A new wave of cyberattacks disrupted refrigeration systems at more than 100 European stores overnight November 1–2, forcing retailers to discard spoiled food after attackers remotely raised freezer temperatures or activated defrost cycles. The incidents follow similar attacks on hundreds of French supermarkets in October and suspected sabotage of refrigeration equipment at U.S. military bases.

Retailers across multiple countries reported disruptions. According to Reuters, affected businesses included Delhaize and Carrefour stores in Belgium, Coop and ICA supermarkets in Sweden, and SuperValu stores in Ireland. Incidents were also reported in Luxembourg, the Netherlands, Estonia, Finland, Italy and Portugal. Some refrigeration systems reportedly reached temperatures of 50°C, destroying frozen inventory.

Internet-exposed refrigeration controllers are at the center of the investigation. France’s cybersecurity agency ANSSI identified Danfoss AK-SM and AK-SC series controllers, along with Copeland and Dixell XWEB systems, in an October security advisory following the earlier attacks. These systems allow operators and service providers to monitor and manage refrigeration equipment remotely.

The technical consequences may extend beyond software vulnerabilities. Stephan Moelans, CEO of Belgian refrigeration company Sabcobel, told the Belga news agency that attackers had forced refrigeration equipment into defrost mode and that software updates alone might not resolve the underlying weakness. According to SecurityWeek’s November 3 report, Moelans said affected installations also require physical modifications, although the specific equipment and scope of that requirement remain unclear.

Authorities are urging operators to isolate vulnerable systems. CERT-FR recommends removing refrigeration controllers from direct Internet exposure, securing remote connections through protected networks or VPNs, changing default passwords, and applying available firmware updates. The agency warns that older equipment no longer receiving security fixes remains vulnerable even after compromised configurations are reset.

Danfoss said it had advised customers on October 13 to disconnect exposed systems from the Internet. Security researchers have also identified publicly accessible management interfaces, while Dutch reporting indicated that some targeted equipment continued using default credentials. Officials have not publicly established a common intrusion method for every affected installation.

The European incidents follow attacks against hundreds of French supermarkets in October. In a separate investigation, CircleID previously reported that the Pentagon was investigating suspected cyberattacks affecting freezers at approximately six U.S. military commissaries. Subsequent reporting by Nextgov/FCW indicated that U.S. officials suspected Iran-linked hackers, although that attribution remains unconfirmed.

No perpetrator has been identified in the latest European incidents. Investigators have not established whether the attacks across Europe were coordinated or connected to the French and American cases. Belgium’s federal prosecutor’s office has opened an investigation, while affected retailers and equipment suppliers continue examining exposed systems and available remediation measures.