Supermarket freezer attacks spread across Europe in second wave

A second wave of suspected cyberattacks on supermarket refrigeration hit multiple European countries in the early hours of Monday, November 2, remotely raising freezer temperatures and spoiling stock. It follows the French incident three weeks earlier, where attackers forced defrost cycles at hundreds of stores. No group has claimed responsibility, and no agency has named a perpetrator.

The account here is from Recorded Future News, with Belgian and Dutch detail corroborated by broadcaster NOS and installers quoted in local reporting.

Who was hit

• Belgium: more than 50 stores identified, spanning Carrefour, Intermarché and Spar locations.
• Sweden: a limited number of smaller stores under the ICA group. One manager described freezers blowing hot air — "Everything is ruined."
• Ireland, Estonia, the Netherlands, Luxembourg: over a dozen other stores combined. In Estonia, a contractor said attackers reached "an older Danfoss system."

Retailers report set-points pushed as high as 50°C. Distribution centres and deliveries were not disrupted.

What's affected

No single product is confirmed across every incident. Reporting points to legacy Danfoss refrigeration controllers, with Dutch broadcaster NOS reporting Copeland equipment also targeted in Belgium. The common thread, as in France, is a management interface exposed to the internet on controllers that are often discontinued and no longer patched. Sabcobel, a Belgian installer, said about 20 of the units it manages were affected and that fixing them needs physical modifications, not just a software update.

Attribution

Unattributed. Katrien Eggers of the Centre for Cybersecurity Belgium said it "is not known who is behind this attack, and it may never be possible to identify them." The CCB linked the rise in such incidents partly to AI but said it does not yet know whether AI was used here — a hedge worth keeping; there is no evidence tying these attacks to automated tooling.

Action checklist

1. Get refrigeration and building-automation controllers off the public internet. This is the single control that would have stopped both waves. Front them with a VPN; never expose the management UI directly.
2. Inventory Danfoss (AK-SC / AK-SM), Copeland xweb and Dixell xweb units — the families cited in the French incident — and check firmware against vendor status.
3. Treat end-of-service controllers as unpatchable risk. Danfoss says many affected devices are discontinued; if it can't be patched and must stay online, isolate it on a segmented OT network.
4. Alert on out-of-band set-point changes in your refrigeration telemetry so a forced 50°C write pages someone before the stock thaws.

Context

The pattern is now hard to miss: France (~700 victims per the Paris prosecutor), then a six-country European wave, with US investigators separately probing freezer failures at six military installations. These are not high-end intrusions — they are internet-exposed OT with weak or absent authentication, hit at scale. The EU's Cyber Resilience Act will force longer support obligations from December 2027; until then, vendors face no legal duty to fix the discontinued controllers doing the spoiling.