Second wave of attacks on supermarket refrigeration hits 115+ stores in up to nine European countries; Danfoss confirms its products involved

Linha do tempo

1. olhardigital.com.br ↗ · pub. 03/11/2026 10:24 · coletado 03/11 12:02

   Cyberattacks on Supermarket Refrigeration Systems Hit 7 European Countries, Force Food Disposal

   ler a análise desta fonte ocultar

   A new wave of cyberattacks struck supermarket refrigeration systems across Sweden, Ireland, Netherlands, Estonia, Finland, Belgium and Luxembourg on Monday, November 2, 2026, causing unauthorized temperature changes in refrigerators and freezers and forcing retailers to discard spoiled food. The incident follows a similar attack less than a month earlier that hit over 500 stores in France, renewing concerns about the digital vulnerability of Europe's food supply chain. Affected retailers include Carrefour (~15 of 700 Belgian stores), an Ikea unit in Mons, the butcher chain De Laet & Van Haver in Antwerp (temperatures reaching 18°C), Ahold Delhaize, Colruyt Group's Spar stores, Intermarché, Coop and ICA in Sweden (one freezer reached 50°C), Musgrave's SuperValu chain in Ireland, Kesko in Finland, Selver in Estonia, and smaller retailers in the Netherlands. No group has claimed responsibility, and Belgian and EU officials warn attribution may never be determined.

   Technical Details

   Many affected systems reportedly use temperature control technology from Danish manufacturer Danfoss, the same vendor implicated in the earlier French attacks. Danfoss stated it is working with customers to implement security fixes. Researcher Tom Hegel of SentinelOne noted that attackers likely accessed exposed control panels, leaving minimal forensic traces, making it difficult to distinguish between a lone actor and a state-sponsored operation. The absence of ransom demands in these incidents suggests possible sabotage rather than extortion motives.

   Remediation

   Danfoss is reportedly working with affected customers to implement security patches for the exposed control systems; no further technical remediation details were provided in the article.

2. infosecurity-magazine.com ↗ · pub. 03/11/2026 10:45 · coletado 03/11 12:01

   Cyber-Attack on Refrigeration Systems Disrupts Supermarkets Across Nine European Countries

   ler a análise desta fonte ocultar

   A cyber-attack targeting internet-connected refrigeration systems has struck supermarkets in at least nine European countries—Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden—causing freezer and fridge temperatures to be remotely set as high as 50°C, destroying food stock. The incident follows a similar October 2026 attack on refrigeration providers Danfoss and Copeland that affected French supermarket chains, suggesting a possible connection or copycat campaign. Affected retailers include SuperValu in Ireland (13 stores precautionarily cleared of stock), ICA Sweden, and an Ikea outlet in Mons, Belgium. The UK has also reported limited exploitation of vulnerable refrigeration technology per the NCSC. No threat actor has claimed responsibility, but EU officials suspect a deliberate, possibly nation-state-linked attempt to disrupt Europe's food supply chain.

   Technical Details

   Attackers appear to have gained remote access to internet-connected refrigeration units, reprogramming temperature controls to extreme levels (~50°C/122°F), spoiling chilled and frozen goods. The attack vector has not been confirmed, but the pattern mirrors the Danfoss/Copeland incident from October 2026 affecting the same category of connected industrial refrigeration equipment. Sweden's NCSC and the UK NCSC are coordinating with counterparts across Nordic and European countries to assess scope and exploited vulnerabilities.

   Remediation

   Affected retailers removed chilled and frozen products from shelves as a precaution. The UK NCSC has alerted potentially affected companies. EU Agriculture and Food Commissioner Christophe Hansen stated the incidents will be discussed at the EU's Security College to review retailers' contingency plans and incident response capabilities.

3. itsecurityguru.org ↗ · pub. 03/11/2026 11:12 · coletado 03/11 12:00

   Second Wave of Supermarket Refrigeration Cyberattacks Hits Seven European Countries

   ler a análise desta fonte ocultar

   A second wave of suspected cyberattacks against supermarket refrigeration systems struck Belgium, Sweden, Luxembourg, Finland and Ireland (among seven countries) on 2 November 2026, following earlier attacks on French supermarkets in October that caused widespread food spoilage. Affected retailers reportedly include Carrefour, Intermarché, Coop, ICA and Delhaize, with attackers manipulating refrigeration temperatures up to 50°C. The perpetrators and motive remain unconfirmed, but the attacks highlight the exposure of internet-connected operational technology, particularly remote refrigeration management platforms such as Copeland/Dixell XWEB and Danfoss StoreView. Research from Forescout Research – Vedere Labs found nearly 13,000 internet-exposed refrigeration service observations across 99 countries, tied to over 6,000 distinct public IPs, many running outdated software.

   Technical Details

   Attackers appear to exploit unsecured remote access capabilities on refrigeration management systems to switch cooling units into defrost mode, raising temperatures and spoiling stock. Experts note these IoT/OT devices often run outdated firmware, lack processing power for modern security controls, and are frequently exposed to the internet via cellular, wired or Wi-Fi connections for remote monitoring, making them attractive, low-sophistication targets for disruption rather than data theft.

   Remediation

   Security specialists recommend identifying internet-exposed refrigeration and OT equipment, restricting unnecessary remote/internet access, applying available firmware updates, deploying network-level monitoring to detect anomalous communications, and incorporating operational technology into incident response and business continuity planning, including procedures for handling spoiled inventory and restoring correct temperatures.

4. securityweek.com ↗ · pub. 03/11/2026 04:43 · coletado 03/11 05:00

   Over 100 European stores hit as Danfoss and Copeland refrigeration controllers are hijacked in a second attack wave

   ler a análise desta fonte ocultar

   More than 100 stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden had refrigerators and freezers forced to heat up overnight from Sunday to Monday. Problems were also reported in Finland, Italy and Portugal. The incidents resemble the attacks of 11-12 October that hit about 700 French supermarkets, but investigators have not established whether the two waves are linked, and no one has claimed responsibility. The affected devices are reportedly Danfoss and Copeland refrigeration controllers with internet-reachable management interfaces. Officials have not publicly explained how the attackers got in. The EU agriculture commissioner called the attacks a deliberate attempt to disrupt the food supply chain.

   Technical Details

   • In the first wave (France, 11-12 October), refrigeration units at about 700 stores were forced into defrost mode, including Intermarché, Carrefour, Coopérative U and Monoprix. Food was spoiled and fires were reportedly caused. CERT-FR tied the compromises to Danfoss AK-SM and AK-SC controllers, then extended its alert to Copeland and Dixell XWEB systems. Danfoss said most compromised units were legacy products it no longer updates.
   • In the new wave, a Belgian refrigeration firm (Sabcobel) said attackers forced the evaporators into defrost mode, as in France. Some units were set as high as 50°C. Sabcobel said a software update is not enough and the equipment also needs physical modification.
   • Researcher Kevin Beaumont said every freezer hit on Monday had an internet-reachable management interface. Many devices are end-of-life with no patch available.
   • Lupovis saw suspicious activity against its Danfoss AK-SM sensors between 20 and 30 October, peaking on 26 October. Most login attempts used factory-default credentials documented publicly, and others appeared to fingerprint specific controller components. All attempts were rejected.
   • Censys counts just over 1,000 Danfoss StoreView interfaces online. Exposed instances in France fell from 1,825 before the attacks to 220. About 41% of the French instances still online appear patched, against 68% in Belgium (138 exposed), 37% in the Netherlands (51) and 58% in Sweden (50). Censys did not say whether patched devices were among those compromised on Monday.
   • Reported impact: Delhaize (several dozen stores in Belgium, four in Luxembourg), Carrefour Belgium (15 locations), Colruyt (five Spar shops), an IKEA store in Mons, SuperValu in Ireland (13 stores), ICA and Coop in Sweden, Kesko in Finland, Coop-branded stores in Sicily, seven Intermarché stores in Portugal, and at least 17 businesses in the Netherlands. The Belgian federal prosecutor has opened an investigation.

   Remediation

   • Danfoss told customers on 13 October to cut their systems' internet connections and reconnect only through a secure network. Some stores did not act.
   • Remove management interfaces of refrigeration controllers from the internet, change default credentials, and apply available firmware updates. Replace or physically modify end-of-life units that cannot be patched.
5. thehackernews.com ↗ · pub. 03/11/2026 04:27 · coletado 03/11 05:00

   Second wave of attacks on Danfoss refrigeration controls hits supermarkets in Belgium, Sweden, Estonia and the Netherlands

   ler a análise desta fonte ocultar

   Attackers remotely changed settings on internet-connected refrigeration controls at supermarkets in Belgium, Sweden, Estonia and the Netherlands overnight into 2 November 2026, warming fridges and freezers. The incident comes about three weeks after attacks on hundreds of French supermarkets. Danfoss confirmed its products were involved, and Copeland equipment was reportedly hit in Belgium. No chain reported more than several dozen affected stores, and some discarded or pulled chilled and frozen food. No group has claimed the attacks, and attribution and any link to the French campaign are unknown. Belgium's federal prosecutor has opened a criminal investigation.

   Technical Details

   • In Belgium, attackers switched cooling units into defrost mode (Sabcobel, which manages systems for Delhaize, knows of about 20 affected units). Elsewhere the temperature setpoint was raised, for example to 50°C at an ICA store in Sjöbo (Sweden) and at a Selver store in Estonia.
   • Belgian attackers got into individual supermarkets' systems, not those of refrigeration contractors, according to Sabcobel.
   • Danfoss told NOS that the affected Dutch systems were not on a secure network and still used default passwords. It also said the weakness lies mainly in outdated software.
   • In Estonia, an older Danfoss controller that had not been updated was reached. The article does not say how attackers got in in Sweden.
   • CERT-FR's alert (last updated 16 October) covers Danfoss AK-SM and AK-SC series controllers, plus Copeland xweb and Dixell xweb. It says the campaigns are probably still underway. In October, Danfoss said most units hit in France were end-of-life AK-SM 800 and AK-SC 355 models.
   • Danfoss, Sabcobel and Kitman said the method matched or resembled the French attack. A shared method does not show the same actors are behind both.
   • Danfoss's advisories page listed no advisory on these attacks as of 3 November.

   Remediation

   • Make sure devices cannot be reached from the internet, including any device on a public IP. Restore remote access only through a secure VPN or protected network. Filtering contractor IPs at a firewall is an emergency measure only.
   • Check the whole configuration, especially defrost schedules.
   • Update firmware. On Danfoss devices, set the security level to Strict and change default passwords.
   • For compromised devices, restart or factory-reset the Danfoss device and reconfigure it before returning it to service.
   • End-of-life devices that no longer get fixes are very likely to be compromised if left online, and a factory reset alone does not protect them.
   • Sweden's National Cybersecurity Centre advises inventorying internet-connected devices, deciding whether each needs a connection, and layering protections on those that stay connected.
6. olhardigital.com.br ↗ · pub. 02/11/2026 13:58 · coletado 02/11 16:00

   Refrigeration failures at supermarkets in Belgium, Luxembourg and Sweden raise suspicion of cyberattacks

   ler a análise desta fonte ocultar

   Supermarket chains in several European countries reported refrigeration failures on 2 November 2026, raising suspicion of attacks on internet-connected equipment. In Belgium, five Spar stores operated by Colruyt Group, nearly 15 Carrefour stores and dozens of Ahold Delhaize (Delhaize) stores in Belgium and Luxembourg were affected, and ICA and Coop stores in Sweden reported similar problems. The incidents come about a month after a cyberattack on hundreds of supermarkets in France, where police said attackers took control of refrigeration systems and raised temperatures to as much as 50ºC, causing fires and food losses. No authority has named a culprit and no group has claimed responsibility.

   Technical Details

   • The CEO of Sabcobel, the Belgian refrigeration company that supplies Delhaize's systems, said a cyberattack triggered the evaporators into defrost mode, heating the equipment.
   • Delhaize reported a temperature rise in its refrigeration systems.
   • In October, Ahold Delhaize reported a cybersecurity incident to Dutch police after noticing suspicious activity in its infrastructure. The article does not link it to these events.
   • The article attributes the exposure to alarms, refrigerators, cameras and heating systems being connected to networks for remote monitoring and control.
   • No IOCs, CVEs or intrusion vectors were disclosed.

   Remediation

   The article gives no remediation guidance.

7. industrialcyber.co ↗ · pub. 02/11/2026 14:36 · coletado 02/11 15:01

   Hackers manipulate supermarket refrigeration systems in at least seven European countries, forcing product removals

   ler a análise desta fonte ocultar

   A new wave of attacks on supermarket refrigeration systems hit grocery chains in at least seven European countries on Nov. 2: Sweden, Belgium, Estonia, Ireland, Finland, Luxembourg and the Netherlands. Affected retailers include ICA, Coop, Ahold Delhaize, Colruyt, Carrefour, Intermarché, SuperValu, Selver and an IKEA store in Belgium. Attackers manipulated temperature controls, reportedly raising freezers to 50 °C and forcing retailers to pull chilled and frozen goods. The wave follows a similar attack in France the previous month, which reportedly hit hundreds of supermarkets and caused fires and major food losses. No attribution has been established, and authorities have not said whether the incidents are linked to the French attack.

   Technical Details

   • Kitman Coldtech, the Estonian refrigeration provider, said attackers exploited an older Danfoss refrigeration system. Other Estonian clients may also have been targeted.
   • At Selver in Estonia, attackers accessed a computer controlling the refrigeration system and raised the freezer temperature to 50 °C. The technology partner detected the attack quickly and prevented damage.
   • In Ireland, SuperValu said a specific refrigeration system model was affected in 13 of its 223 stores. The Irish NCSC said the incidents may be related to a known vulnerability, but the article gives no CVE.
   • Sweden's National Cybersecurity Centre identified a significant number of exposed OT devices that need updates or patches.
   • An ICA franchise store in Stockholm said the attack occurred around 2 a.m. but was noticed only hours later, and the frozen inventory was destroyed.
   • Reported scope: Coop, six stores; Ahold Delhaize, dozens of stores in Belgium and Luxembourg; Colruyt, five stores; Carrefour Belgium, about 15 of 700 stores; Intermarché, 15 stores.

   Remediation

   • Patch or update exposed OT and refrigeration devices.
   • Control who can remotely access equipment, what they can reach and what they can do.
   • Ask suppliers how long products will be supported and how vulnerabilities will be handled.
   • Operators and their suppliers are responsible for the affected systems, according to the Irish NCSC.
8. bleepingcomputer.com ↗ · pub. 02/11/2026 11:28 · coletado 02/11 13:00

   Hackers remotely tamper with refrigeration controls at 115+ supermarkets across six European countries

   ler a análise desta fonte ocultar

   A cyberattack hit refrigeration and freezer systems at more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Attackers remotely changed temperature settings, shut units down or triggered defrost cycles, causing product losses. Affected chains include ICA, Coop, Ahold Delhaize, Carrefour, Spar Colruyt, Intermarché, SuperValu and Selver, plus butcher shops, an Ikea store in Mons and chocolate shops. It is unclear whether the attacks were coordinated or targeted individually. The vendor Sabcobel says the attacker used the same vulnerability as in similar attacks in France the previous month.

   Technical Details

   • An ICA store manager told TV4 that temperatures were set to +50°C (122°F) and could not be changed.
   • Ahold Delhaize warned store managers by SMS around 4 a.m. Some stores used refrigerated trucks to preserve stock.
   • RTL identified Sabcobel as the refrigeration vendor at several impacted sites. Its director, Stephan Moelans, attributed the disruption to remotely activated defrost functions and said technicians began disconnecting installations from 1 a.m.
   • The vulnerability is not named in the article. The France attacks the previous month affected hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers, which remote attackers set to defrost mode.
   • Some affected stores operate outside the chains' central networks, such as independent Spar stores and ICA stores, each with their own refrigeration systems.

   Remediation

   • Sabcobel says a software update alone is not enough, because the refrigerators also need physical modifications.
   • Sabcobel recommends managing the refrigerators over a secure internet connection. It says most clients adopted this after the France attack.
   • Affected installations were disconnected from the network.
9. helpnetsecurity.com ↗ · pub. 02/11/2026 11:28 · coletado 02/11 12:01

   Second wave of attacks on internet-exposed refrigeration controllers spoils food in Belgian, Luxembourg and Swedish supermarkets

   ler a análise desta fonte ocultar

   A second wave of cyberattacks hit supermarkets in Belgium, Luxembourg and Sweden around 1-2 November 2026, about three weeks after the October attack on French retailers. Attackers remotely switched refrigeration evaporators to defrost mode or raised freezer temperatures (up to 50 °C in Sweden), spoiling refrigerated food. Affected chains include Delhaize, Carrefour and Spar in Belgium, Delhaize in Luxembourg, and Coop and Ica in Sweden. Colruyt and Intermarche reported "technical problems" without confirming a cyberattack. Attribution is still unknown.

   Technical Details

   • Belgian reports say the mechanism is the same as in the October attack in France, which targeted refrigeration control and monitoring systems from Danfoss, Copeland and Dixell, according to ANSSI.
   • The root cause is remotely exploitable vulnerabilities in internet-exposed management interfaces. Researcher Kevin Beaumont confirmed the affected freezers are all management-interface-facing internet with the same issue as last time. He added that many are end of life with no patch available.
   • Ica said the affected stores had connections outside its central network.
   • Sabcobel says a thorough fix needs a software update plus physical modification of the units.

   Remediation

   • Disconnect refrigeration controllers from the internet and manage them over a secure connection. Most Sabcobel customers switched to this after the French attack.
   • Apply the vendor software update and the physical modification Sabcobel describes.
   • Replace or isolate end-of-life units that have no patch.
10. techcrunch.com ↗ · pub. 02/11/2026 11:08 · coletado 02/11 12:00

    Second wave of attacks on Danfoss-linked supermarket refrigeration hits Delhaize and Colruyt stores in four European countries

    ler a análise desta fonte ocultar

    A second wave of suspected cyberattacks has hit supermarket refrigeration across Belgium, Ireland, Luxembourg and Sweden, raising temperatures and spoiling food at dozens of stores. Ahold Delhaize and Colruyt confirmed the incidents. A Belgian company that operates Delhaize's systems said the attackers changed the settings to defrost, per Reuters. The wave follows earlier attacks in France last month that spoiled food at hundreds of supermarkets. The article gives no attribution for the European attacks, though US Department of Defense officials are reportedly investigating whether freezer units on military bases were hacked by Iran-backed actors.

    Technical Details

    • Security researchers attribute the French incidents to internet-connected refrigeration units made by Danfoss, which no longer receives security updates.
    • Claroty warned in August that these units were at risk of remote hacks and outages.
    • The attackers deliberately changed temperature or defrost settings.
    • The article does not state the exact access method, any CVEs or any IOCs, and does not confirm that the second wave involved the same Danfoss devices.

    Remediation

    The article gives no explicit guidance. Its implication is that internet-exposed, end-of-life refrigeration controllers carry a real risk of remote tampering.

11. theregister.com ↗ · pub. 02/11/2026 10:15 · coletado 02/11 12:00

    Refrigeration systems hacked at dozens of supermarkets in Belgium, Sweden, Ireland and Luxembourg, causing mass food spoilage

    ler a análise desta fonte ocultar

    Grocery stores in Belgium, Ireland, Luxembourg and Sweden reported on 2 November 2026 that their refrigerators and freezers had been remotely manipulated overnight, with temperatures raised to 50-55°C and units put into defrost mode. Around 40 Delhaize stores in Belgium were hit, along with about 15 Carrefour stores and sites of Intermarché, Spar and Shop & Go. In Sweden, ICA confirmed an incident at a small number of stores operating outside its central network, and six Coop stores were also affected. At least 13 SuperValu stores in Ireland, owned by Musgrave, were affected as well. Stores threw out their fresh and frozen stock. No actor has been named and no company answered questions about attribution.

    Technical Details

    • Attackers reportedly switched the units into defrost mode and raised temperatures to 50-55°C.
    • ICA said the affected stores operate outside its central network.
    • The wave follows attacks in mid-October 2026 on French chains (Carrefour, Coopérative U, Intermarché, Monoprix and others). In those, some stores ran outdated firmware on Danfoss AK-SM and AK-SC refrigeration controllers, and CERT-FR published an alert on those compromises.
    • The article states it is unclear whether the new attacks used the same methods or the same Danfoss equipment as in France.

    Remediation

    The article gives no remediation guidance. Delhaize said its distribution centres are operating normally and that it took measures to keep stores operational.

12. securityaffairs.com ↗ · pub. 02/11/2026 09:09 · coletado 02/11 10:00

    Fridge cyberattacks hit supermarkets in Belgium, Luxembourg, Sweden and Estonia, setting refrigeration to defrost mode at 50°C

    ler a análise desta fonte ocultar

    A new wave of attacks on supermarket refrigeration systems hit retailers in Belgium, Luxembourg, Sweden and Estonia overnight on 2 November 2026, raising fridge and freezer temperatures and causing food losses. Affected chains include Delhaize (Ahold Delhaize), Colruyt/Spar, Carrefour, ICA, Coop and an unnamed Estonian chain. The incidents follow a similar mid-October attack on hundreds of French supermarkets that targeted Danfoss equipment. No actor has claimed responsibility and authorities have not attributed the attacks.

    Technical Details

    • Attackers appear to have remotely triggered the forced defrost function in continuous mode with a 50°C setpoint. Sabcobel's CEO said evaporators were switched to defrost mode.
    • In Sweden, stores reported temperatures set to 50°C. Consultant Emil Olofsson (Integrity 360) said some units reached 80°C and caught fire, a figure that differs from the police number.
    • Scale: about 40 Delhaize stores in Belgium were reportedly affected, five Colruyt-run Spar stores, at least 6 ICA stores and 6 Coop stores in central Sweden. Le Soir reported dozens of Delhaize and Carrefour stores.
    • Likely access: in the French case, Olofsson said attackers obtained login credentials for control systems exposed directly to the internet. He called the hack simple, so it may have been done by amateurs. The Swedish cyber centre's John Billow noted many exposed OT devices in Sweden.
    • The cause of the Swedish incidents is officially unknown. Ahold's separate October report to Dutch police has no reported link to these incidents.

    Remediation

    • Remove OT and refrigeration control interfaces from direct internet exposure.
    • Patch and update exposed devices, as Swedish authorities have urged.
    • Rotate and protect credentials for control systems.
13. gbhackers.com ↗ · pub. 02/11/2026 08:08 · coletado 02/11 10:00 primeiro registro

    Hackers disrupt refrigeration systems at ICA and Coop supermarkets across Sweden, freezer reaches 55°C

    ler a análise desta fonte ocultar

    Refrigeration systems at several ICA and Coop supermarkets across Sweden were disrupted by hackers, destroying perishable stock and forcing temporary closures. One store manager in Böda, Öland, found a freezer at 55°C. Affected stores span Skåne, Öland, Värmland and reportedly Stockholm, plus six Coop stores in Gästrikland and Hälsingland (per SVT). The incident follows similar attacks on French supermarket refrigeration and a reported Estonian case with remotely altered +50°C settings, but no link has been established.

    Technical Details

    • ICA says the affected refrigeration systems were connected independently of its central network.
    • No exploited vulnerabilities, malware families, controller models or threat actors have been identified.
    • It is unconfirmed whether set points, defrost cycles or cooling were manipulated.
    • Separate research on Copeland commercial refrigeration controller flaws showed cooling can be disabled while normal temperatures are displayed. No evidence links those flaws to the Swedish incidents.
    • Investigators still need to determine the initial access method and whether the stores share a refrigeration supplier, maintenance provider or remote-management infrastructure.

    Remediation

    • Restrict management access to internet-exposed OT.
    • Enforce multifactor authentication.
    • Segment control networks.
    • Monitor configuration changes.
    • Deploy independent temperature alarms and continuous monitoring.

    Sweden's National Cybersecurity Centre (part of FRA) is assisting the affected organizations.