Second Wave of Supermarket Refrigeration Cyberattacks Hits Seven European Countries
A second wave of suspected cyberattacks against supermarket refrigeration systems struck Belgium, Sweden, Luxembourg, Finland and Ireland (among seven countries) on 2 November 2026, following earlier attacks on French supermarkets in October that caused widespread food spoilage. Affected retailers reportedly include Carrefour, Intermarché, Coop, ICA and Delhaize, with attackers manipulating refrigeration temperatures up to 50°C. The perpetrators and motive remain unconfirmed, but the attacks highlight the exposure of internet-connected operational technology, particularly remote refrigeration management platforms such as Copeland/Dixell XWEB and Danfoss StoreView. Research from Forescout Research – Vedere Labs found nearly 13,000 internet-exposed refrigeration service observations across 99 countries, tied to over 6,000 distinct public IPs, many running outdated software.
Detalhes técnicos
Attackers appear to exploit unsecured remote access capabilities on refrigeration management systems to switch cooling units into defrost mode, raising temperatures and spoiling stock. Experts note these IoT/OT devices often run outdated firmware, lack processing power for modern security controls, and are frequently exposed to the internet via cellular, wired or Wi-Fi connections for remote monitoring, making them attractive, low-sophistication targets for disruption rather than data theft.
Remediação
Security specialists recommend identifying internet-exposed refrigeration and OT equipment, restricting unnecessary remote/internet access, applying available firmware updates, deploying network-level monitoring to detect anomalous communications, and incorporating operational technology into incident response and business continuity planning, including procedures for handling spoiled inventory and restoring correct temperatures.
Linha do tempo
-
Second Wave of Supermarket Refrigeration Cyberattacks Hits Seven European Countries
ler a análise desta fonte ocultar
A second wave of suspected cyberattacks against supermarket refrigeration systems struck Belgium, Sweden, Luxembourg, Finland and Ireland (among seven countries) on 2 November 2026, following earlier attacks on French supermarkets in October that caused widespread food spoilage. Affected retailers reportedly include Carrefour, Intermarché, Coop, ICA and Delhaize, with attackers manipulating refrigeration temperatures up to 50°C. The perpetrators and motive remain unconfirmed, but the attacks highlight the exposure of internet-connected operational technology, particularly remote refrigeration management platforms such as Copeland/Dixell XWEB and Danfoss StoreView. Research from Forescout Research – Vedere Labs found nearly 13,000 internet-exposed refrigeration service observations across 99 countries, tied to over 6,000 distinct public IPs, many running outdated software.
Technical Details
Attackers appear to exploit unsecured remote access capabilities on refrigeration management systems to switch cooling units into defrost mode, raising temperatures and spoiling stock. Experts note these IoT/OT devices often run outdated firmware, lack processing power for modern security controls, and are frequently exposed to the internet via cellular, wired or Wi-Fi connections for remote monitoring, making them attractive, low-sophistication targets for disruption rather than data theft.
Remediation
Security specialists recommend identifying internet-exposed refrigeration and OT equipment, restricting unnecessary remote/internet access, applying available firmware updates, deploying network-level monitoring to detect anomalous communications, and incorporating operational technology into incident response and business continuity planning, including procedures for handling spoiled inventory and restoring correct temperatures.