# European Supermarket Refrigeration Systems Targeted by Remote Cyberattacks Hackers exploit vulnerabilities in industrial cooling units to trigger forced defrost and heating modes. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-11-02 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/515cf4d1-f97b-42b5-a47e-6ef82b9ced19 ## Coordinated Attacks Across Europe A wave of cyberattacks hit supermarket refrigeration systems across Belgium, Luxembourg, Sweden, and Estonia on November 2, 2026. Major retailers including Ahold Delhaize, Colruyt, ICA, and Coop reported significant temperature spikes in their freezers overnight. These incidents follow a similar series of attacks that targeted hundreds of French supermarkets in mid-October. ## Forced Defrost Mechanism Exploited Attackers remotely triggered the forced defrost function on refrigeration units, typically designed to clear ice buildup. By setting temperatures to 50°C for several hours, the hackers forced units into heating mode. This malicious manipulation caused widespread food spoilage and, according to some reports, led to physical fires within the cooling equipment. ## Discrepancies in Damage Reports While official police reports cite temperatures reaching 50°C, cybersecurity consultant Emil Olofsson of Integrity 360 claims some units hit 80°C. These extreme temperatures caused units to catch fire in certain locations. Retailers are currently assessing the total volume of food loss, with some stores forced to temporarily close due to equipment failure. ## Danfoss Equipment Vulnerabilities The targeted refrigeration systems primarily utilize equipment manufactured by the Danish firm Danfoss. Investigations reveal that the attacks exploit vulnerabilities in these specific control systems. The pattern mirrors the October incidents in France, where attackers similarly targeted Danfoss technology to disrupt cold chain infrastructure, causing significant operational damage to retail store chains. ## Security Failures in Operational Technology Experts suggest the hackers gained access by exploiting login credentials for control systems exposed directly to the internet. John Billow, head of the Swedish national cybersecurity centre, noted that many operational technology devices remain unpatched. This lack of basic security hygiene allows unauthorized actors to remotely manipulate critical infrastructure like refrigeration units. ## Retailer Response and Investigation Retailers like ICA and Delhaize are actively investigating the breaches and providing support to affected stores. While some companies labeled the event an IT incident, others confirmed direct cyberattacks. In Belgium, Sabcobel CEO Stephan Moelans confirmed that hackers specifically switched evaporators to defrost mode, highlighting the targeted nature of these digital intrusions. ## Expanding Scope of Digital Threats The incident has now reached Estonia, with technology provider Kitman Coldtech reporting a recent attack on a supermarket chain. As refrigeration, heating, and alarm systems become increasingly connected, they present new attack surfaces for cybercriminals. This trend marks a shift from traditional data theft toward the physical sabotage of industrial retail infrastructure. ## Urgent Need for Infrastructure Hardening The recurring nature of these attacks underscores the critical need for securing industrial control systems. Authorities emphasize that exposed devices must be patched immediately to prevent further exploitation. Without robust security protocols for connected hardware, supermarkets remain vulnerable to remote sabotage that threatens both food safety and the physical integrity of stores. ## Sources covering this story - https://securityaffairs.com/202260/security/another-fridge-cyberattack-hits-european-supermarkets-this-time-in-belgium-luxembourg-sweden-and-estonia.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._