Cyberattack on European supermarket refrigeration systems exposes thousands of online units
Dozens of supermarkets in Belgium and other European countries were hit by a cyberattack that disrupted refrigeration, while research shows nearly 13,000 refrigeration controllers are openly reachable on the internet across 99 nations.
A cyberattack targeting refrigeration systems forced dozens of Belgian supermarkets to discard food worth about €100,000. The incident affected roughly 40 Delhaize stores, at least 15 Carrefour locations, five Spar shops and the butchery group De Laet en Van Haver, with temperatures reportedly climbing to 70 °C.
"We have identified an IT incident affecting the refrigeration systems in several dozen stores," a Delhaize spokesperson told Euronews.
Similar disruptions were reported at several Swedish ICA stores, and the attack follows a previous incident on 12 October that impacted hundreds of French supermarkets.
Research by cybersecurity firm Forescout, published in October, found that large supermarket refrigeration units are often managed by central controllers that can be accessed remotely over the internet. Manufacturers such as Danfoss claim remote connectivity reduces engineer callouts by 15-30 % and automates temperature record-keeping required for food safety.
However, the same research highlighted that responsibility for these systems is frequently split among contractors, store owners and internal IT teams, leaving no single party with full visibility of exposed services. Some controllers are outdated; one Danfoss model has been out of support since May 2021 and no longer receives security patches.
Using the Shodan search engine, Forescout identified 12,976 exposed refrigeration management services on 6,017 internet addresses in 99 countries and territories. The majority belong to Copeland and Dixell’s XWEB product families (7,075 instances) and Danfoss’s StoreView (4,697 instances), with 80 % of Danfoss units running firmware older than the version that addresses known vulnerabilities.
The risk extends beyond supermarkets to food-processing plants, wineries, farms and hospital cooling equipment. Attackers can manipulate temperatures, trigger defrost cycles or disable alarms using the system’s normal functions, making malicious actions appear routine.
Forescout recommends removing refrigeration management systems from the open internet, granting contractors access only through secure remote-access tools, replacing unsupported equipment, eliminating shared passwords in favor of individual logins with multi-factor authentication, and maintaining logs of configuration changes.