Attackers remotely tampered with refrigeration controllers at supermarkets in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia overnight into Monday, forcing stores to throw away fresh and frozen stock. Danfoss, whose equipment was involved, said its products were also used in an attack on hundreds of French supermarkets about three weeks earlier.
Controllers Switched to Defrost or Heated to 55 C
In Belgium, attackers pushed cooling units into defrost mode. Elsewhere they raised set points to roughly 50 to 55 C (122 to 131 F), and operators could not change them back. Ahold Delhaize warned store managers by SMS around 4 a.m., and companies confirmed the incidents during the day.
Counts of affected stores vary. One tally counted more than 115 stores across the six countries, while another account said no single chain reported more than several dozen affected stores. Nobody had claimed responsibility by Monday night, and it is not confirmed whether the attacks are linked to the French wave.
Belgium: Delhaize, Carrefour, Spar and Ikea
Belgium took the heaviest reported damage. About 40 Delhaize stores were affected, with Ahold Delhaize describing an IT incident at “several dozen” stores. Fifteen of Carrefour’s 700 Belgian stores were hit, along with Spar outlets (about five, according to Colruyt Group) and an Ikea store in Mons.
One store manager in Overijse called the impact “catastrophic” and discarded all fresh and frozen stock. A butcher in Hove estimated about 15,000 euros of meat was ruined.
Sweden, Ireland, Estonia and the Netherlands
In Sweden, ICA stores outside its central network were affected, connected to a Danfoss outside control system, as were 7 of more than 800 Coop stores. In Ireland, at least 13 SuperValu stores run by Musgrave pulled chilled and frozen goods, and Musgrave said the incident was resolved Monday afternoon. An Estonian Selver freezer was set to 50 C and corrected in about 10 minutes. In the Netherlands, at least 17 butcher shops and neighborhood stores were hit.
Danfoss Points to Default Passwords and Outdated Software
A Danfoss spokesperson said the affected Dutch systems were not on a secure network and still used default passwords, and that the weakness lies mainly in outdated software. Sabcobel, the refrigeration contractor for Delhaize, said attackers got into individual supermarkets’ systems rather than the contractor’s own, using the same vulnerability seen in similar attacks.
Danfoss’s advisory page listed no advisory as of Tuesday. The most detailed operator guidance remains an alert from France’s CERT-FR issued in October, after the French incident.
French Supermarket Wave Hit the Same Danfoss Equipment
The earlier attack on hundreds of French supermarkets used the same class of equipment. That precedent means the second wave did not rely on a new technique, and the continued presence of exposed controllers with default credentials explains why it could be repeated across borders in a single night.
Supermarket Chains Isolate Danfoss Systems and Bring In Refrigerated Trucks
Affected chains isolated or replaced compromised systems and moved stock into refrigerated trucks to save what they could. Dozens of stores lost fresh and frozen goods, and some operated with limited ranges while shelves were restocked. Musgrave reported restocking after resolving its incident.
Danfoss pointed customers to software updates and secure network configuration. Sabcobel had earlier advised stores to secure their internet connections.
Default-Password Danfoss Controllers Enable Physical Disruption
The incident shows how internet-exposed operational technology with default credentials and unpatched firmware can be used for physical-world disruption without any malware on corporate networks. Refrigeration controllers are rarely treated as high-value assets, yet changing a single set point can ruin a store’s fresh and frozen stock within hours.
The timing across six countries within one night suggests an automated sweep for reachable controllers rather than targeting of particular retailers. Smaller outlets such as butcher shops, which rarely have dedicated IT staff, appear on the list alongside large chains, and those operators are the least likely to know their equipment is reachable from the internet.
No attacker has been named, and the absence of a ransom demand in the reported details leaves motive unclear. Until Danfoss publishes an advisory, operators have only the October French alert and the company’s general guidance to work from.
