British businesses caught in Europe-wide supermarket fridge attacks

For the second time in a month, someone has reached into the computers that keep Europe’s groceries cold and switched them toward warm.

Stores found the damage on the morning of Monday, Nov. 2. An ICA Kvantum in Sjöbo, in southern Sweden, posted that its refrigerators and freezers had been hacked and set to 50 C. Staff there emptied freezers and loaded frozen goods into shopping carts to be thrown away.

By Tuesday the incident was well beyond a few stores. Italy’s government held emergency talks with intelligence chiefs after attacks on supermarket freezer systems hit at least 11 European countries. Stores in at least 10 EU countries, including Germany, Italy and the Netherlands, have had to throw out food, and the U.K. has also been affected.

The damage

The incidents were mostly small, but there were a lot of them:

• Belgium and Luxembourg: Delhaize said an “IT incident” affected refrigeration in several dozen stores, mostly in Belgium and a few in Luxembourg. Carrefour said 15 of its more than 700 Belgian stores were hit. Colruyt Group, which runs Spar stores in Belgium under a franchise system, said five shops were attacked, and IKEA said one Belgian store was affected. At a butcher shop south of Antwerp, the owner found his fridges set as high as 18 C and estimated about €15,000 of meat was ruined.
• Sweden: Coop said seven of its 800 stores had their refrigeration tampered with, and named Danfoss among its suppliers. The chain said Tuesday the stores were back to normal and that the equipment had been connected over old 4G mobile networks.
• Ireland: Musgrave said 13 SuperValu stores were affected, and that the incident was limited to one specific refrigeration model. Justice Minister Jim O’Callaghan was briefed, and the National Cyber Security Centre was monitoring the situation.
• Italy, Germany and Romania: Around 20 Italian stores were reported hit, including four of 300 Coop supermarkets run by one Sicilian operator. Four stores were hit in Germany and six outlets in Romania.

How the attackers got in

The tactic is crude but it works. In Belgium, Stephan Moelans, CEO of the refrigeration contractor Sabcobel, which maintains Delhaize’s systems, said attackers switched cooling units into defrost mode. Defrost is normally a short heating cycle that melts ice off the coils. Left running, it cooks the case.

The equipment is the same kind that was hit in France. France’s CERT-FR named the targets in alert CERTFR-2026-ALE-012: Danfoss AK-SM and AK-SC controllers, plus Copeland and Dixell xweb units. Danfoss told AFP the affected models are the AK-SM 800, end of life since May 2021, and the AK-SC 355, phased out in 2016. Neither model gets security fixes anymore.

Danfoss says the affected Dutch units still used default passwords, and that the method matched the French attack. One security researcher, quoted by the Associated Press, said none of this required a zero-day. The attackers got in through internet-facing controllers, end-of-life firmware and default passwords.

There are plenty of these devices to find. Security firm Forescout recently counted nearly 13,000 refrigeration control services openly reachable online in 99 countries.

Who’s behind it?

Nobody has said. Officials don’t agree on how serious the attacks are. EU food and agriculture commissioner Christophe Hansen called them a deliberate attempt to disrupt the food supply chain. Romania’s Dan Cimpean, director of the country’s National Cyber Security Directorate, disagreed. He told reporters, “We do not suspect, under any circumstances, that it is a state actor.”

Belgian federal prosecutors have opened a criminal investigation. The U.S. has also had similar incidents. NPR reports that U.S. military bases had freezer outages in August, and that the Pentagon’s criminal investigators are working with French law enforcement. Two former officials told NPR some evidence points toward Iran, but confidence in that attribution is low. A similar method does not prove the same people carried out every attack.

Why Canadian grocers should pay attention

There are no public reports of Canadian stores being affected. Canadian grocers use the same kind of equipment, though. Danfoss has sold into Canada for more than 70 years, and there is no public data on how many Canadian grocers run the affected controllers. Insurance is a second problem. Spoilage cover on commercial property policies is usually built around power failures or equipment breakdown, and insurers have been tightening cyber exclusions. A walk-in cooler of spoiled meat could fall between a property policy and a cyber policy, with neither paying.

Regulators in Europe recommend these steps:

1. Get controllers off the open internet. Allow remote access only through a VPN or a protected network. CERT-FR also advises checking your insurance contract before cutting the data feed to your refrigeration contractor.
2. Check the configuration, especially defrost schedules and temperature setpoints.
3. Change default passwords and, on supported Danfoss units, set the security level to Strict. Danfoss fixed three vulnerabilities in the AK-SM 800A in firmware R4.3.1 and tells operators to upgrade to that version or later.
4. Replace end-of-life controllers. CERT-FR warns that unsupported devices left online are very likely to be compromised again, even after a factory reset.