Supermarkets in Belgium, Luxembourg and Sweden found their refrigeration units warming up on 2 November after attackers remotely switched the evaporators into defrost mode, spoiling chilled and frozen food. In Belgium, Delhaize, Carrefour and Spar were reportedly among the affected chains. The strikes arrived about three weeks after a larger wave hit shops in France.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
A fridge that defrosts on command is a quiet kind of sabotage: no data is reported stolen and no ransom note has been mentioned in the coverage, yet stock warms past safe limits and is thrown away. The common thread across all four countries is a monitoring and control layer that was reachable from the internet.
Belgium, Luxembourg and Sweden on 2 November
According to Help Net Security’s report, the Belgian attack reportedly began around midnight on Sunday, and the Belga news agency says the mechanism matches the French one. Sabcobel, a Belgian refrigeration manufacturer and installer, said its technicians worked overnight to disconnect affected units from the network. Most of its customers had moved to managing fridges over a secure internet connection after the French incident, the company said, but a full fix needs a software update plus a physical modification of the units.
In Luxembourg, Delhaize supermarkets were hit, according to RTL Today. Colruyt and Intermarche reported technical problems at some stores without attributing them to a cyberattack.
In Sweden, The Local reported that Ica and Coop stores were affected. A store in Sjoebo said on Facebook that its fridges and freezers had been hacked and set to 50 degrees Celsius, and Coop said six of its roughly 800 Swedish stores had fridge and freezer problems, with food thrown away. Neither chain had confirmed a cyberattack. Ica spokesperson Helena Johansson said the company was looking into what happened and how large it was, and Coop spokesman Carlos Cancino said he had received no information that it was a cyberattack. An Ica spokesperson told Dagens Nyheter that a small number of stores connected outside the central network were affected.
The French wave and the CERT-FR alert
The earlier attack hit France on a Sunday night in October and ran into early Monday. Finance Minister Roland Lescure told Parliament that about 700 of France’s 10,000 supermarkets were affected, as reported on 13 October. He said there was no risk to the food supply but called the attack a wake-up call for everyone. According to BFM-TV, hackers forced continuous defrost cycles and pushed temperatures as high as 50 degrees Celsius. The Paris prosecutor’s cybercrime unit opened an investigation. Retailers named in coverage of the French wave included Intermarche, Netto, Super U, Marche U and Leclerc, and damage was reportedly in the tens or hundreds of thousands of euros per affected business. Axima and Danfoss were among the service providers at a crisis meeting held on the Monday.
The French agency’s alert, CERTFR-2026-ALE-012, was first published on 12 October and updated on 13 and 16 October. It lists Copeland xweb, Dixell xweb and Danfoss AK-SC and AK-SM series controllers, reports numerous compromises, and says the core problem is that the management interfaces are exposed to the internet. Its recommendations are to remove that exposure, restore access only through a secure VPN or protected network, change default passwords and update firmware, and, for Danfoss, set the security level to strict. It warns that a factory reset alone is not enough because the device remains vulnerable.
End-of-life controllers and the open attribution question
Security researcher Kevin Beaumont said the units hit in the latest countries share the same issue as the French ones, and that many freezers are end of life with no patch available. In early August, Claroty’s Team82 disclosed vulnerabilities in Danfoss AK-SM 800A and Copeland XWEB Pro controllers, and both vendors have released fixes, though it is not known whether those flaws were used in the attacks, as Help Net Security noted in its October coverage. That coverage also reported a separate security incident at Ahold Delhaize in the Netherlands and Belgium, with no indication at the time that the two attacks were connected, so the Delhaize name appearing in both stories should not be read as a single event.
The French agency’s guidance adds an insurance caution: owners should check their policy terms before cutting the data link to a refrigeration contractor, and review the full configuration, including defrost schedules, because defrost timing is one of the settings an intruder can change. It also says attacks are probably still ongoing.
Nobody has been identified. Help Net Security says it is unclear who is behind either wave, the Swedish chains have not confirmed an attack, and Danfoss had not responded to AFP’s request for comment on the French incident. Whether one actor is behind the French, Belgian, Luxembourg and Swedish cases, or several copying a method, is the question investigators have yet to answer.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
