Refrigeration Controls Compromised: European Supermarkets Forced to Discard Food

What happened

On the night of November 2, attackers remotely accessed refrigeration control units in a handful of supermarkets across Belgium, Sweden, Estonia, and other European nations. The malicious actors changed the temperature settings, switching units into defrost mode or raising set points to 50 °C. As a result, fridges and freezers warmed, forcing store staff to discard chilled and frozen goods to prevent spoilage.

Danfoss, the Danish manufacturer of the affected refrigeration controllers, confirmed that its products were involved. The attack mirrors a similar incident that occurred three weeks earlier in France, where hundreds of supermarkets were hit. Although no official attribution has been released, the pattern suggests a coordinated effort targeting remote‑controlled refrigeration systems.

Who is affected

Supermarkets directly impacted include Delhaize in Belgium, ICA in Sweden, and Selver in Estonia. In Belgium, the refrigeration contractor Sabcobel, which manages Delhaize’s systems, reported the switch to defrost mode. In Sweden, ICA’s store in Sjöbo had its units set to 50 °C, while in Estonia, Selver’s freezer experienced a temperature rise of 2–3 °C before the issue was resolved within ten minutes.

Beyond the named chains, any retailer using Danfoss‑based controllers or relying on remote monitoring services such as Sabcobel or Kitman Coldtech could be vulnerable. The attack underscores the risk for all operators that maintain remote access to critical industrial control devices.

Impact

The immediate consequence was the loss of perishable inventory. Stores were forced to remove food from shelves and, in some cases, discard it entirely to avoid food‑borne risks. The financial impact includes the cost of wasted goods, potential penalties for non‑compliance with food safety regulations, and the operational cost of restoring normal refrigeration cycles.

Operationally, the incident disrupted store workflows, required staff to manage emergency cooling procedures, and introduced safety hazards as equipment operated outside intended parameters. The event also highlighted gaps in incident response readiness for industrial control systems within retail environments.

Exposure

Investigations point to the use of remote access granted to third‑party contractors. Many refrigeration units expose management interfaces over the internet, allowing external parties to monitor and adjust settings. Default or weak credentials, lack of network segmentation, and outdated firmware create a fertile ground for exploitation.

Additional exposure stems from insufficient logging and monitoring of control‑system traffic. Without real‑time alerts for anomalous configuration changes, defenders may not detect malicious activity until physical effects manifest.

What to do

Defenders should immediately isolate affected refrigeration units from the network, verify firmware versions, and apply the latest security patches. Remote access should be disabled unless absolutely necessary, and any remaining remote connections must be protected with strong authentication and encryption.

• Audit all industrial control devices for exposed management interfaces.
• Enforce network segmentation between control‑system networks and corporate or public networks.
• Change default credentials and enforce multi‑factor authentication for remote access.
• Implement continuous monitoring of configuration changes and set up alerts for unauthorized adjustments.
• Maintain an up‑to‑date inventory of all control‑system components and their firmware versions.
• Coordinate with vendors, such as Danfoss, to receive timely security advisories.
• Develop and rehearse an incident‑response plan specific to industrial control systems.

What to watch

Attackers may target other industrial control systems that rely on remote management, including HVAC, water treatment, and energy distribution. New vulnerabilities in refrigeration controller firmware could emerge, so continuous monitoring of vendor advisories is essential.

Stay informed through national cybersecurity agencies, such as CERT‑FR, and industry groups that track supply‑chain threats. Early detection of anomalous traffic to control‑system ports can provide a critical window to mitigate future attacks before they cause physical damage.