Supermarket Refrigeration Attacks Spread as Belgium Issues Fix Advice

Belgium’s national cyber security centre has told shops to take their refrigeration controllers off the public internet, as attacks on supermarket refrigeration spread across Europe. In an advisory on 3 November, the Centre for Cybersecurity Belgium (CCB) said remote controllers were being forced into “maximum-temperature defrost cycles of up to +50°C overnight”, and that “attack campaigns are likely still underway”.

The CCB named Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia as affected. AFP has counted at least 11 countries, adding Finland, Germany, Italy, Portugal and Romania. Italy’s government and the European Commission both held security meetings on Tuesday. Nobody has said who is behind the attacks, and the Commission said it would not attribute them.

What the CCB tells stores to change now

The CCB said the targeted devices include Danfoss controllers in the AK-SC and AK-SM series, and Dixell xweb and Copeland xweb units. The attackers, it said, are exploiting unpatched firmware, web interfaces exposed to the internet and vendor default credentials that were never changed.

Its recommendations for anyone running these controllers are:

• Remove public IP access and put the controller behind a VPN or a protected internal network.
• Update the firmware and change all default passwords.
• Check the whole configuration, including the allowed defrost ranges.
• Use IP filtering only as a stopgap, not as the fix.
• Check insurance terms in contracts with suppliers and installers.

If a controller has already been tampered with, the CCB advises a factory reset and then a full reconfiguration. It adds a warning: “A factory reset alone is insufficient if the device remains exposed.” Compromises should be reported to the CCB through its portal.

That matches the advice France’s CERT-FR gave after the October attack on French supermarkets, which TSN covered at the time. CERT-FR also told operators to disconnect remote controllers, and warned that resetting old devices was not enough.

Italy and the EU hold security meetings

In Rome, Undersecretary Alfredo Mantovano and Agriculture Minister Francesco Lollobrigida met the head of the National Cybersecurity Agency (ACN) and the directors of Italy’s intelligence agencies “following the hacker attacks targeting a number of commercial refrigeration systems in Europe”, the Palazzo Chigi statement said.

The government said initial findings suggest “the impact of the attacks in Italy is extremely limited at the moment: only a few commercial units have been affected, compared with the thousands present across the nation”. Most of the units hit “had obsolete security systems with interfaces directly exposed to the internet as well as weaknesses in their authentication mechanisms”. It said “no risks to public health attributable to thawing have emerged”, and “there is therefore no cause for alarm”.

The ACN is passing anomalies to the Carabinieri food-safety unit (NAS) and meeting sector representatives. The government set out four lines of work: monitoring that it said was “already launched months ago”, dialogue with suppliers, finding and notifying exposed operators, and preventive guidance.

In Brussels, Commission spokesperson Thomas Regnier said at the midday briefing that the Commission was “in direct contact with the member states and the relevant national authorities, which are the ones currently carrying out the investigation”. He said the EU Interinstitutional Task Force, with ENISA, Europol and Commission services, met early on Tuesday, followed by a meeting coordinated with EU CyCLONe, the network of national cyber crisis agencies, including affected states. Asked who was responsible, he said: “It is not for us from this podium to attribute such cyber incidents.” He also said “these are not isolated incidents”.

EU agriculture commissioner Christophe Hansen went further in an interview with POLITICO. He called the attacks “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it — a warning that we must take seriously”. He told POLITICO that food security was not at risk.

How far the supermarket refrigeration attacks have spread

Store counts so far come from the chains, through the press. A tally by The Hacker News lists several dozen Delhaize stores, 15 of Carrefour’s 700-plus Belgian stores, 10 to 15 Intermarché stores and five Spar stores in Belgium. It also lists six or seven of Coop Sweden’s roughly 800 stores, 13 of Musgrave’s 223 SuperValu stores in Ireland, at least 17 businesses in the Netherlands, seven Intermarché stores in Portugal and at least four Coop stores in Italy. Belgian broadcaster HLN has reported at least 76 Belgian stores, according to DR.

AFP reported around 20 affected outlets in Italy, four in Germany and six in Romania, and said Belgian federal prosecutors have opened an investigation.

Danfoss told Danish broadcaster DR: “We can confirm that the incidents reported in several European countries also involve our products” (TSN translation). The CCB’s list shows other makers’ controllers are being targeted too.

In Belgium, the first wave hit overnight into Monday 2 November. VRT reported that Delhaize warned stores of rising temperatures at about 04:00 local time. In Sweden, the National Cyber Security Centre said it was in contact with affected stores, SVT reported. In Ireland, Musgrave said its monitoring systems flagged the problem, The Irish Times reported.

The Belgian outage is separate from the October incident in which Ahold Delhaize took some Dutch systems offline. Nothing published so far connects the two.

Default passwords turned a French warning into a European problem

The most useful thing in Tuesday’s statements is how ordinary the weakness is. Belgium and Italy describe the same picture independently: controllers with web interfaces on the open internet, old firmware and passwords nobody changed. That is not a novel exploit. It is a maintenance gap in equipment built to run for a decade without much attention.

France gave retailers a month’s notice. CERT-FR’s October advice and the CCB’s November list are close to identical, which suggests many operators either never saw the first warning or could not act on it quickly. Refrigeration controllers usually sit with the installer or the equipment maker, not the retailer’s IT team. Changing them can mean a site visit, new hardware or a contract change, which is why the CCB points stores to their insurance and supplier terms.

The Italian figures are a reminder of scale. A few units out of thousands is small, but each one exposed is enough to spoil a store’s stock overnight. The cheapest defence is the first item on the CCB’s list: take the controller off the public internet. The same lesson about exposed industrial kit drove the free database of ship and port vulnerabilities launched last month.

There is still no official account of who is doing this or why. The Commission has declined to attribute it, and Belgian prosecutors are investigating. Until then, the practical question for any shop is simple: can someone outside the building reach the box that sets the freezer temperature?

Sources

• Centre for Cybersecurity Belgium: Warning update, security incidents across Europe targeting remote controllers, 3 November 2026
• Italian government: Statement by Palazzo Chigi on hacker attacks against commercial refrigeration systems in Europe, 3 November 2026
• European Commission: Midday briefing, 3 November 2026
• AFP: Italy holds security talks after European freezer cyberattacks, 3 November 2026
• POLITICO: European Commission probe into supermarket cyberattack, Christophe Hansen, 2 November 2026
• DR: What we know about the hacker attacks on European supermarkets
• The Hacker News: Second wave of cyberattacks hits supermarkets, November 2026
• VRT NWS: Delhaize stores hit, 2 November 2026
• SVT: Store fridges and freezers hacked, 2 November 2026
• The Irish Times: SuperValu removes frozen and chilled food from 13 stores, 2 November 2026

Related stories

• French Fridge Attack: Prosecutors Estimate About 700 Victims, The Record Says
• Ahold Delhaize Says Outage Came From ‘Malicious Actions of Others’
• Maritime Groups Launch a Free Database of Ship Cyber Vulnerabilities