Security Incidents

Second Wave of Cyberattacks Hits European Supermarket Freezers as End-of-Life Refrigeration Controllers Remain Exposed

Attackers remotely pushed supermarket freezers to 50°C (122°F) across six European countries, weeks after a similar campaign in France, exposing the risk of unsupported, internet-facing OT in retail cold chains.

Summary

  • A second wave of suspected cyberattacks hit supermarket refrigeration systems across Europe overnight on 1–2 November 2026, with freezers remotely pushed to temperatures as high as 50°C (122°F) and stock destroyed.
  • Belgium was hardest hit, with more than 50 stores identified, including Delhaize, Carrefour and Spar locations. Stores in Sweden (ICA, Coop), Luxembourg, Ireland, Estonia and the Netherlands were also affected.
  • The attack follows an October wave in France in which internet-exposed refrigeration controllers at hundreds of supermarkets were compromised; the Paris prosecutor’s office put the victim count at around 700.
  • Attackers reportedly abused the units’ built-in defrost function, overriding normal temperature and duration limits. Equipment from Danfoss, Copeland and Dixell has been linked to the campaign, much of it discontinued and no longer receiving security updates.
  • No group has claimed responsibility, and no government or law enforcement agency has attributed either wave.

Same playbook, wider footprint

Three weeks after France’s cybersecurity agency ANSSI warned about attacks on supermarket refrigeration controllers, the same technique has spread across at least six countries. Belgian refrigeration installer Sabcobel said the attack began around midnight on Sunday and that its technicians worked through the night to disconnect affected units from the network. A Swedish store manager reported that staff were unable to bring temperatures back down, and that the freezers were effectively ruined.

Reporting from Belga indicates the attackers switched evaporators into defrost mode, warming the cabinets. ICA said only a small number of its stores were affected, specifically those whose connections sat outside its central network. That detail matters: the stores hit appear to be the ones where refrigeration management was reachable from the internet rather than routed through controlled corporate infrastructure.

End-of-life OT, left online

The common thread is legacy building and refrigeration control equipment with internet-exposed management interfaces. An Estonian contractor said the attackers accessed an older Danfoss system, while Dutch broadcaster NOS reported Copeland equipment was also targeted in Belgium. Following the French incident, both vendors said the affected devices were mainly discontinued products that no longer receive security updates. Security researcher Kevin Beaumont noted that many affected freezers are end-of-life, with no patch available, yet remain online.

Remediation is not a simple software push. Sabcobel’s CEO said the fix requires physical modification of the units, not just an update. In the interim, the guidance has been to move management traffic onto a secured connection, which many French operators did after the first wave. The second wave suggests that advice did not travel across borders quickly enough.

A regulatory gap that won’t close until 2027

Under current rules, manufacturers have no legal obligation to fix products targeted in attacks like these. The EU Cyber Resilience Act will impose stricter security requirements on connected products, but those obligations do not apply until December 2027. Danfoss had already announced a “hard End of Service” policy for legacy products in October 2025, citing new European cybersecurity legislation and the legal obligations continued support would bring. The result is a population of connected controllers that vendors have stepped away from and operators have not replaced.

This is not the first time these controllers have been abused. Danfoss has previously referenced attacks on its controllers in Russian supermarkets at the start of the invasion of Ukraine, and an incident affecting 40 stores in Israel that it said lacked adequate firewall or VPN protection.

Why it matters

This campaign is a clear demonstration of cyber-physical impact at scale: no data was stolen, no ransom has been demanded, yet retailers have lost large volumes of perishable stock and suffered operational disruption in a single night. The attack surface was not the corporate network, but facilities equipment that often sits outside the CISO’s asset inventory and is managed by third-party installers. For any organisation running cold chain, HVAC, building management or other operational technology, the lesson is that end-of-life devices with internet-reachable management interfaces are now being targeted systematically and across borders. Until the Cyber Resilience Act takes effect, the burden of securing these devices sits with the operator, not the manufacturer.

What to do now

  • Inventory all refrigeration, HVAC and building management controllers, including those installed and maintained by third-party contractors, and identify any with management interfaces reachable from the internet.
  • Remove direct internet exposure immediately. Route remote management through a VPN or secure remote access gateway with MFA, and restrict access to known contractor endpoints.
  • Identify end-of-life and end-of-service controllers from Danfoss, Copeland, Dixell and other vendors, and build a funded replacement plan rather than relying on patches that will not arrive.
  • Review contracts with facilities and refrigeration service providers to set clear security obligations for remote access, monitoring and incident notification.
  • Add OT and facilities alarms, such as abnormal temperature changes or unexpected defrost cycles, to security monitoring so physical anomalies trigger an incident response, not just a maintenance ticket.
  • Review ANSSI alert CERTFR-2026-ALE-012 and share its indicators and guidance with operations and facilities teams.

Sources

Related Posts