Second Wave of Cyberattacks Hits Supermarket Refrigeration Across Europe

Refrigeration and freezer units at supermarkets across six European countries overheated overnight into Monday in what officials and retailers suspect was a second wave of a cyberattack campaign that first hit hundreds of French grocery stores in October. Chains in Belgium, Sweden, Luxembourg and Estonia reported that cooling systems had been driven into prolonged defrost cycles, pushing some units as high as 50 degrees Celsius and forcing staff to discard spoiled meat, dairy and frozen stock, the BBC reported on Monday.

The disruption hit roughly 40 Delhaize supermarkets and about 15 Carrefour stores in Belgium, along with some 15 Intermarché locations and five independently run Spar outlets tied to Colruyt Group, according to Belgian broadcaster RTL's reporting and company statements. In Sweden, grocery group Coop confirmed problems at six stores in the central part of the country, while ICA said an overnight incident had affected "a limited number" of its roughly 1,300 outlets. An unnamed Estonian chain also reported overheating equipment, flagged by refrigeration contractor Kitman Coldtech to national broadcaster ERR, and stores in Luxembourg linked to the Colruyt-owned Spar franchise were affected as well.

No one has claimed responsibility, and investigators in Belgium and Sweden have stopped short of formally attributing the incidents to a cyberattack, describing them only as suspected. Delhaize characterized the episode as an "IT incident." Carrefour said it was still assessing what happened. The pattern, however, closely mirrors an attack that struck roughly 300 Intermarché and Netto stores and fewer than 100 U supermarkets in France in mid-October, an episode French authorities did formally attribute to a cyber intrusion and that the Guardian described as the likely first wave of the same campaign.

A second wave spreads north and east

At an ICA Kvantum store in Sjöbo, in southern Sweden, manager Rickard Nilsson said freezer units had been remotely reset to 50 degrees Celsius overnight and that staff were unable to regain control of the equipment, destroying what he estimated as hundreds of thousands of Swedish kronor worth of stock. A Belgian refrigeration contractor, Sabcobel, said its technicians worked through the night disconnecting affected installations after hackers appeared to switch units' evaporators into continuous defrost mode — the same mechanism, reported by French investigators in October, that turns a cooling system into a heater by endlessly melting ice instead of cycling normally.

Accounts of just how hot units got vary. Company statements and most on-the-record figures cap out at 50 degrees Celsius, the same ceiling reported in France. One refrigeration consultant told Swedish wire service TT that some units reached as high as 80 degrees Celsius and caught fire, a claim that goes well beyond the figures cited by police and company spokespeople and that could not be independently corroborated.

Sweden's cybersecurity authorities confirmed they are treating the incident seriously. John Billow, who heads the country's national cybersecurity centre, said his team was responding to multiple incidents affecting store cooling systems and that a broader review had found many exposed operational-technology devices nationally still need patching. ICA spokesperson Gustaf Nilsson offered a narrower, more cautious account of what the company itself could confirm:

"We are aware that a limited number of stores were affected by an incident overnight."

Coop's press chief, Carlos Cancino, confirmed six stores had problems but said the company could not yet say whether further incidents were ruled out. In Estonia, an industry representative, Jann Mutso, told local media simply: "This is very recent. It happened this morning." The Associated Press, carried by broadcaster WRAL, separately confirmed that affected stores spanned at least six countries once France was included.

Decades-old industrial controllers, exposed to the open internet

The October attack in France was traced by the country's national cybersecurity agency to remote management modules built into refrigeration controllers made by Danish manufacturer Danfoss, along with related equipment from Copeland and Dixell. The agency, now operating under the domain cert.cyber.gouv.fr, issued a formal alert in October describing "numerous compromises" of Danfoss AK-SM and AK-SC series controllers and urged operators to cut direct internet exposure to the devices' management interfaces, since a factory reset alone would not stop renewed intrusions on equipment that can no longer be patched.

That equipment problem is not new. Danfoss has said the hardest-hit units, including its AK-SM 800 and AK-SC 355 controllers, have been end-of-life for years — the AK-SM 800 since May 2021 — and no longer receive security updates, leaving replacement as the company's only recommended fix. Even the newer AK-SM 800A model, which Danfoss continues to support, has carried serious flaws: the U.S. Cybersecurity and Infrastructure Security Agency's advisory on the AK-SM 8xxA series details an authentication-bypass bug and a command-injection vulnerability, tracked as CVE-2025-41450 and CVE-2025-41451, that researchers found could let an attacker who reaches the device's web interface take it over and run arbitrary commands after logging in. Danfoss patched both in firmware releases R4.2 and R4.3.1.

Those flaws were first disclosed by Claroty's industrial-security research unit, Team82, which published its findings on the Danfoss controllers after using the internet-scanning service Censys to count roughly 2,765 AK-SM 800A management interfaces reachable directly from the open internet, many of them tied to supermarket chains and cold-storage operators that rely on remote access for maintenance. A separate Shodan-based count put total exposed Danfoss refrigeration devices, across older and newer models combined, above 4,500 at one point this year. Security firm Integrity 360 has said the French intrusions did not appear technically sophisticated, noting that attackers seem to have obtained working login credentials for control panels that maintenance firms had left reachable straight from the internet rather than behind a virtual private network — a low bar that researchers warn would let relatively unskilled actors replicate the attack elsewhere in Europe.

Grocers scramble as a food-safety problem becomes a cybersecurity one

For the retailers involved, the immediate concern is less espionage than spoilage. Supermarket refrigeration sits at an uncomfortable intersection of food safety regulation, perishable-goods economics and industrial control systems that were often installed, and then largely forgotten, a decade or more ago. Unlike a ransomware attack on a corporate network, there is no data to recover: once meat, dairy or frozen goods cross a temperature threshold for long enough, the stock itself has to be thrown out, and the loss is immediate and irreversible rather than something that can be negotiated or restored from backup.

The disruption also lands on a sector already on edge. Weeks before the refrigeration incidents began, Ahold Delhaize — the Dutch parent of several of the chains later hit by the cooling-system attacks — disclosed a separate cybersecurity incident that knocked its U.S. and some European banner websites and apps offline for more than a week in October, notifying the Dutch national cybersecurity centre and filing a police report. The company has said it found no evidence that incident involved customer data theft, and nothing publicly links it to the refrigeration intrusions, but the back-to-back episodes underscore how much operational exposure large grocery groups are carrying heading into the winter.

Recommended fixes, echoed by CERT-FR, Claroty and refrigeration-industry publications alike, are unglamorous: take management interfaces off the open internet, route remote maintenance access through a secured virtual private network, change default administrator passwords, update firmware where a vendor still ships it, and audit defrost schedules for unauthorized changes. None of that requires exotic tooling, which is part of why researchers describe the underlying weakness as years in the making rather than newly discovered.

What happens next

Investigations are continuing in Belgium, Sweden and Estonia, and none of the affected governments has yet matched the French cybersecurity agency's formal attribution of the October wave to a cyberattack, let alone named a suspected actor. Grocery chains across the three countries have begun manually disconnecting or isolating affected controllers, mirroring the French agency's guidance, while national cybersecurity centres in Sweden and, before it, France say they are pushing operators of similar equipment to check their own exposure before further incidents emerge.

With Danfoss's oldest affected models unable to receive further security patches at all, the practical remedy for thousands of installed units across European retail is replacement rather than a fix — a costly and slow-moving answer to a vulnerability that, for now, keeps resurfacing one country at a time.