A new wave of cyberattacks has disrupted refrigeration systems at supermarkets across Belgium, Luxembourg, and Sweden, just weeks after a similar incident in France led to widespread spoilage of chilled and frozen food.
Belgian retailers including Delhaize, Carrefour, and Spar were among those impacted after attackers remotely manipulated refrigeration controls, reportedly forcing evaporators into defrost mode and causing temperatures inside fridges and freezers to rise. Industry experts say the attack mirrors the large-scale campaign that affected hundreds of French stores in October.
According to refrigeration equipment provider Sabcobel, the incident began around midnight on Sunday. The company said technicians immediately worked to isolate affected systems from their networks. Although many organizations strengthened security following the French attacks by moving refrigeration management to more secure internet connections, experts warned that software updates alone may not fully address the underlying vulnerability, with some systems requiring hardware modifications.
The disruption extended beyond Belgium. Delhaize locations in Luxembourg were affected, while Colruyt and Intermarché acknowledged technical issues at some stores without publicly attributing them to a cyberattack. In Sweden, retailers Coop and Ica also reported incidents, with some refrigeration units allegedly reaching temperatures as high as 50 degrees Celsius. An Ica spokesperson said only a limited number of stores operating outside the company’s central network were impacted.
Investigators believe the attacks exploit weaknesses in internet-connected refrigeration monitoring and management systems. French cybersecurity authorities previously linked the October incidents to vulnerabilities in refrigeration control platforms manufactured by Danfoss, Copeland, and Dixell. Attackers were able to remotely access exposed management interfaces and alter operating settings, rendering refrigeration systems ineffective and causing food losses.
Security researcher Kevin Beaumont said the newly affected systems appear to share the same internet-facing vulnerability identified during the French attacks. He noted that many refrigeration units remain online despite reaching end-of-life status and, in some cases, no longer receiving security updates, leaving operators with limited options for remediation.
The latest incidents highlight the growing risks associated with operational technology and internet-connected industrial control systems. As more critical infrastructure relies on remote management capabilities, organizations are facing increasing pressure to identify exposed devices, apply available patches, and replace unsupported equipment before attackers exploit known weaknesses.
Make the description more conciseAdd a defender-focused sectionFormat the IOCs as a table
AllPeoplePeopleFilesFilesMeetingsMeetingsEmailsEmails
