   • The Danfoss attackers reportedly set temperatures as high as 50°C (infosecurity-magazine.com).

   Remediation

   • Do not expose controller panels to the internet.
   • If remote access is required, place it behind a firewall or edge device and keep it updated.
   • Isolate OT from business networks.
   • Change default passwords and enforce phishing-resistant MFA.
   • Retire end-of-life devices through a lifecycle management process.
   • Restrict changes to authorized devices and IP addresses.
   • Keep tested offline and offsite backups.
7. helpnetsecurity.com ↗ · pub. 06/11/2026 06:04 · coletado 06/11 08:01

   CISA, FBI, HHS, USDA and DOT warn of attacks on refrigeration controllers after European supermarket and blood bank disruptions

   The article adds that the French Blood Establishment (EFS) confirmed temperature spikes in three blood banks after a refrigeration equipment provider was hit. It also names more affected countries (Sweden, Luxembourg, Finland, Ireland, Estonia) and quotes CISA and FBI officials. Help Net Security says the synchronized timing suggests a possible nation-state actor, though the attackers remain unidentified.

   ler a análise desta fonte ocultar

   The article adds that the French Blood Establishment (EFS) confirmed temperature spikes in three blood banks after a refrigeration equipment provider was hit. It also names more affected countries (Sweden, Luxembourg, Finland, Ireland, Estonia) and quotes CISA and FBI officials. Help Net Security says the synchronized timing suggests a possible nation-state actor, though the attackers remain unidentified.

   Five US agencies (CISA, FBI, HHS, USDA and DOT) published a joint advisory on 5 November 2026. It warns of ongoing malicious activity against industrial refrigeration and cold-chain monitoring systems worldwide. Attackers are going after electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage. They can push units into continuous heating and defrost cycles, which causes inventory loss, equipment damage and fire hazards. Affected sectors are healthcare and public health, chemical, food and agriculture, and transportation. The advisory follows attacks on supermarkets in France and other European countries. The attackers remain unidentified, and the synchronized timing suggests a possible nation-state actor (helpnetsecurity.com).

   Technical Details

   • The agencies say attackers may exploit controllers that are unpatched or reachable from the internet. The routes named are authentication bypass, arbitrary code injection and weak configurations.
   • Once inside, attackers can change temperature settings remotely and force units into heating.
   • Operators may also lose sight of current temperatures, which the agencies call a "denial-of-view condition".
   • Unsafe storage could indirectly harm consumers if food or medicine is consumed afterwards.
   • Help Net Security reports that hundreds of French supermarkets were hit overnight. A second wave three weeks later hit Belgium, Luxembourg and Sweden. Later reports added Finland, Ireland, Estonia and the Netherlands.
   • The French Blood Establishment (EFS) confirmed that three blood banks detected a temperature spike in their cold rooms after one of its refrigeration equipment providers was hit.
   • The article names no CVEs, IOCs or specific vendor products.

   Remediation

   • Stop exposing controller panels and other control system devices to the internet. Where remote access is unavoidable, route it through a firewall or edge device kept at its latest version.
   • Put OT devices on a dedicated VLAN separate from business networks.
   • Change default passwords and enable phishing-resistant MFA where feasible.
   • Keep firmware up to date, and retire and replace devices the vendor no longer supports.
   • Limit changes with device and IP address allowlisting.
   • Keep tested offline backups and enable logging.
   • Define reasonable setpoint limits for devices downstream of controllers, and alert on any deviation.
   • Report suspicious activity to the FBI.
8. industrialcyber.co ↗ · pub. 06/11/2026 07:34 · coletado 06/11 08:00

   CISA, FBI and partners warn of attacks on exposed refrigeration controllers after supermarket cooling disruptions across Europe

   ler a análise desta fonte ocultar

   CISA, the FBI, HHS, USDA and DOT issued a joint fact sheet on Thursday warning of malicious activity against industrial refrigeration and cold-chain monitoring systems worldwide. Targets are electronic temperature controllers and commercial refrigeration controllers in retail grocery stores and cold storage. Affected sectors are healthcare and public health, chemical, food and agriculture, and transportation. The warning follows two waves of attacks on European supermarkets: Oct. 11-12 in France, and Nov. 2 across at least seven EU countries, where more than 100 stores and businesses reported problems. No group has claimed responsibility, and authorities have not established whether one perpetrator is behind both waves.

   Technical Details

   • The agencies say attackers may exploit unpatched or internet-accessible devices through authentication bypass, arbitrary code injection and weak configurations (industrialcyber.co, reporting the fact sheet).
   • Attackers can change temperature settings remotely, trigger continuous heating and defrost cycles, and disrupt temperature visibility. The results are inventory losses and equipment and fire hazards.
   • In France, freezers and fridges reportedly reached up to 50 °C and some stores had fires.
   • On Nov. 2, Sabcobel said attackers accessed cooling systems and switched evaporators into defrost mode.
   • Danfoss said some targeted systems in the Netherlands were on unsecured networks and still used default passwords.
   • A Cato Networks commentator noted published research on vulnerabilities in Danfoss AK-SM 800A and Copeland XWEB Pro controllers. Their exploitation in these attacks is not confirmed.
   • A Pentagon investigation into suspected attacks on refrigeration at military commissaries was reported by Xage Security. The article does not confirm it.

   Remediation

   • Remove direct public internet exposure, including maintenance providers' cellular connections.
   • Isolate OT from business networks.
   • Change passwords and use phishing-resistant MFA (the agencies' guidance). Danfoss and Cato Networks commentary adds replacing default and shared passwords.
   • Keep firmware current and retire end-of-life equipment.
   • Allowlist authorized devices and IP addresses.
   • Keep tested offsite and offline backups.
   • Enable logging, and collect network traffic where OT assets lack logs.
   • Set safe temperature limits downstream of controllers, with deviation alerts, and use independent temperature monitoring.
   • Secure necessary remote access through firewalls or edge devices.
9. securityaffairs.com ↗ · pub. 06/11/2026 06:46 · coletado 06/11 08:00

   ENISA and EU bodies warn of attacks on Danfoss refrigeration controllers hitting French supermarkets

   The joint ENISA, European Commission, Europol EC3, EU CSIRTs Network and EU-CyCLONe statement of 4 November reports attacks on commercial refrigeration systems in several Member States. The attacks began in October, with a new wave on 1-2 November. French victims are reportedly about 300 Intermarché and Netto stores and fewer than 100 Coopérative U outlets. BFMTV reported that the French incidents involved end-of-support or outdated Danfoss controllers. No attribution has been given.

   ler a análise desta fonte ocultar

   The joint ENISA, European Commission, Europol EC3, EU CSIRTs Network and EU-CyCLONe statement of 4 November reports attacks on commercial refrigeration systems in several Member States. The attacks began in October, with a new wave on 1-2 November. French victims are reportedly about 300 Intermarché and Netto stores and fewer than 100 Coopérative U outlets. BFMTV reported that the French incidents involved end-of-support or outdated Danfoss controllers. No attribution has been given.

   ENISA, the European Commission (DG CNECT), Europol EC3, the EU CSIRTs Network and EU-CyCLONe issued a joint warning on 4 November. It follows attacks on commercial refrigeration systems in several EU Member States. The attacks began in October, and a new wave hit on 1-2 November. In France, attackers remotely changed settings on refrigeration management systems at hundreds of supermarkets and forced freezers into continuous defrost. Some units reportedly reached 50°C, and fresh and frozen stock was destroyed. About 300 Intermarché and Netto stores and fewer than 100 Coopérative U outlets were reportedly affected. Authorities have not attributed the campaign.

   Technical Details

   • BFMTV reported that the targets were Danfoss refrigeration controllers used in French stores (securityaffairs.com).
   • The devices were older controllers that were end-of-support and no longer received security updates. Other systems ran outdated firmware (securityaffairs.com).
   • Researchers had earlier found Danfoss controller flaws, including authentication bypass. Authorities have not confirmed that these flaws were exploited (securityaffairs.com).
   • The Paris prosecutor reportedly said fires also occurred (securityaffairs.com).
   • The article gives no CVEs, IOCs or attacker identity.

   Remediation

   • ENISA urges immediate action to reduce exposure of the affected systems. It has published a collection of national CSIRT technical advisories (securityaffairs.com).
   • ENISA also stresses rapid information-sharing.
   • The article recalls the regulatory background. Under the Cyber Resilience Act, manufacturers have had to report severe incidents and actively exploited vulnerabilities since 11 September 2026. The main CRA requirements apply from 11 December 2027. NIS2 entities must manage cyber risk and report significant incidents.
10. bleepingcomputer.com ↗ · pub. 05/11/2026 21:56 · coletado 05/11 23:00

    FBI, CISA Warn of Attacks on Industrial Refrigeration and Cold-Chain Systems After European Supermarket and Blood Bank Incidents

    ler a análise desta fonte ocultar

    The FBI and CISA, jointly with the U.S. Departments of Health and Human Services (HHS), Agriculture (USDA), and Transportation (DOT), issued an advisory warning that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, with potential to cause food spoilage, equipment damage, and fire hazards. The warning covers electronic temperature controllers and commercial refrigeration management systems used across healthcare, food production, chemical, and transportation sectors. It follows a wave of attacks in Europe: in October, hackers compromised refrigeration controllers at an estimated 250 to 350 French supermarkets, remotely triggering defrost cycles, and a second wave in November hit more than 115 stores across six European countries, with some systems shut down entirely and temperatures raised as high as 50°C (122°F). On November 3, the French Blood Establishment (EFS) confirmed that a cybersecurity incident at a refrigeration equipment provider altered temperature and defrost settings at three facilities storing blood products. CISA's Acting Executive Assistant Director for Cybersecurity, Chris Butera, said every organization relying on refrigeration and monitoring systems should assume it could be a target.

    Technical Details

    The agencies state that attackers are exploiting authentication bypass vulnerabilities, arbitrary code injection flaws, or weak configurations in unpatched or internet-accessible controllers to modify temperature settings and force equipment into continuous heating or defrost cycles. This can cause inventory losses, reduced equipment lifespan, fire hazards, unsafe storage conditions, and reduced visibility into real-time temperatures, delaying detection of problems. No specific CVE identifiers, named vulnerable products, or threat actor attribution are disclosed in the advisory as reported; no group has claimed responsibility for the European attacks, and authorities remain on alert for possible hybrid threats amid tensions with Russia (therecord.media). Separately, the U.S. Defense Department's inspector general is investigating freezer and refrigeration malfunctions at several U.S. military commissaries that began in August, though it remains unclear whether these are connected to the European wave (therecord.media); prior reporting had suggested suspected Iran-linked activity behind those military base incidents (nextgov.com).

    Remediation

    The agencies recommend removing refrigeration controllers from the public internet, securing any necessary remote access, changing default passwords, applying available security updates, isolating operational technology (OT) systems from business networks, and enforcing safe temperature limits to prevent controllers from operating outside acceptable ranges.

11. theregister.com ↗ · pub. 05/11/2026 19:37 · coletado 05/11 20:00

    US agencies warn grocers and cold-chain operators of global refrigeration hacking spree spoiling food, risking fires

    ler a análise desta fonte ocultar

    The FBI, CISA, Health and Human Services, USDA, and the Department of Transportation issued a joint advisory on Thursday warning operators of industrial refrigeration and cold-chain monitoring systems about an ongoing wave of attacks. Since mid-October, unknown attackers have hacked thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg, and Sweden, forcing units to overheat to as high as 50°C (122°F), spoiling food and sparking fires. No confirmed attacks against US supermarkets have been documented, but Ahold Delhaize (parent of Food Lion, Giant Food, and Stop & Shop) proactively took IT systems offline last month after a cyberattack, and the Pentagon is reportedly investigating freezer malfunctions that spoiled food at US military bases in August as a suspected cyberattack.

    Technical Details

    According to the agencies, the actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards. The article states that attackers gain access by bypassing authentication, injecting arbitrary code, and abusing weak configurations, allowing them to change temperatures to spoil food or temperature-controlled medications, start fires, and potentially harm consumers of improperly stored products. No specific CVE or vulnerable vendor product was named in the advisory or the article; the threat is attributed to internet-exposed electronic temperature and commercial refrigeration controllers broadly, not a single named flaw. Separately, the agencies drew a parallel to Iranian hackers who used internet-accessible programmable logic controllers (PLCs) to breach more than 100 US water systems in July, citing exposed, often password-less devices as an easy entry point for attackers.

    Remediation

    The agencies urge owners and operators to immediately disconnect industrial control systems and devices from the public internet; if remote access is required, protect it behind a firewall or edge device kept up to date. Additional recommendations include creating a dedicated VLAN to isolate OT devices from business networks, replacing default passwords with strong, unique credentials and enabling phishing-resistant multi-factor authentication, applying patches promptly and retiring unsupported legacy devices, maintaining a device/IP allow-list restricting OT access, keeping offsite and offline backups, and enabling and regularly reviewing logs for unusual activity.

12. techcrunch.com ↗ · pub. 05/11/2026 15:48 · coletado 05/11 16:00

    CISA, FBI Warn of Ongoing Attacks on Industrial Refrigeration Systems Linked to Suspected Iranian Actors

    ler a análise desta fonte ocultar

    CISA, the FBI, and the U.S. Departments of Agriculture, Health and Human Services, and Transportation issued a joint advisory warning of an 'ongoing cyber threat' targeting internet-connected industrial refrigeration and cold chain monitoring systems. The warning follows waves of attacks against supermarket freezers across the United Kingdom and Europe, a French blood bank, and U.S. military refrigeration units, in which attackers manipulated temperature settings to spoil food, threaten blood supplies, and risk fire hazards or equipment damage. Some compromised systems were manufactured by Danish company Danfoss, which had stopped providing security updates for the affected units. While the U.S. has not formally attributed the attacks, researchers and officials reportedly suspect Iran is behind the campaign.

    Technical Details

    Attackers are reportedly gaining remote access to internet-exposed refrigeration control systems and forcing units into continuous heating and defrost cycles, causing inventory loss and equipment hazards. Affected sectors span food, agriculture, transportation, and medical cold-chain operations, including a blood bank in France where an attack on refrigerated blood storage was stopped before causing losses, and U.S. military bases currently under Department of Defense investigation.

    Remediation

    CISA, the FBI, and partner agencies urge affected organizations to remove remote-control refrigeration systems from direct internet exposure, change and strengthen passwords, apply available patches, and retire equipment no longer supported by vendors.

13. hackread.com ↗ · pub. 04/11/2026 09:36 · coletado 04/11 10:01

    Cyberattacks Alter Refrigeration Controls Across European Supermarkets, Forcing Food Discards

    ler a análise desta fonte ocultar

    On November 2, attackers remotely altered refrigeration settings at supermarkets and food suppliers across multiple European countries, forcing stores to discard chilled and frozen food. Affected retailers include ICA (Sweden), Coop (Sweden), Delhaize and Carrefour (Belgium/Luxembourg), Musgrave Group/SuperValu (Ireland), Edeka (Germany), and UK suppliers including Langridge Organic and three abattoirs monitored by the Association of Independent Meat Suppliers. The incidents follow an earlier wave in France on October 12 that caused food losses and reported fires at hundreds of stores, investigated by CERT-FR. Attackers appear to exploit internet-exposed refrigeration controllers, including Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB systems, switching evaporators into defrost mode and disabling temperature alert messages. No attacker attribution has been established, and the UK's National Cyber Security Centre (NCSC) is assisting affected organizations.

    Technical Details

    Belgian refrigeration company Sabcobel reported attackers switched evaporators into defrost mode, warming equipment; some fixes required physical intervention rather than software patches alone. In the UK, Langridge Organic had six of ten cold-room controllers altered, with automated temperature-alert messages disabled; staff caught the issue via manual checks. Copeland confirmed its Dixell XWEB controls were identified in UK incidents and is circulating patching guidance. A prior Forescout Vedere Labs scan (reported October 26) found 12,976 internet-exposed refrigeration services across 6,017 public IPs in 99 countries/territories, highlighting the attack surface of management interfaces controlling temperature, defrost schedules, and alarms.

    Remediation

    CERT-FR recommends removing public internet access to refrigeration controllers, reviewing configurations, updating firmware, changing default passwords, and routing remote maintenance through a secured VPN or protected network. It warns that resetting an unsupported controller without addressing underlying weaknesses leaves it exposed to repeat compromise. Danfoss has similarly advised customers against exposing refrigeration controls directly to the internet.

14. darkreading.com ↗ · pub. 03/11/2026 19:16 · coletado 03/11 21:00 só resumo do feed

    European Cold-Chain Refrigeration Systems Hit by Remote Access Attacks

    ler a análise desta fonte ocultar

    Recent incidents in Europe show attackers targeting temperature-controlled infrastructure, such as commercial refrigeration and cold-storage systems, by abusing exposed Internet connectivity and weak remote access controls. The attacks highlight how OT environments supporting food storage and other temperature-sensitive operations share the same security weaknesses as traditional industrial control systems. Beyond food supply chains, the article notes that similar combinations of Internet-facing connectivity, remote access tools, and poor security hygiene could expose temperature-controlled infrastructure in other critical sectors, including pharmaceuticals and healthcare cold storage. The piece frames these fridge attacks as a wake-up call for cold-chain operators to reassess exposure of remote management interfaces and strengthen authentication and network segmentation.

    Remediation

    Organizations operating temperature-controlled or cold-chain infrastructure should audit Internet-facing remote access points, enforce strong authentication, segment OT networks from IT and the Internet, and monitor for unauthorized access to refrigeration and climate-control systems.

15. olhardigital.com.br ↗ · pub. 03/11/2026 17:23 · coletado 03/11 18:01

    IoT Attack Spikes Supermarket Freezer Temperatures to 50°C Across Seven European Countries

    ler a análise desta fonte ocultar

    On the night of Monday, November 2, 2026, threat actors remotely tampered with internet-connected refrigeration systems in supermarkets across seven European countries, causing freezer and fridge temperatures to spike to 50°C. Delhaize, Belgium's largest retailer, confirmed problems across dozens of stores. The incident highlights the growing exposure of IoT-connected industrial and retail equipment to cyberattacks, raising concerns about food safety, operational disruption, and the security posture of connected cold-chain infrastructure. The article is behind a paywall and provides limited technical detail on the attack vector or responsible actor.

16. cybersecuritydive.com ↗ · pub. 03/11/2026 12:59 · coletado 03/11 14:01 só resumo do feed

    European and US authorities investigate ongoing attacks on grocery refrigerators and hacks at US military bases

    ler a análise desta fonte ocultar

    European authorities are investigating ongoing attacks targeting grocery refrigerators, according to Cybersecurity Dive. US military investigators are working with French agencies after hacks hit domestic bases. The source provides only a headline and subhead. It gives no details on the attack method, vulnerabilities, affected products, victims, attribution or impact. Treat the story as an open investigation with unconfirmed scope.

    Technical Details

    The source states no technical details, CVEs, indicators or attacker identity.

    Remediation

    The source gives no remediation guidance. Generic advice for operators of building and refrigeration control systems is to avoid exposing them directly to the internet, restrict remote access, and watch for unexpected configuration changes.

17. industrialcyber.co ↗ · pub. 03/11/2026 10:03 · coletado 03/11 14:01

    Suspected OT attacks hit refrigeration systems at supermarkets in Sweden, Belgium and Luxembourg

    ler a análise desta fonte ocultar

    Supermarket chains in Sweden, Belgium, and Luxembourg have reported a new wave of suspected cyberattacks targeting refrigeration systems, following an earlier incident in which attackers reportedly manipulated cooling equipment across hundreds of French stores, causing significant food losses. Unlike typical IT-focused attacks, these incidents affect operational technology (OT) controlling refrigeration, with potential consequences including spoiled food, interrupted operations, financial losses, and food safety risks. Michael Ferdinandsen, CEO of Danish industrial cybersecurity firm Secomea, says the incidents highlight that many retailers lack sufficient control over third-party remote access to refrigeration equipment, which is often exposed to the internet or granted overly broad access by external service providers and maintenance technicians. Investigators are still examining the latest suspected attacks, and no technical details of the intrusion method have been disclosed.

    Remediation

    Secomea recommends adopting OT-native secure remote access architectures that control connections at the individual asset level rather than granting broad network access, using Edge Gateways near operational assets, centralized access management, granular permissions, and audit logging. The company points to Danish firm AK-Centralen, which uses this approach to remotely monitor refrigeration systems across more than 1,500 supermarkets without direct access to internal networks, as a model combining operational efficiency with stronger security controls. Broader recommendations include vulnerability management, network segmentation, system updates, and continuous monitoring of third-party remote access across OT environments.

18. olhardigital.com.br ↗ · pub. 03/11/2026 10:24 · coletado 03/11 12:02

    Cyberattacks on Supermarket Refrigeration Systems Hit 7 European Countries, Force Food Disposal

    ler a análise desta fonte ocultar

    A new wave of cyberattacks struck supermarket refrigeration systems across Sweden, Ireland, Netherlands, Estonia, Finland, Belgium and Luxembourg on Monday, November 2, 2026, causing unauthorized temperature changes in refrigerators and freezers and forcing retailers to discard spoiled food. The incident follows a similar attack less than a month earlier that hit over 500 stores in France, renewing concerns about the digital vulnerability of Europe's food supply chain. Affected retailers include Carrefour (~15 of 700 Belgian stores), an Ikea unit in Mons, the butcher chain De Laet & Van Haver in Antwerp (temperatures reaching 18°C), Ahold Delhaize, Colruyt Group's Spar stores, Intermarché, Coop and ICA in Sweden (one freezer reached 50°C), Musgrave's SuperValu chain in Ireland, Kesko in Finland, Selver in Estonia, and smaller retailers in the Netherlands. No group has claimed responsibility, and Belgian and EU officials warn attribution may never be determined.

    Technical Details

    Many affected systems reportedly use temperature control technology from Danish manufacturer Danfoss, the same vendor implicated in the earlier French attacks. Danfoss stated it is working with customers to implement security fixes. Researcher Tom Hegel of SentinelOne noted that attackers likely accessed exposed control panels, leaving minimal forensic traces, making it difficult to distinguish between a lone actor and a state-sponsored operation. The absence of ransom demands in these incidents suggests possible sabotage rather than extortion motives.

    Remediation

    Danfoss is reportedly working with affected customers to implement security patches for the exposed control systems; no further technical remediation details were provided in the article.

19. infosecurity-magazine.com ↗ · pub. 03/11/2026 10:45 · coletado 03/11 12:01

    Cyber-Attack on Refrigeration Systems Disrupts Supermarkets Across Nine European Countries

    ler a análise desta fonte ocultar

    A cyber-attack targeting internet-connected refrigeration systems has struck supermarkets in at least nine European countries—Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden—causing freezer and fridge temperatures to be remotely set as high as 50°C, destroying food stock. The incident follows a similar October 2026 attack on refrigeration providers Danfoss and Copeland that affected French supermarket chains, suggesting a possible connection or copycat campaign. Affected retailers include SuperValu in Ireland (13 stores precautionarily cleared of stock), ICA Sweden, and an Ikea outlet in Mons, Belgium. The UK has also reported limited exploitation of vulnerable refrigeration technology per the NCSC. No threat actor has claimed responsibility, but EU officials suspect a deliberate, possibly nation-state-linked attempt to disrupt Europe's food supply chain.

    Technical Details

    Attackers appear to have gained remote access to internet-connected refrigeration units, reprogramming temperature controls to extreme levels (~50°C/122°F), spoiling chilled and frozen goods. The attack vector has not been confirmed, but the pattern mirrors the Danfoss/Copeland incident from October 2026 affecting the same category of connected industrial refrigeration equipment. Sweden's NCSC and the UK NCSC are coordinating with counterparts across Nordic and European countries to assess scope and exploited vulnerabilities.

    Remediation

    Affected retailers removed chilled and frozen products from shelves as a precaution. The UK NCSC has alerted potentially affected companies. EU Agriculture and Food Commissioner Christophe Hansen stated the incidents will be discussed at the EU's Security College to review retailers' contingency plans and incident response capabilities.

20. itsecurityguru.org ↗ · pub. 03/11/2026 11:12 · coletado 03/11 12:00

    Second Wave of Supermarket Refrigeration Cyberattacks Hits Seven European Countries

    ler a análise desta fonte ocultar

    A second wave of suspected cyberattacks against supermarket refrigeration systems struck Belgium, Sweden, Luxembourg, Finland and Ireland (among seven countries) on 2 November 2026, following earlier attacks on French supermarkets in October that caused widespread food spoilage. Affected retailers reportedly include Carrefour, Intermarché, Coop, ICA and Delhaize, with attackers manipulating refrigeration temperatures up to 50°C. The perpetrators and motive remain unconfirmed, but the attacks highlight the exposure of internet-connected operational technology, particularly remote refrigeration management platforms such as Copeland/Dixell XWEB and Danfoss StoreView. Research from Forescout Research – Vedere Labs found nearly 13,000 internet-exposed refrigeration service observations across 99 countries, tied to over 6,000 distinct public IPs, many running outdated software.

    Technical Details

    Attackers appear to exploit unsecured remote access capabilities on refrigeration management systems to switch cooling units into defrost mode, raising temperatures and spoiling stock. Experts note these IoT/OT devices often run outdated firmware, lack processing power for modern security controls, and are frequently exposed to the internet via cellular, wired or Wi-Fi connections for remote monitoring, making them attractive, low-sophistication targets for disruption rather than data theft.

    Remediation

    Security specialists recommend identifying internet-exposed refrigeration and OT equipment, restricting unnecessary remote/internet access, applying available firmware updates, deploying network-level monitoring to detect anomalous communications, and incorporating operational technology into incident response and business continuity planning, including procedures for handling spoiled inventory and restoring correct temperatures.

21. securityweek.com ↗ · pub. 03/11/2026 04:43 · coletado 03/11 05:00

    Over 100 European stores hit as Danfoss and Copeland refrigeration controllers are hijacked in a second attack wave

    ler a análise desta fonte ocultar

    More than 100 stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden had refrigerators and freezers forced to heat up overnight from Sunday to Monday. Problems were also reported in Finland, Italy and Portugal. The incidents resemble the attacks of 11-12 October that hit about 700 French supermarkets, but investigators have not established whether the two waves are linked, and no one has claimed responsibility. The affected devices are reportedly Danfoss and Copeland refrigeration controllers with internet-reachable management interfaces. Officials have not publicly explained how the attackers got in. The EU agriculture commissioner called the attacks a deliberate attempt to disrupt the food supply chain.

    Technical Details

    • In the first wave (France, 11-12 October), refrigeration units at about 700 stores were forced into defrost mode, including Intermarché, Carrefour, Coopérative U and Monoprix. Food was spoiled and fires were reportedly caused. CERT-FR tied the compromises to Danfoss AK-SM and AK-SC controllers, then extended its alert to Copeland and Dixell XWEB systems. Danfoss said most compromised units were legacy products it no longer updates.
    • In the new wave, a Belgian refrigeration firm (Sabcobel) said attackers forced the evaporators into defrost mode, as in France. Some units were set as high as 50°C. Sabcobel said a software update is not enough and the equipment also needs physical modification.
    • Researcher Kevin Beaumont said every freezer hit on Monday had an internet-reachable management interface. Many devices are end-of-life with no patch available.
    • Lupovis saw suspicious activity against its Danfoss AK-SM sensors between 20 and 30 October, peaking on 26 October. Most login attempts used factory-default credentials documented publicly, and others appeared to fingerprint specific controller components. All attempts were rejected.
    • Censys counts just over 1,000 Danfoss StoreView interfaces online. Exposed instances in France fell from 1,825 before the attacks to 220. About 41% of the French instances still online appear patched, against 68% in Belgium (138 exposed), 37% in the Netherlands (51) and 58% in Sweden (50). Censys did not say whether patched devices were among those compromised on Monday.
    • Reported impact: Delhaize (several dozen stores in Belgium, four in Luxembourg), Carrefour Belgium (15 locations), Colruyt (five Spar shops), an IKEA store in Mons, SuperValu in Ireland (13 stores), ICA and Coop in Sweden, Kesko in Finland, Coop-branded stores in Sicily, seven Intermarché stores in Portugal, and at least 17 businesses in the Netherlands. The Belgian federal prosecutor has opened an investigation.

    Remediation

    • Danfoss told customers on 13 October to cut their systems' internet connections and reconnect only through a secure network. Some stores did not act.
    • Remove management interfaces of refrigeration controllers from the internet, change default credentials, and apply available firmware updates. Replace or physically modify end-of-life units that cannot be patched.
22. thehackernews.com ↗ · pub. 03/11/2026 04:27 · coletado 03/11 05:00

    Second wave of attacks on Danfoss refrigeration controls hits supermarkets in Belgium, Sweden, Estonia and the Netherlands

    ler a análise desta fonte ocultar

    Attackers remotely changed settings on internet-connected refrigeration controls at supermarkets in Belgium, Sweden, Estonia and the Netherlands overnight into 2 November 2026, warming fridges and freezers. The incident comes about three weeks after attacks on hundreds of French supermarkets. Danfoss confirmed its products were involved, and Copeland equipment was reportedly hit in Belgium. No chain reported more than several dozen affected stores, and some discarded or pulled chilled and frozen food. No group has claimed the attacks, and attribution and any link to the French campaign are unknown. Belgium's federal prosecutor has opened a criminal investigation.

    Technical Details

    • In Belgium, attackers switched cooling units into defrost mode (Sabcobel, which manages systems for Delhaize, knows of about 20 affected units). Elsewhere the temperature setpoint was raised, for example to 50°C at an ICA store in Sjöbo (Sweden) and at a Selver store in Estonia.
    • Belgian attackers got into individual supermarkets' systems, not those of refrigeration contractors, according to Sabcobel.
    • Danfoss told NOS that the affected Dutch systems were not on a secure network and still used default passwords. It also said the weakness lies mainly in outdated software.
    • In Estonia, an older Danfoss controller that had not been updated was reached. The article does not say how attackers got in in Sweden.
    • CERT-FR's alert (last updated 16 October) covers Danfoss AK-SM and AK-SC series controllers, plus Copeland xweb and Dixell xweb. It says the campaigns are probably still underway. In October, Danfoss said most units hit in France were end-of-life AK-SM 800 and AK-SC 355 models.
    • Danfoss, Sabcobel and Kitman said the method matched or resembled the French attack. A shared method does not show the same actors are behind both.
    • Danfoss's advisories page listed no advisory on these attacks as of 3 November.

    Remediation

    • Make sure devices cannot be reached from the internet, including any device on a public IP. Restore remote access only through a secure VPN or protected network. Filtering contractor IPs at a firewall is an emergency measure only.
    • Check the whole configuration, especially defrost schedules.
    • Update firmware. On Danfoss devices, set the security level to Strict and change default passwords.
    • For compromised devices, restart or factory-reset the Danfoss device and reconfigure it before returning it to service.
    • End-of-life devices that no longer get fixes are very likely to be compromised if left online, and a factory reset alone does not protect them.
    • Sweden's National Cybersecurity Centre advises inventorying internet-connected devices, deciding whether each needs a connection, and layering protections on those that stay connected.
23. olhardigital.com.br ↗ · pub. 02/11/2026 13:58 · coletado 02/11 16:00

    Refrigeration failures at supermarkets in Belgium, Luxembourg and Sweden raise suspicion of cyberattacks

    ler a análise desta fonte ocultar

    Supermarket chains in several European countries reported refrigeration failures on 2 November 2026, raising suspicion of attacks on internet-connected equipment. In Belgium, five Spar stores operated by Colruyt Group, nearly 15 Carrefour stores and dozens of Ahold Delhaize (Delhaize) stores in Belgium and Luxembourg were affected, and ICA and Coop stores in Sweden reported similar problems. The incidents come about a month after a cyberattack on hundreds of supermarkets in France, where police said attackers took control of refrigeration systems and raised temperatures to as much as 50ºC, causing fires and food losses. No authority has named a culprit and no group has claimed responsibility.

    Technical Details

    • The CEO of Sabcobel, the Belgian refrigeration company that supplies Delhaize's systems, said a cyberattack triggered the evaporators into defrost mode, heating the equipment.
    • Delhaize reported a temperature rise in its refrigeration systems.
    • In October, Ahold Delhaize reported a cybersecurity incident to Dutch police after noticing suspicious activity in its infrastructure. The article does not link it to these events.
    • The article attributes the exposure to alarms, refrigerators, cameras and heating systems being connected to networks for remote monitoring and control.
    • No IOCs, CVEs or intrusion vectors were disclosed.

    Remediation

    The article gives no remediation guidance.

24. industrialcyber.co ↗ · pub. 02/11/2026 14:36 · coletado 02/11 15:01

    Hackers manipulate supermarket refrigeration systems in at least seven European countries, forcing product removals

    ler a análise desta fonte ocultar

    A new wave of attacks on supermarket refrigeration systems hit grocery chains in at least seven European countries on Nov. 2: Sweden, Belgium, Estonia, Ireland, Finland, Luxembourg and the Netherlands. Affected retailers include ICA, Coop, Ahold Delhaize, Colruyt, Carrefour, Intermarché, SuperValu, Selver and an IKEA store in Belgium. Attackers manipulated temperature controls, reportedly raising freezers to 50 °C and forcing retailers to pull chilled and frozen goods. The wave follows a similar attack in France the previous month, which reportedly hit hundreds of supermarkets and caused fires and major food losses. No attribution has been established, and authorities have not said whether the incidents are linked to the French attack.

    Technical Details

    • Kitman Coldtech, the Estonian refrigeration provider, said attackers exploited an older Danfoss refrigeration system. Other Estonian clients may also have been targeted.
    • At Selver in Estonia, attackers accessed a computer controlling the refrigeration system and raised the freezer temperature to 50 °C. The technology partner detected the attack quickly and prevented damage.
    • In Ireland, SuperValu said a specific refrigeration system model was affected in 13 of its 223 stores. The Irish NCSC said the incidents may be related to a known vulnerability, but the article gives no CVE.
    • Sweden's National Cybersecurity Centre identified a significant number of exposed OT devices that need updates or patches.
    • An ICA franchise store in Stockholm said the attack occurred around 2 a.m. but was noticed only hours later, and the frozen inventory was destroyed.
    • Reported scope: Coop, six stores; Ahold Delhaize, dozens of stores in Belgium and Luxembourg; Colruyt, five stores; Carrefour Belgium, about 15 of 700 stores; Intermarché, 15 stores.

    Remediation

    • Patch or update exposed OT and refrigeration devices.
    • Control who can remotely access equipment, what they can reach and what they can do.
    • Ask suppliers how long products will be supported and how vulnerabilities will be handled.
    • Operators and their suppliers are responsible for the affected systems, according to the Irish NCSC.
25. bleepingcomputer.com ↗ · pub. 02/11/2026 11:28 · coletado 02/11 13:00

    Hackers remotely tamper with refrigeration controls at 115+ supermarkets across six European countries

    ler a análise desta fonte ocultar

    A cyberattack hit refrigeration and freezer systems at more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Attackers remotely changed temperature settings, shut units down or triggered defrost cycles, causing product losses. Affected chains include ICA, Coop, Ahold Delhaize, Carrefour, Spar Colruyt, Intermarché, SuperValu and Selver, plus butcher shops, an Ikea store in Mons and chocolate shops. It is unclear whether the attacks were coordinated or targeted individually. The vendor Sabcobel says the attacker used the same vulnerability as in similar attacks in France the previous month.

    Technical Details

    • An ICA store manager told TV4 that temperatures were set to +50°C (122°F) and could not be changed.
    • Ahold Delhaize warned store managers by SMS around 4 a.m. Some stores used refrigerated trucks to preserve stock.
    • RTL identified Sabcobel as the refrigeration vendor at several impacted sites. Its director, Stephan Moelans, attributed the disruption to remotely activated defrost functions and said technicians began disconnecting installations from 1 a.m.
    • The vulnerability is not named in the article. The France attacks the previous month affected hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers, which remote attackers set to defrost mode.
    • Some affected stores operate outside the chains' central networks, such as independent Spar stores and ICA stores, each with their own refrigeration systems.

    Remediation

    • Sabcobel says a software update alone is not enough, because the refrigerators also need physical modifications.
    • Sabcobel recommends managing the refrigerators over a secure internet connection. It says most clients adopted this after the France attack.
    • Affected installations were disconnected from the network.
26. helpnetsecurity.com ↗ · pub. 02/11/2026 11:28 · coletado 02/11 12:01

    Second wave of attacks on internet-exposed refrigeration controllers spoils food in Belgian, Luxembourg and Swedish supermarkets

    ler a análise desta fonte ocultar

    A second wave of cyberattacks hit supermarkets in Belgium, Luxembourg and Sweden around 1-2 November 2026, about three weeks after the October attack on French retailers. Attackers remotely switched refrigeration evaporators to defrost mode or raised freezer temperatures (up to 50 °C in Sweden), spoiling refrigerated food. Affected chains include Delhaize, Carrefour and Spar in Belgium, Delhaize in Luxembourg, and Coop and Ica in Sweden. Colruyt and Intermarche reported "technical problems" without confirming a cyberattack. Attribution is still unknown.

    Technical Details

    • Belgian reports say the mechanism is the same as in the October attack in France, which targeted refrigeration control and monitoring systems from Danfoss, Copeland and Dixell, according to ANSSI.
    • The root cause is remotely exploitable vulnerabilities in internet-exposed management interfaces. Researcher Kevin Beaumont confirmed the affected freezers are all management-interface-facing internet with the same issue as last time. He added that many are end of life with no patch available.
    • Ica said the affected stores had connections outside its central network.
    • Sabcobel says a thorough fix needs a software update plus physical modification of the units.

    Remediation

    • Disconnect refrigeration controllers from the internet and manage them over a secure connection. Most Sabcobel customers switched to this after the French attack.
    • Apply the vendor software update and the physical modification Sabcobel describes.
    • Replace or isolate end-of-life units that have no patch.
27. techcrunch.com ↗ · pub. 02/11/2026 11:08 · coletado 02/11 12:00

    Second wave of attacks on Danfoss-linked supermarket refrigeration hits Delhaize and Colruyt stores in four European countries

    ler a análise desta fonte ocultar

    A second wave of suspected cyberattacks has hit supermarket refrigeration across Belgium, Ireland, Luxembourg and Sweden, raising temperatures and spoiling food at dozens of stores. Ahold Delhaize and Colruyt confirmed the incidents. A Belgian company that operates Delhaize's systems said the attackers changed the settings to defrost, per Reuters. The wave follows earlier attacks in France last month that spoiled food at hundreds of supermarkets. The article gives no attribution for the European attacks, though US Department of Defense officials are reportedly investigating whether freezer units on military bases were hacked by Iran-backed actors.

    Technical Details

    • Security researchers attribute the French incidents to internet-connected refrigeration units made by Danfoss, which no longer receives security updates.
    • Claroty warned in August that these units were at risk of remote hacks and outages.
    • The attackers deliberately changed temperature or defrost settings.
    • The article does not state the exact access method, any CVEs or any IOCs, and does not confirm that the second wave involved the same Danfoss devices.

    Remediation

    The article gives no explicit guidance. Its implication is that internet-exposed, end-of-life refrigeration controllers carry a real risk of remote tampering.

28. theregister.com ↗ · pub. 02/11/2026 10:15 · coletado 02/11 12:00

    Refrigeration systems hacked at dozens of supermarkets in Belgium, Sweden, Ireland and Luxembourg, causing mass food spoilage

    ler a análise desta fonte ocultar

    Grocery stores in Belgium, Ireland, Luxembourg and Sweden reported on 2 November 2026 that their refrigerators and freezers had been remotely manipulated overnight, with temperatures raised to 50-55°C and units put into defrost mode. Around 40 Delhaize stores in Belgium were hit, along with about 15 Carrefour stores and sites of Intermarché, Spar and Shop & Go. In Sweden, ICA confirmed an incident at a small number of stores operating outside its central network, and six Coop stores were also affected. At least 13 SuperValu stores in Ireland, owned by Musgrave, were affected as well. Stores threw out their fresh and frozen stock. No actor has been named and no company answered questions about attribution.

    Technical Details

    • Attackers reportedly switched the units into defrost mode and raised temperatures to 50-55°C.
    • ICA said the affected stores operate outside its central network.
    • The wave follows attacks in mid-October 2026 on French chains (Carrefour, Coopérative U, Intermarché, Monoprix and others). In those, some stores ran outdated firmware on Danfoss AK-SM and AK-SC refrigeration controllers, and CERT-FR published an alert on those compromises.
    • The article states it is unclear whether the new attacks used the same methods or the same Danfoss equipment as in France.

    Remediation

    The article gives no remediation guidance. Delhaize said its distribution centres are operating normally and that it took measures to keep stores operational.

29. securityaffairs.com ↗ · pub. 02/11/2026 09:09 · coletado 02/11 10:00

    Fridge cyberattacks hit supermarkets in Belgium, Luxembourg, Sweden and Estonia, setting refrigeration to defrost mode at 50°C

    ler a análise desta fonte ocultar

    A new wave of attacks on supermarket refrigeration systems hit retailers in Belgium, Luxembourg, Sweden and Estonia overnight on 2 November 2026, raising fridge and freezer temperatures and causing food losses. Affected chains include Delhaize (Ahold Delhaize), Colruyt/Spar, Carrefour, ICA, Coop and an unnamed Estonian chain. The incidents follow a similar mid-October attack on hundreds of French supermarkets that targeted Danfoss equipment. No actor has claimed responsibility and authorities have not attributed the attacks.

    Technical Details

    • Attackers appear to have remotely triggered the forced defrost function in continuous mode with a 50°C setpoint. Sabcobel's CEO said evaporators were switched to defrost mode.
    • In Sweden, stores reported temperatures set to 50°C. Consultant Emil Olofsson (Integrity 360) said some units reached 80°C and caught fire, a figure that differs from the police number.
    • Scale: about 40 Delhaize stores in Belgium were reportedly affected, five Colruyt-run Spar stores, at least 6 ICA stores and 6 Coop stores in central Sweden. Le Soir reported dozens of Delhaize and Carrefour stores.
    • Likely access: in the French case, Olofsson said attackers obtained login credentials for control systems exposed directly to the internet. He called the hack simple, so it may have been done by amateurs. The Swedish cyber centre's John Billow noted many exposed OT devices in Sweden.
    • The cause of the Swedish incidents is officially unknown. Ahold's separate October report to Dutch police has no reported link to these incidents.

    Remediation

    • Remove OT and refrigeration control interfaces from direct internet exposure.
    • Patch and update exposed devices, as Swedish authorities have urged.
    • Rotate and protect credentials for control systems.
30. gbhackers.com ↗ · pub. 02/11/2026 08:08 · coletado 02/11 10:00

    Hackers disrupt refrigeration systems at ICA and Coop supermarkets across Sweden, freezer reaches 55°C

    ler a análise desta fonte ocultar

    Refrigeration systems at several ICA and Coop supermarkets across Sweden were disrupted by hackers, destroying perishable stock and forcing temporary closures. One store manager in Böda, Öland, found a freezer at 55°C. Affected stores span Skåne, Öland, Värmland and reportedly Stockholm, plus six Coop stores in Gästrikland and Hälsingland (per SVT). The incident follows similar attacks on French supermarket refrigeration and a reported Estonian case with remotely altered +50°C settings, but no link has been established.

    Technical Details

    • ICA says the affected refrigeration systems were connected independently of its central network.
    • No exploited vulnerabilities, malware families, controller models or threat actors have been identified.
    • It is unconfirmed whether set points, defrost cycles or cooling were manipulated.
    • Separate research on Copeland commercial refrigeration controller flaws showed cooling can be disabled while normal temperatures are displayed. No evidence links those flaws to the Swedish incidents.
    • Investigators still need to determine the initial access method and whether the stores share a refrigeration supplier, maintenance provider or remote-management infrastructure.

    Remediation

    • Restrict management access to internet-exposed OT.
    • Enforce multifactor authentication.
    • Segment control networks.
    • Monitor configuration changes.
    • Deploy independent temperature alarms and continuous monitoring.

    Sweden's National Cybersecurity Centre (part of FRA) is assisting the affected organizations.

31. securityaffairs.com ↗ · pub. 29/10/2026 18:58 · coletado 29/10 21:00

    Pentagon probes August freezer failures at US military commissaries as suspected cyberattack, links to French supermarket hack

    ler a análise desta fonte ocultar

    The Pentagon is treating a series of freezer malfunctions that spoiled food at US military base commissaries in August as a suspected cyberattack, according to four officials cited by Reuters. At least six commissaries were affected in late August — Fort Irwin, F.E. Warren, Naval Station Newport, Columbus, Travis and Fort Huachuca among them — with some reports counting up to 14 sites across 11 states. In at least one case the freezers were not simply shut down: temperatures were raised overnight, and Fort Huachuca reported its freezer entered defrost mode and heated the stored food. US investigators, including a unit of US Cyber Command and the Army Criminal Investigation Division Cyber Field Office, are coordinating with French law enforcement over a similar attack that raised cooling temperatures in more than 350 French supermarkets, emptying frozen aisles and in some cases causing units to catch fire, with losses potentially in the tens of millions of euros. Attribution remains unknown and the investigation's progress is undisclosed.

    Technical Details

    The attack pattern in both the US and France involved manipulating refrigeration controllers to increase temperatures rather than disabling the units, maximizing spoilage and in France causing fires. In the French case the targeted controller manufacturer was Danfoss, which did not reply to press inquiries; the brand used at US bases is unknown. A public research report on Danfoss controllers was published before the incidents, but no link to the military bases has been established. Danfoss has previously reported that attackers hit supermarkets in Russia and Israel in 2022 by exploiting outdated cooling controllers, and in December 2025 US prosecutors accused a Ukrainian woman of belonging to a group that disrupted refrigeration at a meat plant in 2024.

    Remediation

    Operators of commercial refrigeration and other OT/ICS building systems should inventory internet-exposed cooling controllers, update outdated firmware, segment them from general IT networks, enforce strong authentication and monitor for unauthorized setpoint changes. The Global Food Safety Initiative has urged food safety and IT leaders to jointly protect refrigeration systems.

32. olhardigital.com.br ↗ · pub. 29/10/2026 11:32 · coletado 29/10 13:01 primeiro registro

    Pentagon probes suspected cyberattack on military base commissary freezers; linked to French supermarket refrigeration hacks

    ler a análise desta fonte ocultar

    The Pentagon is investigating whether a cyberattack caused refrigeration failures at commissaries on at least six US military bases in August 2026, spoiling food, according to four officials cited by Reuters. In one case the freezer temperature was raised overnight; on 26 August, Fort Huachuca (Arizona) reported a freezer entering defrost mode and warming products, a case first surfaced by the blog Signal and Silence. A unit of US Cyber Command and the Army Criminal Investigation Division Cyber Field Office are coordinating with interagency, law-enforcement and French authorities over a similar incident in which temperature controls were manipulated at more than 350 French retail sites, forcing disposal of frozen goods and in some cases causing units to catch fire. No attribution or investigation stage has been disclosed.

    Technical Details

    Experts told Reuters the intrusion appeared simple to execute. Danfoss stated that several controllers in the affected French equipment were obsolete or running outdated firmware, which could have eased unauthorized access; Reuters could not confirm whether Danfoss or other brands were installed at the US bases. The core issue flagged by ICS specialists is the internet exposure of refrigeration controllers originally designed for on-site maintenance. Danfoss also noted that in 2022 attackers hit supermarkets in Russia and Israel using obsolete versions of its cold-storage controllers. In December 2025, Los Angeles federal prosecutors charged a Ukrainian woman as part of a group that disrupted refrigeration at a meat-processing plant in 2024, destroying over 900 kg of meat.

    Remediation

    Inventory and remove internet exposure of refrigeration/HVAC controllers, retire obsolete units and update firmware, and align food-safety and IT/OT security teams as recommended in early 2026 by the Global Food Safety Initiative.