Supermarket refrigeration systems across Europe malfunctioned overnight Monday, with stores in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden reporting problems. In Estonia, some units were pushed to 50°C.
No group has claimed responsibility for the incidents.
France was the first known large-scale case
The earliest known outbreak in this sequence was reported in France. On Oct. 13, French Finance Minister Roland Lescure told Parliament that about 700 of the country’s 10,000 supermarkets had been affected.
According to CERT-FR, attackers forced refrigeration equipment into a continuous defrost cycle. That spoiled food and triggered fires at some stores. The agency said it was aware of numerous compromises involving remote-control modules made by Danfoss and Copeland.
Groupement Mousquetaires, owner of Intermarché and Netto, said 300 stores were affected. Cooperative U said 80 of its 2,000 shops were hit. Lescure said food supplies were not at risk, but added that the attack “touches the heart of our food security.” Some Mousquetaires display cases were still out of service on Tuesday.
Monday’s disruption spread across more countries
In Belgium, Carrefour said about 15 of its 700 stores saw disruption. Belgian refrigeration contractor Sabcobel said evaporators had been switched into defrost mode, and federal prosecutors opened an investigation. In Luxembourg, four Delhaize outlets also reported problems.
Italy’s Radenza Group, which operates Coop-branded stores in Sicily, said the attack began at 4 a.m. local time and targeted the remote-control system for frozen food sections. In Ireland, Musgrave said 13 SuperValu stores were affected. In Portugal, Mosqueteiros confirmed incidents at seven Intermarché stores.
In Sweden, Coop said six of its roughly 800 stores were hit and that those locations ran on 4G connections, making them “more exposed.” Ica said a limited number of stores had problems and that the affected shops used an external Danfoss control system. Neither company confirmed a cyberattack. Finland’s Kesko said network interference had not been ruled out.
EU official calls it a deliberate attempt
EU Agriculture Commissioner Christophe Hansen described the incidents as a “deliberate attempt” to disrupt the food supply chain. Investigators have not said whether Monday’s wave is linked to the earlier French attack.
Estonian refrigeration company Kitman Coldtech said the affected units were older Danfoss models similar to those targeted in France. CERT-FR warned that end-of-life devices left exposed to the internet without security patches carry a very high risk of compromise.
Known flaws and current mitigation steps
Researchers at Claroty disclosed vulnerabilities in Danfoss AK-SM 800A controllers in August, including an authentication bypass. Claroty said it found 2,765 of those devices exposed online, and Danfoss fixed the flaws in firmware R4.3.1.
It remains unclear which weaknesses were used in the attacks. CERT-FR said the campaigns were probably still ongoing, while Italy’s government was set to hold a cybersecurity meeting on Tuesday.
For now, CERT-FR is advising operators to remove the controllers from the public internet. Sabcobel’s CEO said many older units require physical modifications, which means additional investment. Until that work is done, the oldest systems do not have a practical fix.
