Overnight attacks struck Delhaize, Carrefour, ICA and SuperValu stores, three weeks after the French strikes
A second wave of supermarket fridge cyberattacks struck stores in Belgium, Sweden and Ireland overnight on 1 November. TF is tracking the reports and the hack. Attackers warmed refrigeration units over the internet, and nobody has claimed responsibility.
What’s Happening & Why It Matters
Second Wave Hits Belgium, Sweden and Ireland
The attacks ran from Sunday night into Monday 2 November. About 40 Delhaize stores in Belgium and Luxembourg lost refrigeration. At least 15 Carrefour stores and five Spar stores reported problems. Belgian media put the food thrown away at about €100,000 ($112,000).
In Ireland, at least 13 SuperValu stores run by Musgrave were affected. In Sweden, ICA confirmed attacks on a small number of stores outside its central network. Six Coop sites in central Sweden lost control of their fridges. One Delhaize store manager called the loss of all fresh and frozen stock “catastrophic”.
How the Attackers Warm the Food
Stephan Moelans, chief executive of Belgian refrigeration firm Sabcobel, says the attack began around midnight on Sunday. Attackers switched evaporators to defrost mode, a normal function which warms a unit. Technicians worked through the night to disconnect affected units from the network.
Temperatures differ by report. Swedish freezers reached 50°C, and one ICA manager cited 55°C. Belgian media mentioned 70°C, which no confirmed account supports. Moelans says a full fix needs a software update and a physical change to the units.
Why Supermarket Fridges Face the Internet
Remote access lets contractors diagnose faults without visiting each store. Danfoss says remote connectivity cuts engineer callouts by 15% to 30%. Installation guides describe router port forwarding to make controllers reachable from outside.
Forescout research from October says responsibility is split between contractors, store owners and technology teams. One Danfoss unit has lacked security updates since May 2021. Shodan found 12,976 exposed refrigeration services on 6,017 IP addresses in 99 countries. About 80% of Danfoss services ran firmware older than the fix for known flaws. The figures count exposed systems, not confirmed breaches.
What Links the Two Waves
The French wave struck hundreds of stores, including Intermarché and Coopérative U, in mid-October. France’s cybersecurity agency ANSSI said attackers used internet-exploitable flaws in exposed controllers from Danfoss, Copeland and Dixell. Belga reports the Belgian method matches the French method. Researcher Kevin Beaumont says the units in the new attacks exposed management interfaces. Many are end-of-life with no patch.
No outlet has identified a shared operator, and no one has been named. Coopérative U says Danfoss does not supply its stores. Forescout advises removing controllers from the open internet, replacing unsupported units, and giving contractors individual logins with multi-factor authentication. TF follows such incidents in its cybercrime round-ups.
My take: Attackers used a legitimate defrost command on exposed controllers, so no malware was needed. The danger is food waste and shopper trust. A lasting fix needs hardware replacement, which takes months.
TF Summary: What’s Next
Retailers will disconnect more controllers and move contractors to secure remote access. Investigators will test whether one flaw links both waves. Insurers will review cover for spoiled stock.
MY FORECAST: Investigators will link the two waves to one class of flaw within a month. A third wave will strike stores before 31 December 2026. Nobody will face charges in 2026.
Stories You May Like
- TF Cybercrime Round-up: 30 October 2026
- TF Cybercrime Round-up: 6–11 October 2026
- Binance Replaces 90% of $6.3Bn Hack Losses as FBI Blames North Korea
- PHP2Shell: PHP Vulnerabilities, AI Research and Patches
- Google Unveils Gemini 4 Carbon, a Vulnerability-Hunting Model Few Can Use