Early Monday morning, refrigeration equipment at grocery retailers spanning several European nations fell victim to a coordinated cyberattack. The assault marked the second such incident in recent weeks, with perpetrators gaining remote access to temperature controls and deliberately raising them to destroy inventory. A limited number of smaller Swedish outlets were compromised, alongside more than 50 stores in Belgium and additional locations across Ireland, Estonia, the Netherlands and Luxembourg.
Retail companies and equipment suppliers have characterized the incident as a cyberattack, though neither law enforcement nor government bodies have yet identified those responsible. Katrien Eggers, spokesperson for the Centre for Cybersecurity Belgium (CCB), acknowledged her organization's awareness of the breach but stated: "It is not known who is behind this attack, and it may never be possible to identify them."
The latest incident echoes a previous breach that struck France roughly three weeks earlier. In that October attack, hackers compromised internet-exposed remote controllers governing refrigeration systems at numerous supermarkets. The Paris prosecutor's office documented approximately 700 victims in that assault. France's cybersecurity authority ANSSI confirmed it was monitoring attacks targeting refrigeration system remote controllers across multiple manufacturers.
Neither the Monday attack nor the October incident has been claimed by any group, and investigators have not determined whether the same actors orchestrated both breaches. Retailers have reported scenarios matching the earlier French case, with freezers remotely configured to 50°C. Rickard Nilsson, managing a supermarket in southern Sweden, described the situation to broadcaster TV4: "We can't adjust the temperatures, we can't change them. Heat is blowing into the freezers. Everything is ruined."
Stephan Moelans, chief executive of installation firm Sabcobel, told the Belga news agency that his company mobilized technicians at 1 a.m. to respond to the attacks. Sabcobel identified roughly 20 compromised refrigeration units among the hundreds it maintains throughout Belgium. Moelans noted that remedying the affected units would require physical modifications beyond mere software patches to eliminate the underlying vulnerabilities.
Eggers raised alarm about the escalating frequency of such incidents, noting: "We are concerned about the rising number of incidents, partly due to the targeted use of AI," which she characterized as "a development that has unfolded over the last six months, and the situation is changing very rapidly." The CCB has not yet confirmed whether artificial intelligence played a role in the current attacks. However, Eggers observed that "we have recently seen a huge rise in the number of vulnerabilities where AI has been used to identify and exploit them."
In Estonia, a contractor reported that attackers exploited an older Danfoss system, while Dutch broadcaster NOS indicated that Copeland equipment was also targeted in Belgium. Following the French attack, both manufacturers acknowledged that the compromised devices were largely discontinued products no longer receiving security patches.
The EU's Cyber Resilience Act will establish stricter obligations on such products beginning December 2027, requiring manufacturers to furnish support periods aligned with a product's anticipated lifespan. Currently, however, manufacturers face no legal duty to address vulnerabilities in products targeted by such breaches. In an October newsletter, Danfoss announced it was enforcing a "hard End of Service" policy for legacy products, citing "recent European cybersecurity legislation." The company stated that continued support "would place Danfoss under new legal obligations to maintain security updates."
Danfoss referenced earlier campaigns involving its controllers, including an operation at the outset of Russia's invasion of Ukraine in which attackers targeted Russian supermarkets using the device. An additional 40 stores in Israel were compromised, which Danfoss said lacked sufficient firewall or VPN safeguards.
