Supermarket managers in at least seven European countries started Monday, November 2, by throwing away food. Overnight, refrigeration units in dozens of stores had been switched into defrost mode remotely, and temperatures inside freezers rose until stock could no longer be sold. It is the second wave of attacks on store refrigeration in a month. The first hit hundreds of French supermarkets on October 12. No group has claimed responsibility for either.
The attacks are a reminder that some of the most damaging cyber incidents now target equipment few compliance teams have ever listed in a risk register: connected building and plant controllers that are managed remotely by outside service companies.
What happened on Monday
According to the BBC, around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, with smaller numbers of stores hit in Sweden, Ireland, the Netherlands, Estonia and Finland. Belgian refrigeration company Sabcobel, which manufactures some of the affected units and operates Delhaize’s refrigeration systems, said the evaporators were switched to defrost mode, causing them to warm up, in what is believed to be the same method used in France.
Other chains confirmed problems to reporters. Coverage by Belgian media, Euronews, NBC News and BleepingComputer, taken together, reported:
- Belgium: affected stores included about 40 Delhaize locations, 15 Carrefour stores, around 15 Intermarché stores and five Spar locations operated under Colruyt, with Belgian media putting the national total at about 75 stores. Carrefour said the impact was “extremely limited,” affecting 15 of its more than 700 stores.
- Sweden: stores of ICA and Coop reported freezers set to as high as 50 degrees Celsius.
- Ireland: 13 SuperValu stores were affected by a suspected cyber incident, according to owner Musgrave.
- Netherlands: a spokesperson for equipment maker Danfoss said the cooling systems of at least 17 companies were attacked.
- Estonia: one Selver store reported a similar incident.
Belgium’s Centre for Cybersecurity said it was aware of an incident targeting supermarket refrigeration systems but had no further information. Counts from different outlets do not line up exactly, and some stores may have been double-counted or missed, so the totals should be treated as provisional.
Stephan Moelans, Sabcobel’s chief executive, told the Belga news agency the company had been “working all night and morning to disconnect the affected units from the network.” He said Sabcobel had been working since the French attack to protect customers’ units against the vulnerability, but that a software update alone was not enough and the equipment needed physical modifications. “That requires investment,” he said. “The simplest solution is to manage the fridges over a secure internet connection. Most of our customers switched to that after the attack in France.”
The French precedent
On the night of October 11 to 12, attackers took control of refrigeration controllers at stores belonging to several French chains, including Coopérative U, Intermarché and Leclerc. The Associated Press later reported that about 700 French stores were affected. Coopérative U’s president, Dominique Schelcher, said on RTL that 80 of the group’s roughly 2,000 stores had been hit, that most were able to stop the attack before the cold chain broke, and that losses where it did break ranged from tens of thousands of euros in a small store to as much as 180,000 or 200,000 euros in a hypermarket, as reported by Capital. The Paris prosecutor opened a criminal investigation, and Prime Minister Sébastien Lecornu asked the national cybersecurity agency, ANSSI, to investigate.
On October 12, France’s government CERT issued an alert saying it was aware of numerous compromises of remote controllers for refrigeration installations, naming Danfoss AK-SM and AK-SC series devices and Copeland and Dixell XWEB supervisors. Its central point was blunt: exposing a management interface directly to the internet is contrary to good practice. The agency told operators to remove internet exposure, check defrost schedules and configurations, restore access only through a secure VPN or protected network, update firmware, enable strict security settings and change default passwords. It warned that attack campaigns were probably still under way and that simply factory-resetting an unpatched, internet-exposed device would leave it vulnerable to being compromised again.
Why this is a governance problem
Refrigeration controllers are typically installed and maintained by specialist contractors who need remote access to monitor temperatures and fix faults. That access is often provided through an internet-facing web interface on the controller itself. The result is a piece of operational technology, owned by the retailer, configured by a contractor and reachable by anyone who finds it. The French alert even advised operators to check their insurance terms before cutting the data link to the refrigeration contractor, a sign of how deeply that remote connection is built into commercial arrangements.
This is the same pattern privacy and security teams see with web trackers and SaaS integrations: a third party’s access becomes the organization’s exposure. Our guidance on audit requirements in third-party risk management and the third-party risk assessment checklist both apply here, even though the “vendor” maintains freezers rather than software.
What retailers and other operators should do now
- Find every internet-exposed controller. Refrigeration, HVAC, lighting, access control and energy management systems should be inventoried, and any management interface on a public IP address should be taken off it.
- Route contractor access through controlled channels. Replace direct web access with VPN or a managed remote-access service with individual accounts, multi-factor authentication and logging.
- Check configurations, not just availability. In both waves, the attackers changed settings such as defrost cycles. Compare current configurations against a known-good baseline.
- Review contracts. Make contractors’ security obligations explicit: patching, credential management, notification of incidents and responsibility for losses.
- Plan for physical fixes. Sabcobel’s chief executive said software updates alone were not enough for some units. Budget for hardware replacement where devices are end-of-life.
Broader frameworks help structure the work. Our overview of cybersecurity compliance frameworks and the UK regulator’s thinking in the ICO’s IoT guidance are useful starting points, and NIST’s work on device security, which we summarized in our piece on NIST guidelines for connected devices, sets out baseline expectations that apply well beyond consumer products.
The regulatory angle
Whether these incidents trigger formal reporting duties depends on the company and the country. The EU’s NIS2 directive covers some food businesses, mainly wholesale distribution and industrial production and processing, and managed ICT service providers, with the exact scope set by each member state’s transposing law. The EU Cyber Resilience Act’s duty on manufacturers to report actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements began applying on September 11, 2026. Personal data is unlikely to be central to a freezer attack, but the remote-management platforms that control these units can hold staff accounts and contact details, so data protection teams should check whether any personal data was accessed before concluding that breach rules do not apply.
Captain Compliance’s assessment and vendor review workflows can help document which contractors have remote access to which systems and what risk decision was made about each. They cannot secure a device, and no platform can guarantee that operational technology will not be compromised.
Frequently asked questions
Who is behind the attacks?
No one has claimed responsibility, and authorities in France and Belgium have not attributed the incidents. Investigators believe the November attacks used the same mechanism as the October attacks in France.
Was customer data stolen?
There are no public reports of customer data theft. The visible damage was spoiled food and lost sales.
Which equipment was affected?
The French CERT alert named Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB supervisors. Reports on the November wave did not name every device model involved.
Is a software patch enough?
Not always. Sabcobel said some units require physical modifications, and the French CERT warned that unpatched, end-of-life devices left on the internet would very likely be compromised again.
What happens on the next cold night
The October attacks gave European retailers and their contractors three weeks of warning. Many used it, according to Sabcobel, by moving remote management onto secure connections. Monday’s wave shows that “most” is not “all,” and that the gap between a vendor’s advice and an operator’s budget is now measured in dumpsters of spoiled food. The next decision for many chains is whether to pay for hardware upgrades now, or to keep paying for each overnight attack.
