New Wave of Cyberattacks Targets European Supermarket Refrigeration Systems
Summary
Attackers remotely altered supermarket refrigeration controls in Belgium, Sweden, Estonia and elsewhere, causing some food losses. Outdated software and insecure connections were cited; no actor or link to the earlier French attacks was confirmed.
Key points
- Attackers changed refrigeration settings overnight into November 2; no group had claimed responsibility, and a link to the earlier French attacks was unknown.
- In Belgium, refrigeration units were reportedly switched to defrost mode. Sabcobel said it knew of about 20 affected units among those it manages.
- An ICA store in Sweden reported settings raised to 50°C and staff discarding goods. In Estonia, a freezer reportedly warmed by only 2–3°C; the issue was resolved in about 10 minutes without product damage.
- Danfoss equipment was involved in several cases. Sources cited outdated software, internet exposure and default passwords as issues affecting some systems.
- CERT-FR said campaigns against listed Danfoss and Copeland controller series were probably still underway. Advice included using secure networks, keeping connected devices updated and protecting them with multiple security layers.
- Belgium's federal prosecutor opened an investigation; Sweden's National Cybersecurity Centre said it was tracking incidents and sharing information with other agencies.
Article Details
- Victim Organization
- Multiple supermarkets and food retailers, including ICA, Selver, Musgrave-operated SuperValu stores, Delhaize stores managed by Sabcobel, and De Laet & Van Haver; no single victim organization was identified.
- Incident Type
- Remote unauthorized changes to supermarket refrigeration-control settings, including switching units to defrost mode or raising temperature settings.
- Incident Date
- 2026-11-02
- Disclosure Date
- 2026-11-02
- Operational Impact
- Fridges and freezers warmed, causing some food to be discarded or removed from sale. Affected stores included 13 SuperValu locations; Sabcobel reported about 20 affected units among those it manages in Belgium. A butcher estimated that about €15,000 worth of meat was ruined. A Selver freezer incident was resolved in about 10 minutes without product damage. No chain reported more than several dozen affected stores.
- Ransom Or Extortion
- No one had claimed responsibility for the attacks by Monday night; ransom or extortion was not reported.
- Claim Status
- confirmed
People
Jann MutsoChief executive of refrigeration supplier Kitman Coldtech; reported the incident at a Selver supermarket in Estonia and said an older Danfoss system’s control computer was reached.Luc De LaetOwner of the affected De Laet & Van Haver butcher shop; reported that its fridges had been turned up to 18°C and estimated the resulting meat loss.Stephan MoelansChief executive of refrigeration contractor Sabcobel; described the Belgian incidents, including attackers switching cooling units into defrost mode and accessing individual supermarkets’ systems.
Vendors
CopelandAn affected Belgian butcher told Dutch broadcaster NOS that equipment from a second maker, Copeland, was also attacked in Belgium. Copeland gave NOS no clear answer to questions about the attacks.Danfossdozen affected stores, and some had to throw away chilled and frozen food or take it off the shelf. Danfoss, a Danish maker of refrigeration controls, said its products were involved, as they were three weeks
Products
Copeland XWEBCERT-FR's alert covers Danfoss AK-SM and AK-SC series controllers, as well as Copeland xweb and Dixell xweb. It says attack campaigns against these devices are probably still underway. When The Hacker News checked onDixell XWEBCERT-FR's alert covers Danfoss AK-SM and AK-SC series controllers, as well as Copeland xweb and Dixell xweb. It says attack campaigns against these devices are probably still underway. When The Hacker News checked on
Countries
BelgiumAttackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers.EstoniaAttackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers.FranceNo one had claimed the attacks by Monday night, and it was not known whether they were linked to the attack in France.SwedenAttackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers.