Hackers manipulate supermarket refrigeration systems in at least seven European countries, forcing product removals
A new wave of attacks on supermarket refrigeration systems hit grocery chains in at least seven European countries on Nov. 2: Sweden, Belgium, Estonia, Ireland, Finland, Luxembourg and the Netherlands. Affected retailers include ICA, Coop, Ahold Delhaize, Colruyt, Carrefour, Intermarché, SuperValu, Selver and an IKEA store in Belgium. Attackers manipulated temperature controls, reportedly raising freezers to 50 °C and forcing retailers to pull chilled and frozen goods. The wave follows a similar attack in France the previous month, which reportedly hit hundreds of supermarkets and caused fires and major food losses. No attribution has been established, and authorities have not said whether the incidents are linked to the French attack.
Entenda a falha
A vulnerabilidade
No CVE is named. The articles say attackers exploited an older Danfoss refrigeration system, according to Kitman Coldtech, the Estonian provider. Ireland's NCSC says the incidents may be related to a known vulnerability but does not identify it. Sweden's NCSC found many exposed OT devices that need updates or patches. The articles give no affected or fixed versions, no authentication requirements and no exact flaw type. What attackers got was control over refrigeration temperature settings: freezers were reportedly raised to 50 °C, and the affected stores pulled chilled and frozen goods.
Como funciona
The articles do not describe the technical mechanism. What they report is that remotely managed refrigeration controllers are reachable and attackers reached the control system, in Selver's case a computer that controls the refrigeration. From there they changed the temperature setpoints, so freezers heated up with no one noticing for hours. An ICA franchise store says the attack happened around 2 a.m. and was noticed only hours later. How the attackers got access, and which step of the Danfoss system fails, is not stated.
Por que é vulnerável
The articles do not state a root cause. They point to an older Danfoss system, a known but unnamed vulnerability, and exposed OT devices that are unpatched. Commentators stress that remote access is not tightly controlled and that embedded products run for years without a clear support and vulnerability-handling plan. Any more specific cause would be a guess.
Como foi descoberta
The issue surfaced through the attacks themselves, reported on Nov. 2 in Sweden, Belgium, Estonia, Ireland, Finland, Luxembourg and the Netherlands, after a similar attack in France the month before. Selver's technology partner detected its attack quickly. Kitman Coldtech identified the older Danfoss system as the target. Ireland's NCSC said the incidents may be tied to a known vulnerability, and Sweden's NCSC is investigating. No one has established who is behind the attacks or whether they are linked to the French incident.
Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 15:20.
Detalhes técnicos
- Kitman Coldtech, the Estonian refrigeration provider, said attackers exploited an older Danfoss refrigeration system. Other Estonian clients may also have been targeted.
- At Selver in Estonia, attackers accessed a computer controlling the refrigeration system and raised the freezer temperature to 50 °C. The technology partner detected the attack quickly and prevented damage.
- In Ireland, SuperValu said a specific refrigeration system model was affected in 13 of its 223 stores. The Irish NCSC said the incidents may be related to a known vulnerability, but the article gives no CVE.
- Sweden's National Cybersecurity Centre identified a significant number of exposed OT devices that need updates or patches.
- An ICA franchise store in Stockholm said the attack occurred around 2 a.m. but was noticed only hours later, and the frozen inventory was destroyed.
- Reported scope: Coop, six stores; Ahold Delhaize, dozens of stores in Belgium and Luxembourg; Colruyt, five stores; Carrefour Belgium, about 15 of 700 stores; Intermarché, 15 stores.
Remediação
- Patch or update exposed OT and refrigeration devices.
- Control who can remotely access equipment, what they can reach and what they can do.
- Ask suppliers how long products will be supported and how vulnerabilities will be handled.
- Operators and their suppliers are responsible for the affected systems, according to the Irish NCSC.
Linha do tempo
-
Hackers manipulate supermarket refrigeration systems in at least seven European countries, forcing product removals
ler a análise desta fonte ocultar
A new wave of attacks on supermarket refrigeration systems hit grocery chains in at least seven European countries on Nov. 2: Sweden, Belgium, Estonia, Ireland, Finland, Luxembourg and the Netherlands. Affected retailers include ICA, Coop, Ahold Delhaize, Colruyt, Carrefour, Intermarché, SuperValu, Selver and an IKEA store in Belgium. Attackers manipulated temperature controls, reportedly raising freezers to 50 °C and forcing retailers to pull chilled and frozen goods. The wave follows a similar attack in France the previous month, which reportedly hit hundreds of supermarkets and caused fires and major food losses. No attribution has been established, and authorities have not said whether the incidents are linked to the French attack.
Technical Details
- Kitman Coldtech, the Estonian refrigeration provider, said attackers exploited an older Danfoss refrigeration system. Other Estonian clients may also have been targeted.
- At Selver in Estonia, attackers accessed a computer controlling the refrigeration system and raised the freezer temperature to 50 °C. The technology partner detected the attack quickly and prevented damage.
- In Ireland, SuperValu said a specific refrigeration system model was affected in 13 of its 223 stores. The Irish NCSC said the incidents may be related to a known vulnerability, but the article gives no CVE.
- Sweden's National Cybersecurity Centre identified a significant number of exposed OT devices that need updates or patches.
- An ICA franchise store in Stockholm said the attack occurred around 2 a.m. but was noticed only hours later, and the frozen inventory was destroyed.
- Reported scope: Coop, six stores; Ahold Delhaize, dozens of stores in Belgium and Luxembourg; Colruyt, five stores; Carrefour Belgium, about 15 of 700 stores; Intermarché, 15 stores.
Remediation
- Patch or update exposed OT and refrigeration devices.
- Control who can remotely access equipment, what they can reach and what they can do.
- Ask suppliers how long products will be supported and how vulnerabilities will be handled.
- Operators and their suppliers are responsible for the affected systems, according to the Irish NCSC.