Cyberattacks Warm Supermarket Refrigeration Systems Across Europe

Refrigeration systems at supermarkets across Belgium, Sweden, Estonia, and other European nations were remotely compromised overnight November 1-2, with attackers altering temperature controls to warm stored food. Some systems were switched into defrost mode—causing them to heat rather than cool—while others had temperatures raised to 50°C. Food losses reached thousands of euros at some locations. The incidents appeared limited in immediate scale, with individual chains reporting no more than several dozen affected stores, though the pattern echoed attacks on French supermarkets three weeks earlier. Whether the incidents were coordinated remains unclear.

Attacks compromised refrigeration control systems from Danfoss and Copeland. A consistent vulnerability pattern emerged: older systems with unpatched firmware, direct internet connectivity, and unchanged default passwords. Many retailers had disregarded hardening measures recommended after the French campaign. Attackers breached individual store systems rather than contractor networks, pointing to weak internet-facing configurations rather than sophisticated network attacks. Equipment no longer receiving security updates proved especially vulnerable.

Authorities across affected countries are investigating, but Belgian officials acknowledge the perpetrators may never be identified and no group has claimed responsibility. The incidents underscore entrenched weaknesses in operational technology security: organizations failed to implement basic protections despite warnings from the French attacks mere weeks prior. Recommended mitigations—isolating systems from the public internet, requiring VPN access for remote management, and firmware updates—represent significant operational and financial burdens that many retailers have not yet embraced.