New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Swati KhandelwalNov 03, 2026Cyberattack / Industrial Security Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers. No chain reported more than several dozen affected stores, and some had to throw away chilled and frozen food or take it off the shelf. Danfoss, a Danish maker of refrigeration controls, said its products were involved, as they were three weeks earlier when attackers hit hundreds of French supermarkets. No one had claimed the attacks by Monday night, and it was not known whether they were linked to the attack in France. Refrigeration controls are computers that run a store's fridges and freezers. They can be connected to the internet, allowing refrigeration contractors to monitor them and fix faults remotely. In Belgium, attackers switched cooling units into defrost mode, Stephan Moelans, chief executive of the refrigeration contractor Sabcobel, told Belgian media. Defrost mode is meant to clear ice, but in these attacks it made the units heat up instead of keeping food cold. Sabcobel manages refrigeration systems for the Delhaize supermarket chain. In other cases, the temperature setting was raised. An ICA store in Sjöbo, in southern Sweden, said its fridges and freezers had been set to 50°C and that staff were throwing out the affected goods. At a Selver supermarket in Estonia, a freezer was set to 50°C, said Jann Mutso, chief executive of the refrigeration supplier Kitman Coldtech. Its temperature rose by only about 2-3°C, and the problem was resolved within about 10 minutes, with no products damaged. Danfoss's security advisories page listed no advisory about the attacks when The Hacker News checked on November 3. The most detailed steps for operators are still those in an October alert from CERT-FR, part of France's national cybersecurity agency. Each company described the incident in its own words, and not all of them called it a cyberattack. Country Company Stores affected What the company or its supplier said Belgium, Luxembourg Delhaize Several dozen, mostly in Belgium and a few in Luxembourg An "IT incident" affected refrigeration. The range of fresh and frozen food was temporarily limited. Belgium Carrefour 15 of more than 700 A cyberattack on its refrigeration, with very limited impact. Belgium Intermarché 10 to 15 Problems with its fridges. Belgium Spar, under Colruyt Group 5, run by independent owners Their fridge systems were attacked. Belgium IKEA 1, in Mons A cyber incident hit the store's fridges and freezers. No other IKEA store in Belgium was affected. Sweden ICA A limited number. No count given An incident affected refrigeration and freezer systems. ICA did not confirm a cyberattack. Sweden Coop 6 (to TT and AFP) or 7 (to Reuters and Bloomberg), of about 800 A cyber incident in which someone tampered with its refrigeration without permission. Ireland Musgrave, owner of SuperValu 13 of 223 A "cyber incident" limited to one refrigeration model. Estonia Selver, through supplier Kitman Coldtech 1 An attack on an older Danfoss system. Netherlands Businesses not named At least 17 businesses, including butchers and small local shops Attacked, according to Danfoss. Finland Kesko A few smaller stores Unusual temperatures. The cause was under investigation. The stores' equipment is outside Kesko's central protections. Portugal Intermarché, Mosqueteiros group 7 A cyberattack that appears to have targeted an outside company managing the refrigeration, according to AFP. Italy Coop supermarkets run by Radenza Group At least 4, in Sicily An attack on its remote control system for frozen food sections, according to AFP. At a De Laet & Van Haver butcher shop in Hove, south of Antwerp, the fridges were turned up as high as 18°C, owner Luc De Laet told Reuters. He estimated that about €15,000 worth of meat was ruined. At the 13 SuperValu stores, Musgrave took chilled and frozen products off sale as a precaution. The company said on Monday afternoon that the incident had been resolved and restocking was under way. What Companies Say About the Equipment and the Way In Several of the systems that were hit were made by Danfoss. All of ICA's affected stores were connected to an outside refrigeration control system supplied by Danfoss, an ICA spokesperson told AFP. In Estonia, attackers reached the control computer of an older Danfoss system, Mutso said. Danfoss is not named in every case. Musgrave's statement did not name the maker of the affected model. An affected Belgian butcher told Dutch broadcaster NOS that equipment from a second maker, Copeland, was also attacked in Belgium. Copeland gave NOS no clear answer to questions about the attacks. The Dutch systems that were hit were not on a secure network and still used default passwords, a Danfoss spokesperson told NOS. Most shops there had taken measures after the French attack, but a few had not, and those were the ones hit. Danfoss also told Belgian broadcaster VTM that the weakness lies mainly in outdated software and that customers who had not updated were affected, Euronews reported. Sabcobel knows of about 20 affected units among the hundreds it manages in Belgium. In the Belgian cases, attackers got into individual supermarkets' systems, not those of refrigeration contractors, Moelans told Belgian media. Sabcobel had advised stores to secure their internet connections, and many but not all had done so. Mutso said old controllers that had not been updated were being targeted. Selver said the store that was hit was the last one it had not yet moved to a new system. ICA told NBC News that its own systems were not affected and that the affected stores used an outside supplier and were connected to a network outside ICA's central network. Belgium's Centre for Cybersecurity told reporters on Monday that it had no further information. Sweden's National Cybersecurity Centre did not say in its notice how attackers got in. CERT-FR's alert covers Danfoss AK-SM and AK-SC series controllers, as well as Copeland xweb and Dixell xweb. It says attack campaigns against these devices are probably still underway. When The Hacker News checked on November 3, the alert had last been updated on October 16. For devices that have not been compromised, the steps are: Make sure the devices cannot be reached from the internet, including any device on a public IP address. Check your insurance contract before cutting the data feed to your refrigeration contractor. Check the whole configuration, especially the defrost schedules. Restore access only through a secure VPN or a protected network. In an emergency, you can filter the contractors' IP addresses at a firewall, but this should not be a lasting fix. Follow the maker's good practices, such as updating firmware. For Danfoss devices, set the security level to Strict and make sure default passwords have been changed. For a device that has been compromised, two more steps follow: restart the Danfoss device or reset it to factory settings, then reconfigure it before putting it back into service. End-of-life devices that no longer get security fixes are very likely to be compromised if they stay on the internet, CERT-FR warns. A factory reset alone leaves them open to attack again. In October, Danfoss said most of the units hit in France were older models it no longer updates, the AK-SM 800 and AK-SC 355. Danfoss advised Dutch customers on October 13 to disconnect their systems from the internet and reconnect them only through a secure network. It had also been working with customers to put fixes in place. Sweden's National Cybersecurity Center advised organizations to list which devices are connected to the internet, decide whether each one needs to be connected, and keep any that remain connected updated and protected with multiple layers of security. Moelans said a software update alone is not enough, because the installations need physical changes that cost money. The simplest answer is a secure internet connection for managing the fridges, which most of Sabcobel's customers adopted after the French attack. Danfoss said the Dutch attacks were the same kind as the one in France, Sabcobel said the same method was used in Belgium, and Kitman said the method in Estonia was similar. A shared method does not show that the same people carried out both attacks. Belgium's Centre for Cybersecurity said on Monday that it was not known who was behind the attacks and that "it may never be determined". Belgium's federal prosecutor's office has opened a criminal investigation, it confirmed to VRT. Sweden's National Cybersecurity Centre said on Monday that it was following the incidents and sharing information with agencies in other Nordic and European countries. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. cyberattack, Industrial Security, iot security, Supply Chain Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers AI-Generated Fake Login Pages Are Making Account Takeovers Easier CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Attend Live Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. See how Identity Dark Matter impacts your GRC, IR, and Infrastructure. Watch the video. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security