Hackers remotely tamper with refrigeration controls at 115+ supermarkets across six European countries
A cyberattack hit refrigeration and freezer systems at more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Attackers remotely changed temperature settings, shut units down or triggered defrost cycles, causing product losses. Affected chains include ICA, Coop, Ahold Delhaize, Carrefour, Spar Colruyt, Intermarché, SuperValu and Selver, plus butcher shops, an Ikea store in Mons and chocolate shops. It is unclear whether the attacks were coordinated or targeted individually. The vendor Sabcobel says the attacker used the same vulnerability as in similar attacks in France the previous month.
Entenda a falha
A vulnerabilidade
The story has no CVE, and the articles do not name the flaw. Sabcobel's director, Stephan Moelans, told RTL that the attacker used the same vulnerability as in similar attacks in France the previous month. BleepingComputer says those France attacks hit hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers, which remote attackers set to defrost mode. The articles give no details on the exact component, the attacker's prerequisites (authentication, network exposure) or the affected and fixed versions. Remote attackers could change temperatures, shut units down or trigger defrost at more than 115 stores.
Como funciona
The articles do not describe the internal mechanism. What they report is the effect: overnight, remote commands reached the refrigeration controllers and changed their settings, shutting down units or activating defrost functions. At one ICA store the temperature was set to +50°C (122°F) and could not be changed. Temperatures then rose and stock was lost until technicians disconnected the installations from the network, starting around 1 a.m.
Por que é vulnerável
The articles do not state the root cause. The only hints are in Sabcobel's remediation: a simple software update is not enough because the refrigerators also need physical modifications. It recommends managing them over a secure internet connection, which most clients adopted after the France attack. Beyond that, the reason the flaw existed or went unnoticed is not explained.
Como foi descoberta
It came to light through exploitation in the wild: store managers noticed refrigeration failures overnight, and Ahold Delhaize warned managers by SMS around 4 a.m. RTL identified Sabcobel as the vendor at several affected sites, and its director linked the attack to the same vulnerability used in France the previous month. It is unclear whether the attacks were coordinated or targeted individually. BleepingComputer had contacted Sabcobel and was awaiting a response. No researcher, report or coordinated disclosure is mentioned.
Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 13:17.
Detalhes técnicos
- An ICA store manager told TV4 that temperatures were set to +50°C (122°F) and could not be changed.
- Ahold Delhaize warned store managers by SMS around 4 a.m. Some stores used refrigerated trucks to preserve stock.
- RTL identified Sabcobel as the refrigeration vendor at several impacted sites. Its director, Stephan Moelans, attributed the disruption to remotely activated defrost functions and said technicians began disconnecting installations from 1 a.m.
- The vulnerability is not named in the article. The France attacks the previous month affected hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers, which remote attackers set to defrost mode.
- Some affected stores operate outside the chains' central networks, such as independent Spar stores and ICA stores, each with their own refrigeration systems.
Remediação
- Sabcobel says a software update alone is not enough, because the refrigerators also need physical modifications.
- Sabcobel recommends managing the refrigerators over a secure internet connection. It says most clients adopted this after the France attack.
- Affected installations were disconnected from the network.
Linha do tempo
-
Hackers remotely tamper with refrigeration controls at 115+ supermarkets across six European countries
ler a análise desta fonte ocultar
A cyberattack hit refrigeration and freezer systems at more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Attackers remotely changed temperature settings, shut units down or triggered defrost cycles, causing product losses. Affected chains include ICA, Coop, Ahold Delhaize, Carrefour, Spar Colruyt, Intermarché, SuperValu and Selver, plus butcher shops, an Ikea store in Mons and chocolate shops. It is unclear whether the attacks were coordinated or targeted individually. The vendor Sabcobel says the attacker used the same vulnerability as in similar attacks in France the previous month.
Technical Details
- An ICA store manager told TV4 that temperatures were set to +50°C (122°F) and could not be changed.
- Ahold Delhaize warned store managers by SMS around 4 a.m. Some stores used refrigerated trucks to preserve stock.
- RTL identified Sabcobel as the refrigeration vendor at several impacted sites. Its director, Stephan Moelans, attributed the disruption to remotely activated defrost functions and said technicians began disconnecting installations from 1 a.m.
- The vulnerability is not named in the article. The France attacks the previous month affected hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers, which remote attackers set to defrost mode.
- Some affected stores operate outside the chains' central networks, such as independent Spar stores and ICA stores, each with their own refrigeration systems.
Remediation
- Sabcobel says a software update alone is not enough, because the refrigerators also need physical modifications.
- Sabcobel recommends managing the refrigerators over a secure internet connection. It says most clients adopted this after the France attack.
- Affected installations were disconnected from the network.