Supermarket refrigeration attacks hit 115+ stores in Europe; CISA and FBI warn of cold-chain campaign, Iran suspected, Danfoss products involved

Linha do tempo

1. malwarebytes.com ↗ · pub. 06/11/2026 09:02 · coletado 06/11 10:01

   CISA, FBI warn on industrial refrigeration attacks after Danfoss-linked supermarket and French blood-service cold-storage intrusions

   ler a análise desta fonte ocultar

   On November 5, CISA, the FBI and three other US federal agencies warned operators to secure industrial refrigeration and cold-chain monitoring systems. The warning follows attacks on supermarket refrigeration systems in Europe, including at least 17 mostly small businesses in the Netherlands on November 2. France's national blood service also confirmed that monitoring and control systems at three cold-storage sites were affected. Staff intervened before any blood products or samples were compromised. The article names no threat actor, malware or CVE. This summary draws on the article alone, and no web research was done.

   Technical Details

   • Danfoss said the affected systems were reachable through unsecured connections and used default passwords (per NOS, cited by malwarebytes.com).
   • The agencies warn that attackers may exploit authentication bypass flaws, code-injection vulnerabilities or weak configurations in refrigeration controllers. Successful attacks could change temperatures or force equipment into continuous heating or defrost cycles.
   • Danfoss told Dutch customers on October 13, after the first attacks in France, to disconnect systems from the public internet. Most stores followed the advice, and major Dutch chains were reportedly unaffected.

   Remediation

   • Keep control panels off the public internet and isolate operational equipment from business networks.
   • Change default passwords and use strong authentication.
   • Patch firmware and replace unsupported devices.
   • Set safe operating limits, with alerts for temperatures outside them.
2. infosecurity-magazine.com ↗ · pub. 06/11/2026 08:50 · coletado 06/11 10:01

   CISA, FBI warn of attacks on internet-exposed industrial refrigeration controllers after Danfoss, Copeland/Dixell and Coolworld incidents

   ler a análise desta fonte ocultar

   CISA, the FBI and other federal agencies published a joint advisory on November 5, 2026. It warns of malicious activity targeting industrial refrigeration and cold chain monitoring systems globally. Attackers exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles. This can cause widespread inventory loss and equipment hazards. The warning follows European incidents: supermarkets hit through systems administered by Danfoss (reported October 11), a similar incident on November 1 affecting supermarkets in at least nine European countries, and a cyber-attack on Coolworld that reportedly pushed cold storage rooms at France's blood service (EFS) to 110°C. No threat actor has been attributed.

   Technical Details

   • The agencies list three access paths: authentication bypass, arbitrary code injection and weak configurations on internet-exposed systems (infosecurity-magazine.com).
   • Sectors highlighted in the advisory: healthcare, chemical, food and agriculture, and transportation (infosecurity-magazine.com).
   • Censys data from November 5 shows a 53% drop in internet-exposed controllers across Danfoss StoreView and Copeland/Dixell XWEB, the products compromised in the October 11 and November 2 incidents respectively. The drop is consistent with provider action or owners disconnecting devices (infosecurity-magazine.com).
   • The Danfoss attackers reportedly set temperatures as high as 50°C (infosecurity-magazine.com).

   Remediation

   • Do not expose controller panels to the internet.
   • If remote access is required, place it behind a firewall or edge device and keep it updated.
   • Isolate OT from business networks.
   • Change default passwords and enforce phishing-resistant MFA.
   • Retire end-of-life devices through a lifecycle management process.
   • Restrict changes to authorized devices and IP addresses.
   • Keep tested offline and offsite backups.
3. helpnetsecurity.com ↗ · pub. 06/11/2026 06:04 · coletado 06/11 08:01

   CISA, FBI, HHS, USDA and DOT warn of attacks on refrigeration controllers after European supermarket and blood bank disruptions

   The article adds that the French Blood Establishment (EFS) confirmed temperature spikes in three blood banks after a refrigeration equipment provider was hit. It also names more affected countries (Sweden, Luxembourg, Finland, Ireland, Estonia) and quotes CISA and FBI officials. Help Net Security says the synchronized timing suggests a possible nation-state actor, though the attackers remain unidentified.

   ler a análise desta fonte ocultar

   The article adds that the French Blood Establishment (EFS) confirmed temperature spikes in three blood banks after a refrigeration equipment provider was hit. It also names more affected countries (Sweden, Luxembourg, Finland, Ireland, Estonia) and quotes CISA and FBI officials. Help Net Security says the synchronized timing suggests a possible nation-state actor, though the attackers remain unidentified.

   Five US agencies (CISA, FBI, HHS, USDA and DOT) published a joint advisory on 5 November 2026. It warns of ongoing malicious activity against industrial refrigeration and cold-chain monitoring systems worldwide. Attackers are going after electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage. They can push units into continuous heating and defrost cycles, which causes inventory loss, equipment damage and fire hazards. Affected sectors are healthcare and public health, chemical, food and agriculture, and transportation. The advisory follows attacks on supermarkets in France and other European countries. The attackers remain unidentified, and the synchronized timing suggests a possible nation-state actor (helpnetsecurity.com).

   Technical Details

   • The agencies say attackers may exploit controllers that are unpatched or reachable from the internet. The routes named are authentication bypass, arbitrary code injection and weak configurations.
   • Once inside, attackers can change temperature settings remotely and force units into heating.
   • Operators may also lose sight of current temperatures, which the agencies call a "denial-of-view condition".
   • Unsafe storage could indirectly harm consumers if food or medicine is consumed afterwards.
   • Help Net Security reports that hundreds of French supermarkets were hit overnight. A second wave three weeks later hit Belgium, Luxembourg and Sweden. Later reports added Finland, Ireland, Estonia and the Netherlands.
   • The French Blood Establishment (EFS) confirmed that three blood banks detected a temperature spike in their cold rooms after one of its refrigeration equipment providers was hit.
   • The article names no CVEs, IOCs or specific vendor products.

   Remediation

   • Stop exposing controller panels and other control system devices to the internet. Where remote access is unavoidable, route it through a firewall or edge device kept at its latest version.
   • Put OT devices on a dedicated VLAN separate from business networks.
   • Change default passwords and enable phishing-resistant MFA where feasible.
   • Keep firmware up to date, and retire and replace devices the vendor no longer supports.
   • Limit changes with device and IP address allowlisting.
   • Keep tested offline backups and enable logging.
   • Define reasonable setpoint limits for devices downstream of controllers, and alert on any deviation.
   • Report suspicious activity to the FBI.
4. industrialcyber.co ↗ · pub. 06/11/2026 07:34 · coletado 06/11 08:00

   CISA, FBI and partners warn of attacks on exposed refrigeration controllers after supermarket cooling disruptions across Europe

   ler a análise desta fonte ocultar

   CISA, the FBI, HHS, USDA and DOT issued a joint fact sheet on Thursday warning of malicious activity against industrial refrigeration and cold-chain monitoring systems worldwide. Targets are electronic temperature controllers and commercial refrigeration controllers in retail grocery stores and cold storage. Affected sectors are healthcare and public health, chemical, food and agriculture, and transportation. The warning follows two waves of attacks on European supermarkets: Oct. 11-12 in France, and Nov. 2 across at least seven EU countries, where more than 100 stores and businesses reported problems. No group has claimed responsibility, and authorities have not established whether one perpetrator is behind both waves.

   Technical Details

   • The agencies say attackers may exploit unpatched or internet-accessible devices through authentication bypass, arbitrary code injection and weak configurations (industrialcyber.co, reporting the fact sheet).
   • Attackers can change temperature settings remotely, trigger continuous heating and defrost cycles, and disrupt temperature visibility. The results are inventory losses and equipment and fire hazards.
   • In France, freezers and fridges reportedly reached up to 50 °C and some stores had fires.
   • On Nov. 2, Sabcobel said attackers accessed cooling systems and switched evaporators into defrost mode.
   • Danfoss said some targeted systems in the Netherlands were on unsecured networks and still used default passwords.
   • A Cato Networks commentator noted published research on vulnerabilities in Danfoss AK-SM 800A and Copeland XWEB Pro controllers. Their exploitation in these attacks is not confirmed.
   • A Pentagon investigation into suspected attacks on refrigeration at military commissaries was reported by Xage Security. The article does not confirm it.

   Remediation

   • Remove direct public internet exposure, including maintenance providers' cellular connections.
   • Isolate OT from business networks.
   • Change passwords and use phishing-resistant MFA (the agencies' guidance). Danfoss and Cato Networks commentary adds replacing default and shared passwords.
   • Keep firmware current and retire end-of-life equipment.
   • Allowlist authorized devices and IP addresses.
   • Keep tested offsite and offline backups.
   • Enable logging, and collect network traffic where OT assets lack logs.
   • Set safe temperature limits downstream of controllers, with deviation alerts, and use independent temperature monitoring.
   • Secure necessary remote access through firewalls or edge devices.
5. bleepingcomputer.com ↗ · pub. 05/11/2026 21:56 · coletado 05/11 23:00

   FBI, CISA Warn of Attacks on Industrial Refrigeration and Cold-Chain Systems After European Supermarket and Blood Bank Incidents

   ler a análise desta fonte ocultar

   The FBI and CISA, jointly with the U.S. Departments of Health and Human Services (HHS), Agriculture (USDA), and Transportation (DOT), issued an advisory warning that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, with potential to cause food spoilage, equipment damage, and fire hazards. The warning covers electronic temperature controllers and commercial refrigeration management systems used across healthcare, food production, chemical, and transportation sectors. It follows a wave of attacks in Europe: in October, hackers compromised refrigeration controllers at an estimated 250 to 350 French supermarkets, remotely triggering defrost cycles, and a second wave in November hit more than 115 stores across six European countries, with some systems shut down entirely and temperatures raised as high as 50°C (122°F). On November 3, the French Blood Establishment (EFS) confirmed that a cybersecurity incident at a refrigeration equipment provider altered temperature and defrost settings at three facilities storing blood products. CISA's Acting Executive Assistant Director for Cybersecurity, Chris Butera, said every organization relying on refrigeration and monitoring systems should assume it could be a target.

   Technical Details

   The agencies state that attackers are exploiting authentication bypass vulnerabilities, arbitrary code injection flaws, or weak configurations in unpatched or internet-accessible controllers to modify temperature settings and force equipment into continuous heating or defrost cycles. This can cause inventory losses, reduced equipment lifespan, fire hazards, unsafe storage conditions, and reduced visibility into real-time temperatures, delaying detection of problems. No specific CVE identifiers, named vulnerable products, or threat actor attribution are disclosed in the advisory as reported; no group has claimed responsibility for the European attacks, and authorities remain on alert for possible hybrid threats amid tensions with Russia (therecord.media). Separately, the U.S. Defense Department's inspector general is investigating freezer and refrigeration malfunctions at several U.S. military commissaries that began in August, though it remains unclear whether these are connected to the European wave (therecord.media); prior reporting had suggested suspected Iran-linked activity behind those military base incidents (nextgov.com).

   Remediation

   The agencies recommend removing refrigeration controllers from the public internet, securing any necessary remote access, changing default passwords, applying available security updates, isolating operational technology (OT) systems from business networks, and enforcing safe temperature limits to prevent controllers from operating outside acceptable ranges.

6. theregister.com ↗ · pub. 05/11/2026 19:37 · coletado 05/11 20:00

   US agencies warn grocers and cold-chain operators of global refrigeration hacking spree spoiling food, risking fires

   ler a análise desta fonte ocultar

   The FBI, CISA, Health and Human Services, USDA, and the Department of Transportation issued a joint advisory on Thursday warning operators of industrial refrigeration and cold-chain monitoring systems about an ongoing wave of attacks. Since mid-October, unknown attackers have hacked thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg, and Sweden, forcing units to overheat to as high as 50°C (122°F), spoiling food and sparking fires. No confirmed attacks against US supermarkets have been documented, but Ahold Delhaize (parent of Food Lion, Giant Food, and Stop & Shop) proactively took IT systems offline last month after a cyberattack, and the Pentagon is reportedly investigating freezer malfunctions that spoiled food at US military bases in August as a suspected cyberattack.

   Technical Details

   According to the agencies, the actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards. The article states that attackers gain access by bypassing authentication, injecting arbitrary code, and abusing weak configurations, allowing them to change temperatures to spoil food or temperature-controlled medications, start fires, and potentially harm consumers of improperly stored products. No specific CVE or vulnerable vendor product was named in the advisory or the article; the threat is attributed to internet-exposed electronic temperature and commercial refrigeration controllers broadly, not a single named flaw. Separately, the agencies drew a parallel to Iranian hackers who used internet-accessible programmable logic controllers (PLCs) to breach more than 100 US water systems in July, citing exposed, often password-less devices as an easy entry point for attackers.

   Remediation

   The agencies urge owners and operators to immediately disconnect industrial control systems and devices from the public internet; if remote access is required, protect it behind a firewall or edge device kept up to date. Additional recommendations include creating a dedicated VLAN to isolate OT devices from business networks, replacing default passwords with strong, unique credentials and enabling phishing-resistant multi-factor authentication, applying patches promptly and retiring unsupported legacy devices, maintaining a device/IP allow-list restricting OT access, keeping offsite and offline backups, and enabling and regularly reviewing logs for unusual activity.

7. techcrunch.com ↗ · pub. 05/11/2026 15:48 · coletado 05/11 16:00

   CISA, FBI Warn of Ongoing Attacks on Industrial Refrigeration Systems Linked to Suspected Iranian Actors

   ler a análise desta fonte ocultar

   CISA, the FBI, and the U.S. Departments of Agriculture, Health and Human Services, and Transportation issued a joint advisory warning of an 'ongoing cyber threat' targeting internet-connected industrial refrigeration and cold chain monitoring systems. The warning follows waves of attacks against supermarket freezers across the United Kingdom and Europe, a French blood bank, and U.S. military refrigeration units, in which attackers manipulated temperature settings to spoil food, threaten blood supplies, and risk fire hazards or equipment damage. Some compromised systems were manufactured by Danish company Danfoss, which had stopped providing security updates for the affected units. While the U.S. has not formally attributed the attacks, researchers and officials reportedly suspect Iran is behind the campaign.

   Technical Details

   Attackers are reportedly gaining remote access to internet-exposed refrigeration control systems and forcing units into continuous heating and defrost cycles, causing inventory loss and equipment hazards. Affected sectors span food, agriculture, transportation, and medical cold-chain operations, including a blood bank in France where an attack on refrigerated blood storage was stopped before causing losses, and U.S. military bases currently under Department of Defense investigation.

   Remediation

   CISA, the FBI, and partner agencies urge affected organizations to remove remote-control refrigeration systems from direct internet exposure, change and strengthen passwords, apply available patches, and retire equipment no longer supported by vendors.

8. hackread.com ↗ · pub. 04/11/2026 09:36 · coletado 04/11 10:01

   Cyberattacks Alter Refrigeration Controls Across European Supermarkets, Forcing Food Discards

   ler a análise desta fonte ocultar

   On November 2, attackers remotely altered refrigeration settings at supermarkets and food suppliers across multiple European countries, forcing stores to discard chilled and frozen food. Affected retailers include ICA (Sweden), Coop (Sweden), Delhaize and Carrefour (Belgium/Luxembourg), Musgrave Group/SuperValu (Ireland), Edeka (Germany), and UK suppliers including Langridge Organic and three abattoirs monitored by the Association of Independent Meat Suppliers. The incidents follow an earlier wave in France on October 12 that caused food losses and reported fires at hundreds of stores, investigated by CERT-FR. Attackers appear to exploit internet-exposed refrigeration controllers, including Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB systems, switching evaporators into defrost mode and disabling temperature alert messages. No attacker attribution has been established, and the UK's National Cyber Security Centre (NCSC) is assisting affected organizations.

   Technical Details

   Belgian refrigeration company Sabcobel reported attackers switched evaporators into defrost mode, warming equipment; some fixes required physical intervention rather than software patches alone. In the UK, Langridge Organic had six of ten cold-room controllers altered, with automated temperature-alert messages disabled; staff caught the issue via manual checks. Copeland confirmed its Dixell XWEB controls were identified in UK incidents and is circulating patching guidance. A prior Forescout Vedere Labs scan (reported October 26) found 12,976 internet-exposed refrigeration services across 6,017 public IPs in 99 countries/territories, highlighting the attack surface of management interfaces controlling temperature, defrost schedules, and alarms.

   Remediation

   CERT-FR recommends removing public internet access to refrigeration controllers, reviewing configurations, updating firmware, changing default passwords, and routing remote maintenance through a secured VPN or protected network. It warns that resetting an unsupported controller without addressing underlying weaknesses leaves it exposed to repeat compromise. Danfoss has similarly advised customers against exposing refrigeration controls directly to the internet.

9. darkreading.com ↗ · pub. 03/11/2026 19:16 · coletado 03/11 21:00 só resumo do feed

   European Cold-Chain Refrigeration Systems Hit by Remote Access Attacks

   ler a análise desta fonte ocultar

   Recent incidents in Europe show attackers targeting temperature-controlled infrastructure, such as commercial refrigeration and cold-storage systems, by abusing exposed Internet connectivity and weak remote access controls. The attacks highlight how OT environments supporting food storage and other temperature-sensitive operations share the same security weaknesses as traditional industrial control systems. Beyond food supply chains, the article notes that similar combinations of Internet-facing connectivity, remote access tools, and poor security hygiene could expose temperature-controlled infrastructure in other critical sectors, including pharmaceuticals and healthcare cold storage. The piece frames these fridge attacks as a wake-up call for cold-chain operators to reassess exposure of remote management interfaces and strengthen authentication and network segmentation.

   Remediation

   Organizations operating temperature-controlled or cold-chain infrastructure should audit Internet-facing remote access points, enforce strong authentication, segment OT networks from IT and the Internet, and monitor for unauthorized access to refrigeration and climate-control systems.

10. olhardigital.com.br ↗ · pub. 03/11/2026 17:23 · coletado 03/11 18:01

    IoT Attack Spikes Supermarket Freezer Temperatures to 50°C Across Seven European Countries

    ler a análise desta fonte ocultar

    On the night of Monday, November 2, 2026, threat actors remotely tampered with internet-connected refrigeration systems in supermarkets across seven European countries, causing freezer and fridge temperatures to spike to 50°C. Delhaize, Belgium's largest retailer, confirmed problems across dozens of stores. The incident highlights the growing exposure of IoT-connected industrial and retail equipment to cyberattacks, raising concerns about food safety, operational disruption, and the security posture of connected cold-chain infrastructure. The article is behind a paywall and provides limited technical detail on the attack vector or responsible actor.

11. industrialcyber.co ↗ · pub. 03/11/2026 10:03 · coletado 03/11 14:01

    Suspected OT attacks hit refrigeration systems at supermarkets in Sweden, Belgium and Luxembourg

    ler a análise desta fonte ocultar

    Supermarket chains in Sweden, Belgium, and Luxembourg have reported a new wave of suspected cyberattacks targeting refrigeration systems, following an earlier incident in which attackers reportedly manipulated cooling equipment across hundreds of French stores, causing significant food losses. Unlike typical IT-focused attacks, these incidents affect operational technology (OT) controlling refrigeration, with potential consequences including spoiled food, interrupted operations, financial losses, and food safety risks. Michael Ferdinandsen, CEO of Danish industrial cybersecurity firm Secomea, says the incidents highlight that many retailers lack sufficient control over third-party remote access to refrigeration equipment, which is often exposed to the internet or granted overly broad access by external service providers and maintenance technicians. Investigators are still examining the latest suspected attacks, and no technical details of the intrusion method have been disclosed.

    Remediation

    Secomea recommends adopting OT-native secure remote access architectures that control connections at the individual asset level rather than granting broad network access, using Edge Gateways near operational assets, centralized access management, granular permissions, and audit logging. The company points to Danish firm AK-Centralen, which uses this approach to remotely monitor refrigeration systems across more than 1,500 supermarkets without direct access to internal networks, as a model combining operational efficiency with stronger security controls. Broader recommendations include vulnerability management, network segmentation, system updates, and continuous monitoring of third-party remote access across OT environments.

12. olhardigital.com.br ↗ · pub. 03/11/2026 10:24 · coletado 03/11 12:02

    Cyberattacks on Supermarket Refrigeration Systems Hit 7 European Countries, Force Food Disposal

    ler a análise desta fonte ocultar

    A new wave of cyberattacks struck supermarket refrigeration systems across Sweden, Ireland, Netherlands, Estonia, Finland, Belgium and Luxembourg on Monday, November 2, 2026, causing unauthorized temperature changes in refrigerators and freezers and forcing retailers to discard spoiled food. The incident follows a similar attack less than a month earlier that hit over 500 stores in France, renewing concerns about the digital vulnerability of Europe's food supply chain. Affected retailers include Carrefour (~15 of 700 Belgian stores), an Ikea unit in Mons, the butcher chain De Laet & Van Haver in Antwerp (temperatures reaching 18°C), Ahold Delhaize, Colruyt Group's Spar stores, Intermarché, Coop and ICA in Sweden (one freezer reached 50°C), Musgrave's SuperValu chain in Ireland, Kesko in Finland, Selver in Estonia, and smaller retailers in the Netherlands. No group has claimed responsibility, and Belgian and EU officials warn attribution may never be determined.

    Technical Details

    Many affected systems reportedly use temperature control technology from Danish manufacturer Danfoss, the same vendor implicated in the earlier French attacks. Danfoss stated it is working with customers to implement security fixes. Researcher Tom Hegel of SentinelOne noted that attackers likely accessed exposed control panels, leaving minimal forensic traces, making it difficult to distinguish between a lone actor and a state-sponsored operation. The absence of ransom demands in these incidents suggests possible sabotage rather than extortion motives.

    Remediation

    Danfoss is reportedly working with affected customers to implement security patches for the exposed control systems; no further technical remediation details were provided in the article.

13. infosecurity-magazine.com ↗ · pub. 03/11/2026 10:45 · coletado 03/11 12:01

    Cyber-Attack on Refrigeration Systems Disrupts Supermarkets Across Nine European Countries

    ler a análise desta fonte ocultar

    A cyber-attack targeting internet-connected refrigeration systems has struck supermarkets in at least nine European countries—Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden—causing freezer and fridge temperatures to be remotely set as high as 50°C, destroying food stock. The incident follows a similar October 2026 attack on refrigeration providers Danfoss and Copeland that affected French supermarket chains, suggesting a possible connection or copycat campaign. Affected retailers include SuperValu in Ireland (13 stores precautionarily cleared of stock), ICA Sweden, and an Ikea outlet in Mons, Belgium. The UK has also reported limited exploitation of vulnerable refrigeration technology per the NCSC. No threat actor has claimed responsibility, but EU officials suspect a deliberate, possibly nation-state-linked attempt to disrupt Europe's food supply chain.

    Technical Details

    Attackers appear to have gained remote access to internet-connected refrigeration units, reprogramming temperature controls to extreme levels (~50°C/122°F), spoiling chilled and frozen goods. The attack vector has not been confirmed, but the pattern mirrors the Danfoss/Copeland incident from October 2026 affecting the same category of connected industrial refrigeration equipment. Sweden's NCSC and the UK NCSC are coordinating with counterparts across Nordic and European countries to assess scope and exploited vulnerabilities.

    Remediation

    Affected retailers removed chilled and frozen products from shelves as a precaution. The UK NCSC has alerted potentially affected companies. EU Agriculture and Food Commissioner Christophe Hansen stated the incidents will be discussed at the EU's Security College to review retailers' contingency plans and incident response capabilities.

14. itsecurityguru.org ↗ · pub. 03/11/2026 11:12 · coletado 03/11 12:00

    Second Wave of Supermarket Refrigeration Cyberattacks Hits Seven European Countries

    ler a análise desta fonte ocultar

    A second wave of suspected cyberattacks against supermarket refrigeration systems struck Belgium, Sweden, Luxembourg, Finland and Ireland (among seven countries) on 2 November 2026, following earlier attacks on French supermarkets in October that caused widespread food spoilage. Affected retailers reportedly include Carrefour, Intermarché, Coop, ICA and Delhaize, with attackers manipulating refrigeration temperatures up to 50°C. The perpetrators and motive remain unconfirmed, but the attacks highlight the exposure of internet-connected operational technology, particularly remote refrigeration management platforms such as Copeland/Dixell XWEB and Danfoss StoreView. Research from Forescout Research – Vedere Labs found nearly 13,000 internet-exposed refrigeration service observations across 99 countries, tied to over 6,000 distinct public IPs, many running outdated software.

    Technical Details

    Attackers appear to exploit unsecured remote access capabilities on refrigeration management systems to switch cooling units into defrost mode, raising temperatures and spoiling stock. Experts note these IoT/OT devices often run outdated firmware, lack processing power for modern security controls, and are frequently exposed to the internet via cellular, wired or Wi-Fi connections for remote monitoring, making them attractive, low-sophistication targets for disruption rather than data theft.

    Remediation

    Security specialists recommend identifying internet-exposed refrigeration and OT equipment, restricting unnecessary remote/internet access, applying available firmware updates, deploying network-level monitoring to detect anomalous communications, and incorporating operational technology into incident response and business continuity planning, including procedures for handling spoiled inventory and restoring correct temperatures.

15. securityweek.com ↗ · pub. 03/11/2026 04:43 · coletado 03/11 05:00

    Over 100 European stores hit as Danfoss and Copeland refrigeration controllers are hijacked in a second attack wave

    ler a análise desta fonte ocultar

    More than 100 stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden had refrigerators and freezers forced to heat up overnight from Sunday to Monday. Problems were also reported in Finland, Italy and Portugal. The incidents resemble the attacks of 11-12 October that hit about 700 French supermarkets, but investigators have not established whether the two waves are linked, and no one has claimed responsibility. The affected devices are reportedly Danfoss and Copeland refrigeration controllers with internet-reachable management interfaces. Officials have not publicly explained how the attackers got in. The EU agriculture commissioner called the attacks a deliberate attempt to disrupt the food supply chain.

    Technical Details

    • In the first wave (France, 11-12 October), refrigeration units at about 700 stores were forced into defrost mode, including Intermarché, Carrefour, Coopérative U and Monoprix. Food was spoiled and fires were reportedly caused. CERT-FR tied the compromises to Danfoss AK-SM and AK-SC controllers, then extended its alert to Copeland and Dixell XWEB systems. Danfoss said most compromised units were legacy products it no longer updates.
    • In the new wave, a Belgian refrigeration firm (Sabcobel) said attackers forced the evaporators into defrost mode, as in France. Some units were set as high as 50°C. Sabcobel said a software update is not enough and the equipment also needs physical modification.
    • Researcher Kevin Beaumont said every freezer hit on Monday had an internet-reachable management interface. Many devices are end-of-life with no patch available.
    • Lupovis saw suspicious activity against its Danfoss AK-SM sensors between 20 and 30 October, peaking on 26 October. Most login attempts used factory-default credentials documented publicly, and others appeared to fingerprint specific controller components. All attempts were rejected.
    • Censys counts just over 1,000 Danfoss StoreView interfaces online. Exposed instances in France fell from 1,825 before the attacks to 220. About 41% of the French instances still online appear patched, against 68% in Belgium (138 exposed), 37% in the Netherlands (51) and 58% in Sweden (50). Censys did not say whether patched devices were among those compromised on Monday.
    • Reported impact: Delhaize (several dozen stores in Belgium, four in Luxembourg), Carrefour Belgium (15 locations), Colruyt (five Spar shops), an IKEA store in Mons, SuperValu in Ireland (13 stores), ICA and Coop in Sweden, Kesko in Finland, Coop-branded stores in Sicily, seven Intermarché stores in Portugal, and at least 17 businesses in the Netherlands. The Belgian federal prosecutor has opened an investigation.

    Remediation

    • Danfoss told customers on 13 October to cut their systems' internet connections and reconnect only through a secure network. Some stores did not act.
    • Remove management interfaces of refrigeration controllers from the internet, change default credentials, and apply available firmware updates. Replace or physically modify end-of-life units that cannot be patched.
16. thehackernews.com ↗ · pub. 03/11/2026 04:27 · coletado 03/11 05:00

    Second wave of attacks on Danfoss refrigeration controls hits supermarkets in Belgium, Sweden, Estonia and the Netherlands

    ler a análise desta fonte ocultar

    Attackers remotely changed settings on internet-connected refrigeration controls at supermarkets in Belgium, Sweden, Estonia and the Netherlands overnight into 2 November 2026, warming fridges and freezers. The incident comes about three weeks after attacks on hundreds of French supermarkets. Danfoss confirmed its products were involved, and Copeland equipment was reportedly hit in Belgium. No chain reported more than several dozen affected stores, and some discarded or pulled chilled and frozen food. No group has claimed the attacks, and attribution and any link to the French campaign are unknown. Belgium's federal prosecutor has opened a criminal investigation.

    Technical Details

    • In Belgium, attackers switched cooling units into defrost mode (Sabcobel, which manages systems for Delhaize, knows of about 20 affected units). Elsewhere the temperature setpoint was raised, for example to 50°C at an ICA store in Sjöbo (Sweden) and at a Selver store in Estonia.
    • Belgian attackers got into individual supermarkets' systems, not those of refrigeration contractors, according to Sabcobel.
    • Danfoss told NOS that the affected Dutch systems were not on a secure network and still used default passwords. It also said the weakness lies mainly in outdated software.
    • In Estonia, an older Danfoss controller that had not been updated was reached. The article does not say how attackers got in in Sweden.
    • CERT-FR's alert (last updated 16 October) covers Danfoss AK-SM and AK-SC series controllers, plus Copeland xweb and Dixell xweb. It says the campaigns are probably still underway. In October, Danfoss said most units hit in France were end-of-life AK-SM 800 and AK-SC 355 models.
    • Danfoss, Sabcobel and Kitman said the method matched or resembled the French attack. A shared method does not show the same actors are behind both.
    • Danfoss's advisories page listed no advisory on these attacks as of 3 November.

    Remediation

    • Make sure devices cannot be reached from the internet, including any device on a public IP. Restore remote access only through a secure VPN or protected network. Filtering contractor IPs at a firewall is an emergency measure only.
    • Check the whole configuration, especially defrost schedules.
    • Update firmware. On Danfoss devices, set the security level to Strict and change default passwords.
    • For compromised devices, restart or factory-reset the Danfoss device and reconfigure it before returning it to service.
    • End-of-life devices that no longer get fixes are very likely to be compromised if left online, and a factory reset alone does not protect them.
    • Sweden's National Cybersecurity Centre advises inventorying internet-connected devices, deciding whether each needs a connection, and layering protections on those that stay connected.
17. olhardigital.com.br ↗ · pub. 02/11/2026 13:58 · coletado 02/11 16:00

    Refrigeration failures at supermarkets in Belgium, Luxembourg and Sweden raise suspicion of cyberattacks

    ler a análise desta fonte ocultar

    Supermarket chains in several European countries reported refrigeration failures on 2 November 2026, raising suspicion of attacks on internet-connected equipment. In Belgium, five Spar stores operated by Colruyt Group, nearly 15 Carrefour stores and dozens of Ahold Delhaize (Delhaize) stores in Belgium and Luxembourg were affected, and ICA and Coop stores in Sweden reported similar problems. The incidents come about a month after a cyberattack on hundreds of supermarkets in France, where police said attackers took control of refrigeration systems and raised temperatures to as much as 50ºC, causing fires and food losses. No authority has named a culprit and no group has claimed responsibility.

    Technical Details

    • The CEO of Sabcobel, the Belgian refrigeration company that supplies Delhaize's systems, said a cyberattack triggered the evaporators into defrost mode, heating the equipment.
    • Delhaize reported a temperature rise in its refrigeration systems.
    • In October, Ahold Delhaize reported a cybersecurity incident to Dutch police after noticing suspicious activity in its infrastructure. The article does not link it to these events.
    • The article attributes the exposure to alarms, refrigerators, cameras and heating systems being connected to networks for remote monitoring and control.
    • No IOCs, CVEs or intrusion vectors were disclosed.

    Remediation

    The article gives no remediation guidance.

18. industrialcyber.co ↗ · pub. 02/11/2026 14:36 · coletado 02/11 15:01

    Hackers manipulate supermarket refrigeration systems in at least seven European countries, forcing product removals

    ler a análise desta fonte ocultar

    A new wave of attacks on supermarket refrigeration systems hit grocery chains in at least seven European countries on Nov. 2: Sweden, Belgium, Estonia, Ireland, Finland, Luxembourg and the Netherlands. Affected retailers include ICA, Coop, Ahold Delhaize, Colruyt, Carrefour, Intermarché, SuperValu, Selver and an IKEA store in Belgium. Attackers manipulated temperature controls, reportedly raising freezers to 50 °C and forcing retailers to pull chilled and frozen goods. The wave follows a similar attack in France the previous month, which reportedly hit hundreds of supermarkets and caused fires and major food losses. No attribution has been established, and authorities have not said whether the incidents are linked to the French attack.

    Technical Details

    • Kitman Coldtech, the Estonian refrigeration provider, said attackers exploited an older Danfoss refrigeration system. Other Estonian clients may also have been targeted.
    • At Selver in Estonia, attackers accessed a computer controlling the refrigeration system and raised the freezer temperature to 50 °C. The technology partner detected the attack quickly and prevented damage.
    • In Ireland, SuperValu said a specific refrigeration system model was affected in 13 of its 223 stores. The Irish NCSC said the incidents may be related to a known vulnerability, but the article gives no CVE.
    • Sweden's National Cybersecurity Centre identified a significant number of exposed OT devices that need updates or patches.
    • An ICA franchise store in Stockholm said the attack occurred around 2 a.m. but was noticed only hours later, and the frozen inventory was destroyed.
    • Reported scope: Coop, six stores; Ahold Delhaize, dozens of stores in Belgium and Luxembourg; Colruyt, five stores; Carrefour Belgium, about 15 of 700 stores; Intermarché, 15 stores.

    Remediation

    • Patch or update exposed OT and refrigeration devices.
    • Control who can remotely access equipment, what they can reach and what they can do.
    • Ask suppliers how long products will be supported and how vulnerabilities will be handled.
    • Operators and their suppliers are responsible for the affected systems, according to the Irish NCSC.
19. bleepingcomputer.com ↗ · pub. 02/11/2026 11:28 · coletado 02/11 13:00

    Hackers remotely tamper with refrigeration controls at 115+ supermarkets across six European countries

    ler a análise desta fonte ocultar

    A cyberattack hit refrigeration and freezer systems at more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Attackers remotely changed temperature settings, shut units down or triggered defrost cycles, causing product losses. Affected chains include ICA, Coop, Ahold Delhaize, Carrefour, Spar Colruyt, Intermarché, SuperValu and Selver, plus butcher shops, an Ikea store in Mons and chocolate shops. It is unclear whether the attacks were coordinated or targeted individually. The vendor Sabcobel says the attacker used the same vulnerability as in similar attacks in France the previous month.

    Technical Details

    • An ICA store manager told TV4 that temperatures were set to +50°C (122°F) and could not be changed.
    • Ahold Delhaize warned store managers by SMS around 4 a.m. Some stores used refrigerated trucks to preserve stock.
    • RTL identified Sabcobel as the refrigeration vendor at several impacted sites. Its director, Stephan Moelans, attributed the disruption to remotely activated defrost functions and said technicians began disconnecting installations from 1 a.m.
    • The vulnerability is not named in the article. The France attacks the previous month affected hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers, which remote attackers set to defrost mode.
    • Some affected stores operate outside the chains' central networks, such as independent Spar stores and ICA stores, each with their own refrigeration systems.

    Remediation

    • Sabcobel says a software update alone is not enough, because the refrigerators also need physical modifications.
    • Sabcobel recommends managing the refrigerators over a secure internet connection. It says most clients adopted this after the France attack.
    • Affected installations were disconnected from the network.
20. helpnetsecurity.com ↗ · pub. 02/11/2026 11:28 · coletado 02/11 12:01

    Second wave of attacks on internet-exposed refrigeration controllers spoils food in Belgian, Luxembourg and Swedish supermarkets

    ler a análise desta fonte ocultar

    A second wave of cyberattacks hit supermarkets in Belgium, Luxembourg and Sweden around 1-2 November 2026, about three weeks after the October attack on French retailers. Attackers remotely switched refrigeration evaporators to defrost mode or raised freezer temperatures (up to 50 °C in Sweden), spoiling refrigerated food. Affected chains include Delhaize, Carrefour and Spar in Belgium, Delhaize in Luxembourg, and Coop and Ica in Sweden. Colruyt and Intermarche reported "technical problems" without confirming a cyberattack. Attribution is still unknown.

    Technical Details

    • Belgian reports say the mechanism is the same as in the October attack in France, which targeted refrigeration control and monitoring systems from Danfoss, Copeland and Dixell, according to ANSSI.
    • The root cause is remotely exploitable vulnerabilities in internet-exposed management interfaces. Researcher Kevin Beaumont confirmed the affected freezers are all management-interface-facing internet with the same issue as last time. He added that many are end of life with no patch available.
    • Ica said the affected stores had connections outside its central network.
    • Sabcobel says a thorough fix needs a software update plus physical modification of the units.

    Remediation

    • Disconnect refrigeration controllers from the internet and manage them over a secure connection. Most Sabcobel customers switched to this after the French attack.
    • Apply the vendor software update and the physical modification Sabcobel describes.
    • Replace or isolate end-of-life units that have no patch.
21. techcrunch.com ↗ · pub. 02/11/2026 11:08 · coletado 02/11 12:00

    Second wave of attacks on Danfoss-linked supermarket refrigeration hits Delhaize and Colruyt stores in four European countries

    ler a análise desta fonte ocultar

    A second wave of suspected cyberattacks has hit supermarket refrigeration across Belgium, Ireland, Luxembourg and Sweden, raising temperatures and spoiling food at dozens of stores. Ahold Delhaize and Colruyt confirmed the incidents. A Belgian company that operates Delhaize's systems said the attackers changed the settings to defrost, per Reuters. The wave follows earlier attacks in France last month that spoiled food at hundreds of supermarkets. The article gives no attribution for the European attacks, though US Department of Defense officials are reportedly investigating whether freezer units on military bases were hacked by Iran-backed actors.

    Technical Details

    • Security researchers attribute the French incidents to internet-connected refrigeration units made by Danfoss, which no longer receives security updates.
    • Claroty warned in August that these units were at risk of remote hacks and outages.
    • The attackers deliberately changed temperature or defrost settings.
    • The article does not state the exact access method, any CVEs or any IOCs, and does not confirm that the second wave involved the same Danfoss devices.

    Remediation

    The article gives no explicit guidance. Its implication is that internet-exposed, end-of-life refrigeration controllers carry a real risk of remote tampering.

22. theregister.com ↗ · pub. 02/11/2026 10:15 · coletado 02/11 12:00

    Refrigeration systems hacked at dozens of supermarkets in Belgium, Sweden, Ireland and Luxembourg, causing mass food spoilage

    ler a análise desta fonte ocultar

    Grocery stores in Belgium, Ireland, Luxembourg and Sweden reported on 2 November 2026 that their refrigerators and freezers had been remotely manipulated overnight, with temperatures raised to 50-55°C and units put into defrost mode. Around 40 Delhaize stores in Belgium were hit, along with about 15 Carrefour stores and sites of Intermarché, Spar and Shop & Go. In Sweden, ICA confirmed an incident at a small number of stores operating outside its central network, and six Coop stores were also affected. At least 13 SuperValu stores in Ireland, owned by Musgrave, were affected as well. Stores threw out their fresh and frozen stock. No actor has been named and no company answered questions about attribution.

    Technical Details

    • Attackers reportedly switched the units into defrost mode and raised temperatures to 50-55°C.
    • ICA said the affected stores operate outside its central network.
    • The wave follows attacks in mid-October 2026 on French chains (Carrefour, Coopérative U, Intermarché, Monoprix and others). In those, some stores ran outdated firmware on Danfoss AK-SM and AK-SC refrigeration controllers, and CERT-FR published an alert on those compromises.
    • The article states it is unclear whether the new attacks used the same methods or the same Danfoss equipment as in France.

    Remediation

    The article gives no remediation guidance. Delhaize said its distribution centres are operating normally and that it took measures to keep stores operational.

23. securityaffairs.com ↗ · pub. 02/11/2026 09:09 · coletado 02/11 10:00

    Fridge cyberattacks hit supermarkets in Belgium, Luxembourg, Sweden and Estonia, setting refrigeration to defrost mode at 50°C

    ler a análise desta fonte ocultar

    A new wave of attacks on supermarket refrigeration systems hit retailers in Belgium, Luxembourg, Sweden and Estonia overnight on 2 November 2026, raising fridge and freezer temperatures and causing food losses. Affected chains include Delhaize (Ahold Delhaize), Colruyt/Spar, Carrefour, ICA, Coop and an unnamed Estonian chain. The incidents follow a similar mid-October attack on hundreds of French supermarkets that targeted Danfoss equipment. No actor has claimed responsibility and authorities have not attributed the attacks.

    Technical Details

    • Attackers appear to have remotely triggered the forced defrost function in continuous mode with a 50°C setpoint. Sabcobel's CEO said evaporators were switched to defrost mode.
    • In Sweden, stores reported temperatures set to 50°C. Consultant Emil Olofsson (Integrity 360) said some units reached 80°C and caught fire, a figure that differs from the police number.
    • Scale: about 40 Delhaize stores in Belgium were reportedly affected, five Colruyt-run Spar stores, at least 6 ICA stores and 6 Coop stores in central Sweden. Le Soir reported dozens of Delhaize and Carrefour stores.
    • Likely access: in the French case, Olofsson said attackers obtained login credentials for control systems exposed directly to the internet. He called the hack simple, so it may have been done by amateurs. The Swedish cyber centre's John Billow noted many exposed OT devices in Sweden.
    • The cause of the Swedish incidents is officially unknown. Ahold's separate October report to Dutch police has no reported link to these incidents.

    Remediation

    • Remove OT and refrigeration control interfaces from direct internet exposure.
    • Patch and update exposed devices, as Swedish authorities have urged.
    • Rotate and protect credentials for control systems.
24. gbhackers.com ↗ · pub. 02/11/2026 08:08 · coletado 02/11 10:00 primeiro registro

    Hackers disrupt refrigeration systems at ICA and Coop supermarkets across Sweden, freezer reaches 55°C

    ler a análise desta fonte ocultar

    Refrigeration systems at several ICA and Coop supermarkets across Sweden were disrupted by hackers, destroying perishable stock and forcing temporary closures. One store manager in Böda, Öland, found a freezer at 55°C. Affected stores span Skåne, Öland, Värmland and reportedly Stockholm, plus six Coop stores in Gästrikland and Hälsingland (per SVT). The incident follows similar attacks on French supermarket refrigeration and a reported Estonian case with remotely altered +50°C settings, but no link has been established.

    Technical Details

    • ICA says the affected refrigeration systems were connected independently of its central network.
    • No exploited vulnerabilities, malware families, controller models or threat actors have been identified.
    • It is unconfirmed whether set points, defrost cycles or cooling were manipulated.
    • Separate research on Copeland commercial refrigeration controller flaws showed cooling can be disabled while normal temperatures are displayed. No evidence links those flaws to the Swedish incidents.
    • Investigators still need to determine the initial access method and whether the stores share a refrigeration supplier, maintenance provider or remote-management infrastructure.

    Remediation

    • Restrict management access to internet-exposed OT.
    • Enforce multifactor authentication.
    • Segment control networks.
    • Monitor configuration changes.
    • Deploy independent temperature alarms and continuous monitoring.

    Sweden's National Cybersecurity Centre (part of FRA) is assisting the affected organizations.