Supermarket Refrigeration Cyberattacks in Europe: the Second Wave and the Lesson for OT

According to The Hacker News, a new wave of supermarket refrigeration cyberattacks in Europe left fridges and freezers warm in the early hours of Monday 2 November, which store managers in several countries found on opening [1]; in a shop in southern Sweden, according to BleepingComputer and The Record, the equipment had been set to 50 °C [3][4]. Weeks earlier, on the night of 11–12 October, hundreds of French supermarkets had been attacked, according to SecurityWeek [2]; no link between the two episodes has been established.

The damage is visible and is measured in product thrown away. The authorities have not publicly explained how the attackers got in or identified those responsible; the sources describe refrigeration controllers exposed to the internet and update problems.

A new wave of incidents, with no established link to France

According to SecurityWeek, shops in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden saw the temperature of their equipment rise between Sunday and Monday, and, according to the press, problems were also reported in Finland, Italy and Portugal [2]. BleepingComputer, which gathered confirmations from spokespeople at several chains, puts the count above a hundred establishments [3]. The profile of those affected is very varied: SecurityWeek describes a range running from large chains to small butcher shops [2].

Danfoss appears in several of the cases, although attacks against Copeland equipment were also reported in Belgium, according to The Record [4]. The Hacker News reports that Danfoss, the Danish manufacturer of refrigeration controls, acknowledged that its products were involved, as in the October attacks on French supermarkets [1]. The same outlet notes that some establishments had to throw away chilled and frozen food or pull it from sale [1].

The impact does not stop at large stores. Reuters reports the case of De Laet & Van Haver, a butcher shop in Hove, near Antwerp, whose owner told Reuters that around 15,000 euros of meat was destroyed [7]. For a small business, a controller tampered with for one night is not an IT incident: it is a loss of stock that can be seen and has to be paid for.

What is known and what still has no public answer

It is worth separating confirmed facts from what is still speculation. According to The Record, retailers and equipment suppliers describe what happened as a cyberattack [4], and The Hacker News specifies that the attackers changed the settings of the refrigeration controls remotely [1]. In Belgium, according to the refrigeration firm Sabcobel as reported by BleepingComputer, defrost functions were activated which, instead of clearing the ice, made the equipment heat up [3].

Beyond that, the answers run out. Nobody has claimed responsibility for the attacks, as The Hacker News and SecurityWeek agree [1][2], and investigators have not established whether the two waves are connected [2]. BleepingComputer adds that it is unclear whether this was a coordinated attack or targets hit one by one [3]. The Record stresses that no police force or public agency has identified those responsible [4].

On the method of access there is no official explanation. SecurityWeek states that the authorities have not publicly explained how the attackers got in [2]. Any account of the entry vector should, for now, be treated as a hypothesis.

A refrigeration controller is an industrial computer inside a shop

To understand why this matters beyond the news, you have to look at the equipment that was attacked. The Hacker News describes it plainly: refrigeration controls are computers that run fridges and freezers, and they can be connected to the internet so that the refrigeration engineer can monitor them and fix faults remotely [1]. Industrial Cyber frames the attacks as a demonstration of the weaknesses of connected OT systems and recalls that, unlike an attack on information systems, here the consequences are physical and immediate [5].

In some documented cases, this equipment was outside the retailer's protections or core network. The sources document cases of equipment outside the retailer's protections or core network, but they do not describe who buys it or how it is inventoried. The Hacker News reports, without naming the companies here, that in some cases the affected equipment was outside the retailer's central protections or connected to a network separate from the corporate one [1].

The exposure, moreover, was known. According to Censys, on 11 October, before the attacks in France, there were 1,825 Danfoss StoreView instances reachable from the internet in that country, and on 2 November just over 1,000 worldwide [8]. This is a figure from a single source and does not prove that it was the entry vector, but it sketches the problem well: management equipment reachable from the internet. To address these risks, what has been learned about how to protect a connected facility against cyberattacks may help.

The patch depends on a chain of manufacturer, installer and maintainer

If the equipment is still exposed and unpatched, the useful question is not only a technical one. In our analysis, when a controller is out of date it is worth establishing who installed it, who maintains it remotely, who decides to update it and who answers if it fails. The sources themselves show how tangled that chain is. According to The Hacker News, the head of the Belgian refrigeration firm Sabcobel explained that a software update is not enough, because the installations need physical changes that cost money [1].

We have to be precise about what is not known. The sources do not establish that access took place through a remote maintainer. Published accounts of the point of entry differ and there is no official confirmation.

What can be done is to demand accountability before the next incident. In practice, it is worth requiring providers and maintainers to supply an inventory of the equipment they manage, remote access with strong authentication and a log of every connection, and update responsibilities fixed by contract. This is the ground covered by supplier and third-party risk management.

Regulation will reach manufacturers, but installed equipment will still be there

The European framework is moving, though slowly for this problem. According to The Record, the EU's Cyber Resilience Act will impose stricter requirements on these products from December 2027, when manufacturers will have to offer a support period in line with the product's expected life; the outlet adds that, at the time of its reporting, there were no legal obligations for manufacturers to fix the products targeted in these attacks [4]. The Record also reports that Danfoss applied an end-of-life policy to older products, citing recent European legislation [4].

That date leaves an obvious gap: the already deployed estate, with end-of-life devices that will receive no further updates, will depend on how each operator manages it. It is worth confirming with legal counsel which rules apply to your organisation and, where relevant, reviewing the NIS2 requirements for the industrial and OT sector.

Knowing which equipment is exposed is the control you can apply now

There is no need to wait for attribution before acting. The CERT-FR alert, from the response team of the French agency ANSSI [6], remains the most detailed guidance for operators, according to The Hacker News, and it stresses that unsupported equipment left on the internet is very likely to be compromised [1]. Based on that alert and on what the sources report, the reasonable steps are:

1. Inventory the refrigeration controllers and the store management systems, including those managed by a third party.
2. Check which ones are reachable from the internet and cut that exposure, first consulting the contract with the refrigeration firm and the insurance policy.
3. Verify with the manufacturer the version, the patch status and whether the equipment is still supported; change factory-default passwords.
4. Review and restrict third-party remote access, limiting it to a VPN or protected network with connection logging.
5. Prepare a manual contingency procedure to monitor temperatures and protect the product if the controller stops being reliable.

The underlying idea is simple: an internet-connected refrigeration controller is an OT asset with physical impact; it is worth applying controls for inventory, updating and remote access. It has to be inventoried, patched or replaced, and its governance demanded from whoever maintains it, without waiting to learn who attacked or how. If you want to organise that work in your organisation, you can see how we approach industrial OT security.