The key facts

  • The second wave of attacks on November 2 affected stores in seven countries; the first, on October 11 in France, hit about 700 of 10,000 supermarkets
  • The breach was carried out through internet-connected refrigeration controllers from Danfoss, Copeland and Dixell, whose vulnerabilities had been described back in August
  • No one has claimed responsibility, and no ransom demands or data theft have been recorded; the European Commission is checking retailers' preparedness

What happened

On the night of November 2 the refrigeration systems of supermarkets in Belgium, Luxembourg, Sweden, Ireland, Estonia, the Netherlands and Finland began to warm up: in some cases the temperature was simply raised, in others the defrost mode was switched on. This is the second wave of such attacks: on October 11, the refrigerators of French stores, including Intermarche, Netto, Cooperative U, Carrefour, Monoprix and E.Leclerc, were switched to defrost mode while the stores were closed. French Finance Minister Roland Lescure told the National Assembly that about 700 of the country's 10,000 supermarkets were affected. The Paris prosecutor's office opened a case into a 'large-scale cyberattack on connected refrigerators', mentioning food losses and fires. Both waves occurred at night, when there was little staff on the shop floor.

How the refrigerators are hacked

In large stores, refrigeration equipment is managed by a central controller that sets the temperature and defrost schedules for all display cases and cold rooms. Many such controllers are connected to the internet so that contractors can monitor them remotely. The French cybersecurity agency ANSSI reported 'numerous compromises' of remote controllers made by the Danish manufacturer Danfoss, and later of systems by the American company Copeland and its brand Dixell. Danfoss clarified that most of the affected devices are older models that no longer receive updates. The vulnerabilities had been documented before the attacks: in August, researchers at Claroty described flaws in one of the Danfoss models, including a hidden day code that allowed the administrator password to be bypassed, and using a public scanner they found more than 2,700 Danfoss systems accessible online. British researcher Kevin Beaumont wrote that 'you can simply log in and change the temperature — anyone can do it, and it is easily automated'. ANSSI noted that open access to management interfaces contradicts basic security practice.

Who is behind the attacks and is there a threat to the food

No one has claimed responsibility; no ransom demands or theft of customer data have been publicly recorded, so the motive remains unclear — ranging from deliberate sabotage and hacktivism to simple scanning of vulnerable systems. The industry center Food and Ag-ISAC notes that extortion groups often act opportunistically, and it records a 62% year-on-year increase in ransomware incidents in the food industry, but the authorities cannot yet link the supermarket attacks to a state, a criminal group or hacktivists. According to Anadolu, the Belgian federal prosecutor's office has opened a criminal case, and Sweden's National Cybersecurity Center is exchanging information with partners. EU Agriculture Commissioner Christophe Hansen said the Commission is checking retailers' preparedness, including backup systems and action plans. Officials say the food supply is not under threat: the main danger is warmed products reaching sale, which retailers, according to them, avoided by removing or destroying the goods. The main costs fall on the stores, many of which are independent: they lose their goods and pay for repairs; in some French stores, overheated equipment caught fire.