Second wave of attacks on internet-exposed refrigeration controllers spoils food in Belgian, Luxembourg and Swedish supermarkets
A second wave of cyberattacks hit supermarkets in Belgium, Luxembourg and Sweden around 1-2 November 2026, about three weeks after the October attack on French retailers. Attackers remotely switched refrigeration evaporators to defrost mode or raised freezer temperatures (up to 50 °C in Sweden), spoiling refrigerated food. Affected chains include Delhaize, Carrefour and Spar in Belgium, Delhaize in Luxembourg, and Coop and Ica in Sweden. Colruyt and Intermarche reported "technical problems" without confirming a cyberattack. Attribution is still unknown.
Entenda a falha
A vulnerabilidade
No CVE is assigned. The flaws are remotely exploitable vulnerabilities in the internet-exposed management and monitoring interfaces of refrigeration control systems from Danfoss, Copeland and Dixell, as ANSSI described for the October attack in France. An attacker only needs network reach to an exposed interface. They can then control the units, switching evaporators to defrost mode or raising freezer temperatures (up to 50 °C in Sweden), which spoils food. The articles give no affected or fixed versions. Kevin Beaumont says many of the units are end of life with no patch available. Sabcobel says a full fix needs a software update plus a physical modification of the units.
Como funciona
The controllers have a management interface that is reachable from the internet. A remote attacker sends commands to that interface, and it accepts them as legitimate control of the refrigeration unit. The units then act on them: evaporators switch to defrost mode or freezer setpoints rise, so the cabinets warm up overnight. The articles do not say which step in the interface fails, only that the same mechanism was used in France, Belgium, Luxembourg and Sweden.
Por que é vulnerável
The root cause, according to the articles, is the combination of remotely exploitable vulnerabilities in the management interfaces and their exposure to the internet. Many units are end of life and unpatched, left online. Ica said the affected stores had connections outside its central network. Sabcobel says the fix needs both software and a physical change to the units, but the articles do not explain what the change does.
Como foi descoberta
The articles do not say who found the flaws or how. ANSSI tied the October attack in France to the Danfoss, Copeland and Dixell systems, and exploitation in the wild exposed the problem. On 1-2 November a second wave hit Belgium, Luxembourg and Sweden. Kevin Beaumont said he confirmed with others that the affected freezers are internet-facing management interfaces with the same issue as last time. Attribution remains unknown.
Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 12:21.
Detalhes técnicos
- Belgian reports say the mechanism is the same as in the October attack in France, which targeted refrigeration control and monitoring systems from Danfoss, Copeland and Dixell, according to ANSSI.
- The root cause is remotely exploitable vulnerabilities in internet-exposed management interfaces. Researcher Kevin Beaumont confirmed the affected freezers are all management-interface-facing internet with the same issue as last time. He added that many are end of life with no patch available.
- Ica said the affected stores had connections outside its central network.
- Sabcobel says a thorough fix needs a software update plus physical modification of the units.
Remediação
- Disconnect refrigeration controllers from the internet and manage them over a secure connection. Most Sabcobel customers switched to this after the French attack.
- Apply the vendor software update and the physical modification Sabcobel describes.
- Replace or isolate end-of-life units that have no patch.
Linha do tempo
-
Second wave of attacks on internet-exposed refrigeration controllers spoils food in Belgian, Luxembourg and Swedish supermarkets
ler a análise desta fonte ocultar
A second wave of cyberattacks hit supermarkets in Belgium, Luxembourg and Sweden around 1-2 November 2026, about three weeks after the October attack on French retailers. Attackers remotely switched refrigeration evaporators to defrost mode or raised freezer temperatures (up to 50 °C in Sweden), spoiling refrigerated food. Affected chains include Delhaize, Carrefour and Spar in Belgium, Delhaize in Luxembourg, and Coop and Ica in Sweden. Colruyt and Intermarche reported "technical problems" without confirming a cyberattack. Attribution is still unknown.
Technical Details
- Belgian reports say the mechanism is the same as in the October attack in France, which targeted refrigeration control and monitoring systems from Danfoss, Copeland and Dixell, according to ANSSI.
- The root cause is remotely exploitable vulnerabilities in internet-exposed management interfaces. Researcher Kevin Beaumont confirmed the affected freezers are all management-interface-facing internet with the same issue as last time. He added that many are end of life with no patch available.
- Ica said the affected stores had connections outside its central network.
- Sabcobel says a thorough fix needs a software update plus physical modification of the units.
Remediation
- Disconnect refrigeration controllers from the internet and manage them over a secure connection. Most Sabcobel customers switched to this after the French attack.
- Apply the vendor software update and the physical modification Sabcobel describes.
- Replace or isolate end-of-life units that have no patch.