Suspected cyberattacks disrupted supermarket refrigeration overnight into Monday, 2 November, with problems reported in Belgium, Sweden, Ireland, Luxembourg, the Netherlands and Estonia. Some Swedish freezers reached 50°C, forcing retailers to discard food. Carrefour reported disruption at 15 Belgian stores, while 13 SuperValu stores in Ireland were affected.
Belgian refrigeration installer Sabcobel said attackers had switched equipment into defrost mode. Investigators have yet to identify those responsible, and no group has claimed responsibility. Although hundreds of French supermarkets suffered similar attacks in October, investigators have not established whether the incidents involved the same perpetrators or vulnerabilities. Some affected systems in both countries used Danfoss technology.
Internet-connected refrigeration controllers allow contractors to diagnose faults and adjust settings remotely. According to Danfoss, this can reduce unnecessary engineer visits by 15–30%. Remote monitoring also enables automatic temperature records for food safety requirements. However, intruders can exploit ordinary control functions to alter temperatures, initiate defrost cycles or disable alarms.
Research published by cybersecurity firm Forescout in October identified 12,976 exposed refrigeration management services across 99 countries and territories. These were accessible systems, not necessarily compromised ones. Among the Danfoss services, 80% ran firmware older than the version addressing known security flaws. Divided responsibility between contractors, equipment owners and IT departments can also leave security gaps.
Forescout recommends removing refrigeration controls from the open internet and restricting access to secure remote tools. It also urges operators to replace unsupported equipment and introduce individual accounts with multi-factor authentication. Sabcobel said some affected equipment would require physical modifications rather than software updates alone.
