Supermarket Refrigeration Systems Hacked Across Europe

Executive Summary

On November 2, 2026, a second wave of coordinated cyberattacks targeted supermarket refrigeration systems across Europe, impacting retailers in at least seven countries including Belgium, Estonia, Ireland, and Sweden. Attackers remotely manipulated internet-connected refrigeration controllers, primarily from vendors Danfoss and Copeland, forcing them into a defrost mode or raising temperatures to as high as 50°C (122°F). This resulted in widespread food spoilage and significant financial losses, estimated in the tens of millions of euros. The incident mirrors a previous attack on French supermarkets, indicating a persistent campaign targeting the food supply chain. The vulnerability appears to stem from outdated software and the use of default credentials on insecure networks.

Threat Overview

The attack was a large-scale, synchronized event affecting major supermarket chains such as Ahold Delhaize, Carrefour, and ICA. The threat actors demonstrated a clear understanding of industrial control systems (ICS) used in the retail food sector. By targeting refrigeration controllers, they were able to cause direct physical damage—the destruction of perishable goods—through purely digital means. The attack vector likely involved scanning the public internet for exposed control systems and exploiting known vulnerabilities or weak credentials. The recurrence of this attack highlights a failure to remediate known issues after the initial incident in France, underscoring the challenges of securing operational technology (OT) in distributed environments.

Technical Analysis

The attackers specifically targeted internet-accessible refrigeration controllers. The primary TTPs appear to be:

• Initial Access: T0865 - Exploit Public-Facing Application. The attackers likely scanned for and exploited vulnerabilities in the web interfaces of Danfoss and Copeland controllers exposed to the internet.
• Initial Access: T0886 - Valid Accounts. A Danfoss spokesperson noted that systems with default passwords were at risk, suggesting attackers used brute-force or credential stuffing with default credentials.
• Execution: T0854 - Program Download or similar remote command execution on the controller's firmware to alter settings.
• Impact: T0822 - Inhibit Response Function. By forcing the units into defrost mode or setting unsafe temperatures, the attackers inhibited the primary function of the refrigeration system.
• Impact: T0826 - Loss of Productivity and Revenue. The direct consequence was the spoilage of food, leading to immediate financial loss and store disruption.

No specific malware has been identified, suggesting the attacks may have been carried out using built-in device commands and scripts after gaining unauthorized access.

Impact Assessment

The financial impact is substantial, with one Belgian butcher reporting a €15,000 loss and total damages across Europe expected to be in the tens of millions of euros, similar to the preceding French attack. Beyond direct financial loss, the attack has a significant operational impact, forcing store closures for cleanup and restocking. Strategically, it erodes consumer confidence in the food supply chain and demonstrates the fragility of critical infrastructure sectors that rely on interconnected OT/ICS devices. The European Commissioner for Agriculture has framed this as a deliberate attempt to destabilize the food supply, elevating it from a simple cybercrime to a matter of economic security.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) such as IP addresses, domains, or file hashes were mentioned in the source articles.

Cyber Observables — Hunting Hints

The following patterns could indicate related activity or vulnerable systems:

Detection & Response

• Network Monitoring: Implement robust network traffic analysis (D3-NTA) to detect anomalous connections to OT devices. Alert on any external IP addresses attempting to communicate with refrigeration controllers.
• Log Analysis: Centralize and monitor logs from controllers, firewalls, and VPNs. Look for multiple failed login attempts followed by a success, or logins from geographically impossible locations.
• Configuration Auditing: Regularly audit controller configurations for unauthorized changes, especially to temperature setpoints or operating modes.
• Response Plan: Isolate affected network segments immediately upon detection to prevent lateral movement. Engage with OT/ICS incident response specialists and preserve logs and device state for forensic analysis.

Mitigation

• Network Isolation: The most critical mitigation is to remove ICS/OT devices from the public internet. Place controllers behind a firewall on a segmented, private network. Access should be restricted via a secure VPN with Multi-factor Authentication (D3-MFA).
• Patch Management: Apply all security updates provided by Danfoss and other OT vendors immediately. Prioritize patching for internet-facing or critical systems.
• Credential Hardening: Change all default passwords on controllers and management systems. Implement a strong, unique password policy for all OT accounts.
• Vendor Guidance: Follow the specific security recommendations provided by Danfoss and Copeland following the initial attacks.