Key points:
- A second cyberattack has hit supermarket refrigeration systems in at least six European countries.
- In Belgium, around 75 stores were affected, including Delhaize, Carrefour and Intermarché shops.
- The attackers switched equipment into defrost mode or set it to high temperatures, destroying stock.
- The method is the same as in the attack on around 700 French supermarkets on 11–12 October.
- The French cybersecurity agency warned that remote controllers exposed to the internet are at high risk.
Six countries hit
The attacks were reported on 2 November. According to Euronews, in Belgium they took place between Sunday night and Monday morning and affected around 75 stores, including:
- around 40 Delhaize Proxy stores,
- 15 Carrefour Shop & Go stores,
- 15 Intermarché shops,
- five Spar shops at Q8 petrol stations,
- the IKEA store in Mons.
Carrefour Belgium said 15 of its 700 stores were affected, none of them hypermarkets, and that the impact was “very limited”. All stores remained open. Belgium’s federal prosecutor has opened an investigation.
In Sweden, ICA and Coop stores were hit, with fridges and freezers reportedly set to 50°C. In Ireland, Musgrave said 13 SuperValu stores were affected. Stores were also hit in the Netherlands, Finland and Estonia, while Delhaize suspended its ordering systems in Luxembourg as a precaution.
The same method as in France
The first wave hit France on the night of 11 to 12 October. According to Finance Minister Roland Lescure, around 700 of the country’s 10,000 supermarkets were affected, including Intermarché, Netto, Coopérative U, Carrefour and Monoprix stores, as reported by the Associated Press. Lescure said the attack “touches the heart of our food security”.
According to Spain’s national cybersecurity institute INCIBE-CERT, some units reached 50°C for several hours. Stores had to throw away fresh and frozen food, small fires broke out in some locations, and losses reached tens of millions of euros.
In both waves, the attackers took control of remote management systems for refrigeration. Stephan Moelans, CEO of Belgian refrigeration company Sabcobel, said the evaporators were switched to defrost mode, the same mechanism as in France. In his view, a software update alone is not enough and physical changes to the installations are also needed.
Old software, open to the internet
The French cybersecurity agency’s CERT-FR alert lists remote controllers from Danfoss, Copeland and Dixell among the affected devices. It warns that keeping an end-of-life device exposed to the internet without security patches makes compromise “very likely”, and that exposing a management interface to the internet goes against good security practice.
Danfoss said that most of the affected systems were older products no longer receiving security updates. It advised customers to keep systems updated and to run them behind a firewall.
A warning for cold chain operators
The attacks targeted supermarkets, but the same type of remote-controlled equipment is used in cold stores, distribution centres and other temperature-controlled logistics sites. CERT-FR recommends that operators:
- remove internet exposure from refrigeration controllers,
- check the full configuration, including defrost schedules,
- allow remote access only through a secure VPN or protected network,
- update firmware and change default passwords.
CERT-FR also warns that a factory reset alone is not enough, as the device will remain vulnerable and can be attacked again.
The incidents fit a wider trend. According to the EU cybersecurity agency ENISA, 47% of organisations name supply chain attacks among their top cyber threats, second only to ransomware at 55%. Many logistics managers expect cyberattacks but are still cutting security budgets.
No one has claimed responsibility for either wave of attacks, and the authorities have not ruled out any hypothesis.
