Headline: Europe’s Supermarket Freezers Hijacked in Widespread IoT Attack — Food Spoiled, Fires Reported, Investigations Underway
A fast-moving wave of hacks that forced supermarket freezers into defrost mode has spread across Europe, disrupting stores in nine additional countries after an initial outbreak in France. The incident is a stark reminder to the crypto and broader tech community that poorly secured internet‑connected devices in critical infrastructure can be weaponized quickly — whether for profit, disruption, or chaos.
What happened
- The incident began in France, where Finance Minister Roland Lescure told Parliament on Oct. 13 that roughly 700 of the country’s 10,000 supermarkets were affected. French authorities say attackers forced refrigeration systems into a continuous defrost cycle, spoiling food and even sparking fires at some locations.
- On Monday the problem surfaced across Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. Estonian units reportedly reached 50°C (122°F) — high enough to cook and rapidly accelerate bacterial growth.
- No group has claimed responsibility. Investigators are working to determine links between the French outbreak and the subsequent wave.
Who and what was affected
- Retail groups reporting hits included Groupement Mousquetaires (Intermarché, Netto) — which reported about 300 stores affected — and Cooperative U, which said 80 of its 2,000 shops were hit. Some Mousquetaires display cases remained out of service days later.
- France’s CERT-FR identified compromises of remote control modules made by Danfoss and Copeland.
- In Belgium, Carrefour saw disruption at about 15 stores and federal prosecutors opened an investigation. Four Delhaize outlets in Luxembourg reported problems.
- Italy’s Radenza Group (Coop stores in Sicily) said the attack began around 4 a.m. local time and targeted remote controls for frozen sections.
- Ireland’s Musgrave reported 13 SuperValu stores affected; Portugal’s Mosqueteiros confirmed incidents at seven Intermarché stores.
- Sweden’s Coop said six of about 800 stores were hit; those sites ran on 4G connections, which the chain said made them “more exposed.” Ica also reported a limited number of stores affected; both Swedish chains said the affected shops used an external Danfoss control system.
- Finland’s Kesko said network interference has not been ruled out.
Security findings and warnings
- CERT-FR warns the campaigns are likely still ongoing and urges operators to remove vulnerable controllers from the public internet.
- Estonian refrigeration vendor Kitman Coldtech said the compromised units were older Danfoss models similar to those attacked in France.
- Security firm Claroty disclosed flaws in Danfoss AK‑SM 800A controllers in August, including an authentication bypass; it found 2,765 of those devices exposed online. Danfoss released a fix in firmware R4.3.1, but it’s unclear which specific vulnerabilities the attackers exploited in this wave.
- Belgium’s refrigeration contractor Sabcobel said evaporators were switched into defrost mode, and its CEO warned many older units require physical modifications — an investment that takes time. CERT-FR also cautioned that leaving end‑of‑life devices on the internet without security patches carries a very high risk of compromise.
Official response
- EU Agriculture Commissioner Christophe Hansen described the incidents as a “deliberate attempt” to disrupt the food supply chain.
- Italy’s government scheduled a cybersecurity meeting in response. Federal prosecutors in affected countries have opened investigations.
Why crypto readers should care
- The incident highlights the real‑world consequences of insecure IoT and industrial control systems — a familiar lesson for the crypto community, where “cold” and “hot” storage analogies speak to offline vs online risk. Just as private keys must be protected from exposed systems and unpatched software, critical infrastructure needs robust segmentation, patching, and, where possible, removal from the public internet.
- Attackers exploiting unpatched, internet‑exposed controllers can cause supply‑chain and financial damage without traditional ransomware or theft — a reminder that cyber risk extends well beyond wallets and exchanges.
Practical takeaway
- Authorities and vendors advise taking vulnerable controllers off the public internet immediately and applying firmware updates where available. For many legacy units, more involved hardware changes will be required — and until they’re completed, older, purely offline systems are ironically the safest option. In other words: for now, your unplugged “cold storage” freezer is probably the most secure device on the continent.
Investigations are ongoing; more technical details and attribution may emerge as researchers and national CERTs analyze logs and attack vectors.
A fast-moving wave of hacks that forced supermarket freezers into defrost mode has spread across Europe, disrupting stores in nine additional countries after an initial outbreak in France. The incident is a stark reminder to the crypto and broader tech community that poorly secured internet‑connected devices in critical infrastructure can be weaponized quickly — whether for profit, disruption, or chaos.
What happened
- The incident began in France, where Finance Minister Roland Lescure told Parliament on Oct. 13 that roughly 700 of the country’s 10,000 supermarkets were affected. French authorities say attackers forced refrigeration systems into a continuous defrost cycle, spoiling food and even sparking fires at some locations.
- On Monday the problem surfaced across Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. Estonian units reportedly reached 50°C (122°F) — high enough to cook and rapidly accelerate bacterial growth.
- No group has claimed responsibility. Investigators are working to determine links between the French outbreak and the subsequent wave.
Who and what was affected
- Retail groups reporting hits included Groupement Mousquetaires (Intermarché, Netto) — which reported about 300 stores affected — and Cooperative U, which said 80 of its 2,000 shops were hit. Some Mousquetaires display cases remained out of service days later.
- France’s CERT-FR identified compromises of remote control modules made by Danfoss and Copeland.
- In Belgium, Carrefour saw disruption at about 15 stores and federal prosecutors opened an investigation. Four Delhaize outlets in Luxembourg reported problems.
- Italy’s Radenza Group (Coop stores in Sicily) said the attack began around 4 a.m. local time and targeted remote controls for frozen sections.
- Ireland’s Musgrave reported 13 SuperValu stores affected; Portugal’s Mosqueteiros confirmed incidents at seven Intermarché stores.
- Sweden’s Coop said six of about 800 stores were hit; those sites ran on 4G connections, which the chain said made them “more exposed.” Ica also reported a limited number of stores affected; both Swedish chains said the affected shops used an external Danfoss control system.
- Finland’s Kesko said network interference has not been ruled out.
Security findings and warnings
- CERT-FR warns the campaigns are likely still ongoing and urges operators to remove vulnerable controllers from the public internet.
- Estonian refrigeration vendor Kitman Coldtech said the compromised units were older Danfoss models similar to those attacked in France.
- Security firm Claroty disclosed flaws in Danfoss AK‑SM 800A controllers in August, including an authentication bypass; it found 2,765 of those devices exposed online. Danfoss released a fix in firmware R4.3.1, but it’s unclear which specific vulnerabilities the attackers exploited in this wave.
- Belgium’s refrigeration contractor Sabcobel said evaporators were switched into defrost mode, and its CEO warned many older units require physical modifications — an investment that takes time. CERT-FR also cautioned that leaving end‑of‑life devices on the internet without security patches carries a very high risk of compromise.
Official response
- EU Agriculture Commissioner Christophe Hansen described the incidents as a “deliberate attempt” to disrupt the food supply chain.
- Italy’s government scheduled a cybersecurity meeting in response. Federal prosecutors in affected countries have opened investigations.
Why crypto readers should care
- The incident highlights the real‑world consequences of insecure IoT and industrial control systems — a familiar lesson for the crypto community, where “cold” and “hot” storage analogies speak to offline vs online risk. Just as private keys must be protected from exposed systems and unpatched software, critical infrastructure needs robust segmentation, patching, and, where possible, removal from the public internet.
- Attackers exploiting unpatched, internet‑exposed controllers can cause supply‑chain and financial damage without traditional ransomware or theft — a reminder that cyber risk extends well beyond wallets and exchanges.
Practical takeaway
- Authorities and vendors advise taking vulnerable controllers off the public internet immediately and applying firmware updates where available. For many legacy units, more involved hardware changes will be required — and until they’re completed, older, purely offline systems are ironically the safest option. In other words: for now, your unplugged “cold storage” freezer is probably the most secure device on the continent.
Investigations are ongoing; more technical details and attribution may emerge as researchers and national CERTs analyze logs and attack vectors.