Skip to content
NewA calmer, faster ZeroHour
StoryData breachhighExploited in the wild

European supermarket refrigeration attacks return after October wave

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A November wave of remote defrost attacks hit supermarket fridges across Europe; no group is confirmed, and agencies urge protections.

Unknown attackers remotely forced supermarket refrigeration into defrost or high-temperature modes, spoiling food in a second wave that followed October incidents in France. Reports place the new incidents in at least nine countries, including Belgium, Estonia, Ireland, Luxembourg, the Netherlands, Sweden, Finland, Italy and Portugal, with some outlets also naming Germany, Poland and Spain. Affected chains include Delhaize, Carrefour, Coop, ICA, Spar, Colruyt, Intermarché, SuperValu and Selver; SuperValu removed products from 13 stores. Units were reported as high as 50°C (122°F). Controllers linked to the incidents include Danfoss AK-SM and AK-SC and Copeland and Dixell XWEB systems, many described as end-of-life or internet-exposed. No group has been confirmed; Unit 42 says NoName057(16) and Z-Pentest claimed responsibility on Telegram, unverified. On November 5, CISA, the FBI and other US agencies warned of malicious activity against industrial refrigeration worldwide.

Key facts
  • November wave followed October 11 attacks that mainly hit French stores.
  • Reports disagree on scope: over 100 stores versus 115-plus, and 6 to 12 countries.
  • Dark Reading says the October wave hit roughly 700 French stores.
  • Censys found over 1,000 exposed Danfoss StoreView interfaces worldwide.
  • EU Agriculture Commissioner called the attacks a deliberate food-supply disruption.
  • Many targeted controllers are legacy products with no available patches.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 11, 2026Attackers force defrost cycles on French supermarket refrigeration. · Infosecurity Magazine
  2. Nov 1, 2026Similar refrigeration attacks reported across at least nine countries. · Infosecurity Magazine
  3. Nov 5, 2026CISA, FBI and other US agencies warn of refrigeration attacks. · Infosecurity Magazine

What each outlet adds

beyond the shared facts
  • BleepingComputerCounts 115-plus stores and lists a broader set of chains.
  • SecurityWeekCensys exposure count and Lupovis activity against Danfoss sensors.
  • Infosecurity MagazineSuperValu’s 13 stores, NCSC monitoring, and EU commissioner comment.
  • Dark ReadingOctober scale of about 700 stores and millions of euros in damage.
  • Palo Alto Unit 42Unverified Telegram claims by NoName057(16) and Z-Pentest.
Vendors
DanfossCopelandICACoopAhold DelhaizeCarrefourSpar ColruytIntermarchéSuperValuSelverSabcobelDixell
Products
refrigeration systemsfreezerscooling systemsAK-SMAK-SCXWEBDanfoss refrigeration controllersStoreViewCarrefourAhold DelhaizeColruyt GroupCoop
Threat actors
NoName057(16)Z-PentestCARR
Victims
SuperValuICA SwedenIkeasupermarkets in Belgiumthe NetherlandsSwedenLuxembourgIrelandand Estoniasupermarketsmedical facilitiesIntermarché
Organizations
NCSCEUCERT-FRSentinelLABSCISAANSSILupovisFBICensysAssociation of Independent Meat Suppliers
Countries
BelgiumEstoniaFinlandIrelandItalyLuxembourgNetherlandsPortugalSwedenUnited KingdomFranceEuropean countries

Coverage

oldest first · one row per article · UTC
  1. · 9d ago Help Net SecurityFirst report

    Second wave of refrigeration cyberattacks hits European supermarkets

    Similar attacks affect Delhaize, Carrefour, Coop, and ICA stores in Belgium, Luxembourg, and Sweden three weeks after French incidents.

  2. · 9d ago BleepingComputer

    Hackers disrupt refrigeration systems at European supermarkets

    Over 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia hit after remote temperature changes.