Supermarkets across Europe were hit by another round of suspected cyber incidents from late Sunday night into early Monday morning, Nov. 1 to Nov. 2, after refrigerated units were remotely set to higher temperatures, in some cases reaching 50 degrees Celsius. Several stores threw away food as a result. Bloomberg said the pattern looked similar to the France incident last month, and The Guardian counted impacts in at least seven countries.
Stores in at least seven countries reported disruptions
Reuters said 15 of Carrefour’s 700 stores in Belgium were affected. It also listed five Spar stores under Colruyt in Belgium and seven of Coop’s 800 stores in Sweden.
The Guardian reported that 15 Intermarché stores in Belgium were affected, along with 13 of SuperValu’s 223 stores in Ireland. In the Netherlands, at least 17 stores were hit, most of them small local outlets, citing Dutch public broadcaster NOS.
According to the Associated Press, Delhaize had dozens of affected stores, mostly in Belgium and a smaller number in Luxembourg. Not every company described the incidents the same way. Coop said someone made unauthorized changes to freezing equipment. Carrefour explicitly called it a cyberattack. ICA did not confirm that description. Delhaize referred only to an "IT incident," and Finland’s Kesko said it could not rule out an IT factor.
Belgian operator said the method matched the France case
Supermarket refrigeration is typically managed by a controller, a small computer that handles temperature settings and defrost cycles and can be accessed remotely by maintenance providers. A spokesperson for Danish refrigeration manufacturer Danfoss told Bloomberg that this latest wave involved the company’s products, just as in France in October.
Stephan Moelans, chief executive of Belgian operator Sabcobel, which manages Delhaize refrigeration systems, told Belgian news agency Belga that the attackers remotely switched units into defrost mode. Instead of cooling, the cabinets heated up. He said the method was "exactly the same" as in France.
CERT-FR had already warned about some Danfoss models
CERT-FR, part of France’s national cybersecurity agency ANSSI, issued an alert on Oct. 12 and updated it on Oct. 16, naming certain Danfoss models and warning that the attacks were "likely still ongoing." It said that if the machines remained connected to the internet and had not been patched, a factory reset alone would not be enough and they would "certainly be compromised again."
Bloomberg added that if the latest incidents were indeed cyberattacks, some of the affected machines may have been running legacy software that could not be updated, leaving remediation incomplete.
Many affected systems were outside centralized protection
Several of the incidents involved smaller stores or older equipment that fell outside central security controls. Petri Käyhkö, head of corporate security at Kesko, told Bloomberg that the affected small-store systems were not covered by centralized protection. Estonian supermarket chain Selver told local public broadcaster ERR that the affected location was the company’s only store still using an older Danfoss controller.
The Guardian also said Coop had indicated that some refrigerated units were connected over 4G mobile networks, which left them more exposed.
No claim of responsibility, and no country has been officially named
No one has claimed responsibility so far, and no government authority has publicly named any country. European Commissioner for Agriculture Christophe Hansen described the incidents as a deliberate attempt to disrupt the food supply chain and undermine consumer confidence. Katrien Eggers of Belgium’s Center for Cybersecurity told Reuters: "At this point, we do not know who is behind this, and we may never find out."
Tom Hegel, a researcher at cybersecurity firm SentinelOne, told Reuters there was no ransom demand, making the activity look more like sabotage. He also said that logging into the control panel from outside leaves almost no trace.
Reuters also pointed to similar cases at U.S. military bases
Reuters, citing four informed officials, said the Pentagon treated freezer failures at military bases in late August as suspected hacking incidents, with at least six commissaries affected. Fort Huachuca in Arizona wrote on Facebook on Aug. 26 that a freezer had "gone into defrost mode and heated all the food." The Pentagon has not publicly confirmed that hackers were responsible.
