NewsPublished 3 Nov 2026

Over 100 European Stores Hit as Supermarket Fridge Attacks Return

Source SecurityWeek

Description

Over 100 stores across multiple European countries experienced cyberattacks targeting internet-exposed refrigeration controllers, causing fridges and freezers to heat up and spoil food. The attacks affected stores in Belgium, Sweden, Ireland, and other countries, with some units set as high as 50°C. The incidents resemble a prior wave of attacks in France that disrupted around 700 supermarkets. The compromised devices include legacy Danfoss and Copeland refrigeration controllers, many of which have management interfaces exposed to the internet and lack available patches. The attackers exploited default credentials and internet exposure to force refrigeration units into defrost mode. Physical modifications alongside software updates are needed to fully mitigate the vulnerability. Investigations are ongoing, and no group has claimed responsibility.

Impact

The attacks caused refrigeration units to heat up to damaging temperatures, leading to widespread food spoilage and financial losses for retailers. Some incidents reportedly caused fires. Over 100 stores in Belgium, Sweden, Ireland, and other European countries were affected, disrupting operations and forcing disposal of perishable goods. The attacks erode consumer trust and disrupt the food supply chain. No data breaches or direct information theft have been reported. The affected refrigeration controllers are mostly legacy devices without patches, increasing exposure risk.

Defensive guidance

Danfoss advised customers to disconnect refrigeration controllers from the internet and reconnect only via secure networks. Most affected stores took this action after the initial attacks. However, software updates alone are insufficient; physical modifications to the equipment are necessary to fully mitigate the vulnerability. Organizations should ensure management interfaces are not exposed to the internet and change default credentials. Monitoring for unauthorized access attempts and applying vendor guidance on securing legacy devices is recommended. Since many devices are end-of-life with no patches, network segmentation and physical security controls are critical.

Summary

This threat involves cyberattacks on internet-exposed refrigeration controllers used in supermarkets and stores across Europe. Attackers remotely accessed devices primarily from Danfoss and Copeland, forcing refrigeration units into defrost mode, causing food spoilage and operational disruption. The attacks follow a similar incident in France affecting hundreds of supermarkets. Many targeted devices are legacy models with management interfaces accessible online and no available patches. Attackers exploited factory-default credentials and weak network segmentation. Vendor advisories recommended disconnecting devices from the internet and reconnecting only through secure networks. Physical modifications are also required to fully address the vulnerability. The attacks have caused significant business impact but have not been linked publicly to any threat actor or confirmed as connected between waves.

References

securityweek.com/over-100-european-stores-hit-as-supermarket-fridge-attacks-resume/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Nov 2026, 07:58 UTC

Technical details

References

Community reviews