Second wave of attacks on internet-exposed supermarket refrigeration hits 115+ stores across Europe, following the October French Danfoss attacks

Linha do tempo

1. olhardigital.com.br ↗ · pub. 02/11/2026 13:58 · coletado 02/11 16:00

   Refrigeration failures at supermarkets in Belgium, Luxembourg and Sweden raise suspicion of cyberattacks

   ler a análise desta fonte ocultar

   Supermarket chains in several European countries reported refrigeration failures on 2 November 2026, raising suspicion of attacks on internet-connected equipment. In Belgium, five Spar stores operated by Colruyt Group, nearly 15 Carrefour stores and dozens of Ahold Delhaize (Delhaize) stores in Belgium and Luxembourg were affected, and ICA and Coop stores in Sweden reported similar problems. The incidents come about a month after a cyberattack on hundreds of supermarkets in France, where police said attackers took control of refrigeration systems and raised temperatures to as much as 50ºC, causing fires and food losses. No authority has named a culprit and no group has claimed responsibility.

   Technical Details

   • The CEO of Sabcobel, the Belgian refrigeration company that supplies Delhaize's systems, said a cyberattack triggered the evaporators into defrost mode, heating the equipment.
   • Delhaize reported a temperature rise in its refrigeration systems.
   • In October, Ahold Delhaize reported a cybersecurity incident to Dutch police after noticing suspicious activity in its infrastructure. The article does not link it to these events.
   • The article attributes the exposure to alarms, refrigerators, cameras and heating systems being connected to networks for remote monitoring and control.
   • No IOCs, CVEs or intrusion vectors were disclosed.

   Remediation

   The article gives no remediation guidance.

2. industrialcyber.co ↗ · pub. 02/11/2026 14:36 · coletado 02/11 15:01

   Hackers manipulate supermarket refrigeration systems in at least seven European countries, forcing product removals

   ler a análise desta fonte ocultar

   A new wave of attacks on supermarket refrigeration systems hit grocery chains in at least seven European countries on Nov. 2: Sweden, Belgium, Estonia, Ireland, Finland, Luxembourg and the Netherlands. Affected retailers include ICA, Coop, Ahold Delhaize, Colruyt, Carrefour, Intermarché, SuperValu, Selver and an IKEA store in Belgium. Attackers manipulated temperature controls, reportedly raising freezers to 50 °C and forcing retailers to pull chilled and frozen goods. The wave follows a similar attack in France the previous month, which reportedly hit hundreds of supermarkets and caused fires and major food losses. No attribution has been established, and authorities have not said whether the incidents are linked to the French attack.

   Technical Details

   • Kitman Coldtech, the Estonian refrigeration provider, said attackers exploited an older Danfoss refrigeration system. Other Estonian clients may also have been targeted.
   • At Selver in Estonia, attackers accessed a computer controlling the refrigeration system and raised the freezer temperature to 50 °C. The technology partner detected the attack quickly and prevented damage.
   • In Ireland, SuperValu said a specific refrigeration system model was affected in 13 of its 223 stores. The Irish NCSC said the incidents may be related to a known vulnerability, but the article gives no CVE.
   • Sweden's National Cybersecurity Centre identified a significant number of exposed OT devices that need updates or patches.
   • An ICA franchise store in Stockholm said the attack occurred around 2 a.m. but was noticed only hours later, and the frozen inventory was destroyed.
   • Reported scope: Coop, six stores; Ahold Delhaize, dozens of stores in Belgium and Luxembourg; Colruyt, five stores; Carrefour Belgium, about 15 of 700 stores; Intermarché, 15 stores.

   Remediation

   • Patch or update exposed OT and refrigeration devices.
   • Control who can remotely access equipment, what they can reach and what they can do.
   • Ask suppliers how long products will be supported and how vulnerabilities will be handled.
   • Operators and their suppliers are responsible for the affected systems, according to the Irish NCSC.
3. bleepingcomputer.com ↗ · pub. 02/11/2026 11:28 · coletado 02/11 13:00

   Hackers remotely tamper with refrigeration controls at 115+ supermarkets across six European countries

   ler a análise desta fonte ocultar

   A cyberattack hit refrigeration and freezer systems at more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Attackers remotely changed temperature settings, shut units down or triggered defrost cycles, causing product losses. Affected chains include ICA, Coop, Ahold Delhaize, Carrefour, Spar Colruyt, Intermarché, SuperValu and Selver, plus butcher shops, an Ikea store in Mons and chocolate shops. It is unclear whether the attacks were coordinated or targeted individually. The vendor Sabcobel says the attacker used the same vulnerability as in similar attacks in France the previous month.

   Technical Details

   • An ICA store manager told TV4 that temperatures were set to +50°C (122°F) and could not be changed.
   • Ahold Delhaize warned store managers by SMS around 4 a.m. Some stores used refrigerated trucks to preserve stock.
   • RTL identified Sabcobel as the refrigeration vendor at several impacted sites. Its director, Stephan Moelans, attributed the disruption to remotely activated defrost functions and said technicians began disconnecting installations from 1 a.m.
   • The vulnerability is not named in the article. The France attacks the previous month affected hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers, which remote attackers set to defrost mode.
   • Some affected stores operate outside the chains' central networks, such as independent Spar stores and ICA stores, each with their own refrigeration systems.

   Remediation

   • Sabcobel says a software update alone is not enough, because the refrigerators also need physical modifications.
   • Sabcobel recommends managing the refrigerators over a secure internet connection. It says most clients adopted this after the France attack.
   • Affected installations were disconnected from the network.
4. helpnetsecurity.com ↗ · pub. 02/11/2026 11:28 · coletado 02/11 12:01

   Second wave of attacks on internet-exposed refrigeration controllers spoils food in Belgian, Luxembourg and Swedish supermarkets

   ler a análise desta fonte ocultar

   A second wave of cyberattacks hit supermarkets in Belgium, Luxembourg and Sweden around 1-2 November 2026, about three weeks after the October attack on French retailers. Attackers remotely switched refrigeration evaporators to defrost mode or raised freezer temperatures (up to 50 °C in Sweden), spoiling refrigerated food. Affected chains include Delhaize, Carrefour and Spar in Belgium, Delhaize in Luxembourg, and Coop and Ica in Sweden. Colruyt and Intermarche reported "technical problems" without confirming a cyberattack. Attribution is still unknown.

   Technical Details

   • Belgian reports say the mechanism is the same as in the October attack in France, which targeted refrigeration control and monitoring systems from Danfoss, Copeland and Dixell, according to ANSSI.
   • The root cause is remotely exploitable vulnerabilities in internet-exposed management interfaces. Researcher Kevin Beaumont confirmed the affected freezers are all management-interface-facing internet with the same issue as last time. He added that many are end of life with no patch available.
   • Ica said the affected stores had connections outside its central network.
   • Sabcobel says a thorough fix needs a software update plus physical modification of the units.

   Remediation

   • Disconnect refrigeration controllers from the internet and manage them over a secure connection. Most Sabcobel customers switched to this after the French attack.
   • Apply the vendor software update and the physical modification Sabcobel describes.
   • Replace or isolate end-of-life units that have no patch.
5. techcrunch.com ↗ · pub. 02/11/2026 11:08 · coletado 02/11 12:00

   Second wave of attacks on Danfoss-linked supermarket refrigeration hits Delhaize and Colruyt stores in four European countries

   ler a análise desta fonte ocultar

   A second wave of suspected cyberattacks has hit supermarket refrigeration across Belgium, Ireland, Luxembourg and Sweden, raising temperatures and spoiling food at dozens of stores. Ahold Delhaize and Colruyt confirmed the incidents. A Belgian company that operates Delhaize's systems said the attackers changed the settings to defrost, per Reuters. The wave follows earlier attacks in France last month that spoiled food at hundreds of supermarkets. The article gives no attribution for the European attacks, though US Department of Defense officials are reportedly investigating whether freezer units on military bases were hacked by Iran-backed actors.

   Technical Details

   • Security researchers attribute the French incidents to internet-connected refrigeration units made by Danfoss, which no longer receives security updates.
   • Claroty warned in August that these units were at risk of remote hacks and outages.
   • The attackers deliberately changed temperature or defrost settings.
   • The article does not state the exact access method, any CVEs or any IOCs, and does not confirm that the second wave involved the same Danfoss devices.

   Remediation

   The article gives no explicit guidance. Its implication is that internet-exposed, end-of-life refrigeration controllers carry a real risk of remote tampering.

6. theregister.com ↗ · pub. 02/11/2026 10:15 · coletado 02/11 12:00

   Refrigeration systems hacked at dozens of supermarkets in Belgium, Sweden, Ireland and Luxembourg, causing mass food spoilage

   ler a análise desta fonte ocultar

   Grocery stores in Belgium, Ireland, Luxembourg and Sweden reported on 2 November 2026 that their refrigerators and freezers had been remotely manipulated overnight, with temperatures raised to 50-55°C and units put into defrost mode. Around 40 Delhaize stores in Belgium were hit, along with about 15 Carrefour stores and sites of Intermarché, Spar and Shop & Go. In Sweden, ICA confirmed an incident at a small number of stores operating outside its central network, and six Coop stores were also affected. At least 13 SuperValu stores in Ireland, owned by Musgrave, were affected as well. Stores threw out their fresh and frozen stock. No actor has been named and no company answered questions about attribution.

   Technical Details

   • Attackers reportedly switched the units into defrost mode and raised temperatures to 50-55°C.
   • ICA said the affected stores operate outside its central network.
   • The wave follows attacks in mid-October 2026 on French chains (Carrefour, Coopérative U, Intermarché, Monoprix and others). In those, some stores ran outdated firmware on Danfoss AK-SM and AK-SC refrigeration controllers, and CERT-FR published an alert on those compromises.
   • The article states it is unclear whether the new attacks used the same methods or the same Danfoss equipment as in France.

   Remediation

   The article gives no remediation guidance. Delhaize said its distribution centres are operating normally and that it took measures to keep stores operational.

7. securityaffairs.com ↗ · pub. 02/11/2026 09:09 · coletado 02/11 10:00

   Fridge cyberattacks hit supermarkets in Belgium, Luxembourg, Sweden and Estonia, setting refrigeration to defrost mode at 50°C

   ler a análise desta fonte ocultar

   A new wave of attacks on supermarket refrigeration systems hit retailers in Belgium, Luxembourg, Sweden and Estonia overnight on 2 November 2026, raising fridge and freezer temperatures and causing food losses. Affected chains include Delhaize (Ahold Delhaize), Colruyt/Spar, Carrefour, ICA, Coop and an unnamed Estonian chain. The incidents follow a similar mid-October attack on hundreds of French supermarkets that targeted Danfoss equipment. No actor has claimed responsibility and authorities have not attributed the attacks.

   Technical Details

   • Attackers appear to have remotely triggered the forced defrost function in continuous mode with a 50°C setpoint. Sabcobel's CEO said evaporators were switched to defrost mode.
   • In Sweden, stores reported temperatures set to 50°C. Consultant Emil Olofsson (Integrity 360) said some units reached 80°C and caught fire, a figure that differs from the police number.
   • Scale: about 40 Delhaize stores in Belgium were reportedly affected, five Colruyt-run Spar stores, at least 6 ICA stores and 6 Coop stores in central Sweden. Le Soir reported dozens of Delhaize and Carrefour stores.
   • Likely access: in the French case, Olofsson said attackers obtained login credentials for control systems exposed directly to the internet. He called the hack simple, so it may have been done by amateurs. The Swedish cyber centre's John Billow noted many exposed OT devices in Sweden.
   • The cause of the Swedish incidents is officially unknown. Ahold's separate October report to Dutch police has no reported link to these incidents.

   Remediation

   • Remove OT and refrigeration control interfaces from direct internet exposure.
   • Patch and update exposed devices, as Swedish authorities have urged.
   • Rotate and protect credentials for control systems.
8. gbhackers.com ↗ · pub. 02/11/2026 08:08 · coletado 02/11 10:00 primeiro registro

   Hackers disrupt refrigeration systems at ICA and Coop supermarkets across Sweden, freezer reaches 55°C

   ler a análise desta fonte ocultar

   Refrigeration systems at several ICA and Coop supermarkets across Sweden were disrupted by hackers, destroying perishable stock and forcing temporary closures. One store manager in Böda, Öland, found a freezer at 55°C. Affected stores span Skåne, Öland, Värmland and reportedly Stockholm, plus six Coop stores in Gästrikland and Hälsingland (per SVT). The incident follows similar attacks on French supermarket refrigeration and a reported Estonian case with remotely altered +50°C settings, but no link has been established.

   Technical Details

   • ICA says the affected refrigeration systems were connected independently of its central network.
   • No exploited vulnerabilities, malware families, controller models or threat actors have been identified.
   • It is unconfirmed whether set points, defrost cycles or cooling were manipulated.
   • Separate research on Copeland commercial refrigeration controller flaws showed cooling can be disabled while normal temperatures are displayed. No evidence links those flaws to the Swedish incidents.
   • Investigators still need to determine the initial access method and whether the stores share a refrigeration supplier, maintenance provider or remote-management infrastructure.

   Remediation

   • Restrict management access to internet-exposed OT.
   • Enforce multifactor authentication.
   • Segment control networks.
   • Monitor configuration changes.
   • Deploy independent temperature alarms and continuous monitoring.

   Sweden's National Cybersecurity Centre (part of FRA) is assisting the affected organizations.