Fridge Hackers Spoil Food Across Europe in Second Wave

Overnight into Monday, November 2, attackers remotely changed settings on refrigeration control systems at supermarkets and food businesses in at least nine European countries, warming fridges and freezers and forcing stores to pull chilled and frozen food from shelves. It was the second such wave in three weeks, after a mid-October campaign hit hundreds of French supermarkets. No group has claimed either wave, and British and Belgian authorities say attribution may never come.

The victim list is long but the per-chain damage was contained — this time. The Hacker News tallied the confirmed cases: Delhaize with several dozen stores in Belgium and Luxembourg, Carrefour with 15 of more than 700, Intermarché, Spar, an IKEA in Mons, ICA and Coop in Sweden, Musgrave's SuperValu in Ireland (13 of 223 stores), Selver in Estonia, Kesko in Finland, Intermarché's Mosqueteiros group in Portugal, Coop stores run by Radenza Group in Sicily, and at least 17 Dutch businesses including butchers and small shops. In Britain, The Record reports three members of the Association of Independent Meat Suppliers were hit through vulnerable Copeland XWEB supervisory controllers, plus the wholesaler Langridge Organic.

The headline number so far: one Antwerp-area butcher, Luc De Laet, told Reuters roughly €15,000 of meat was ruined after his fridges were turned up to 18°C. Most chains reported limited losses. Several didn't lose anything — because a human happened to be watching.

What the timeline shows

Anchor this properly, because the sequence matters more than the headlines.

In August, researchers at industrial cybersecurity firm Claroty disclosed almost two dozen vulnerabilities in Copeland's XWEB Pro controllers. A firmware fix has been available since then. Per a security note circulated among AIMS members, XWEB firmware version 1.12.1 and earlier contained severe authentication bypass vulnerabilities — attackers could take control without a password.

Mid-October: the first wave hit French supermarkets, spoiling food and, according to CSO Online, starting some fires. CERT-FR issued an advisory telling operators to disconnect any refrigeration control system with a public IP address from the internet, and to reconnect only via a secure VPN after verifying configuration and, if needed, restoring factory defaults. As an emergency stopgap, operators could filter connections to allow only their refrigeration suppliers' IP addresses. On October 13, Danfoss gave its Dutch clients the same advice: disconnect, reconnect only over a secure network.

Day 0 of wave two, November 2: attackers went after the operators who hadn't acted. In Belgium, units were flipped into defrost mode — a function meant to clear ice, here used to heat food instead. In Sjöbo, Sweden, an ICA store reported fridges and freezers set to 50°C. At a Selver in Estonia, a freezer setpoint was raised to 50°C; the actual temperature climbed only 2–3°C before staff resolved it in about ten minutes, with no product lost. The Dutch systems that fell were, by Danfoss's own account, not on a secure network and still using default passwords.

That is the whole attack chain. No malware, no persistence mechanism anyone has described, no lateral movement worth the name. Internet-exposed controller, weak or absent authentication, changed setpoint, spoiled stock. The NCSC's director of operations, Paul Chichester, said of the French wave: “This is using vulnerabilities that absolutely have been out there for a long period of time.” Boring bugs, exploited at scale. I've responded to flashier incidents that did less damage.

When could this have been caught? At three points. In August, when the patch shipped. On October 13, when the vendor told customers to disconnect. And on the night itself — Langridge Organic's managing director Alex Pearce told The Grocer he was “pretty sure that I interrupted a live hacking event,” physically pulling a fridge off the internet as he watched it being driven into defrost remotely. Manual intervention saved his stock. That is not a control; that's luck with a pair of hands attached.

Exposure: your cold chain is probably someone else's problem

The reason so many retailers failed to move after France isn't laziness, exactly. It's structure. Gartner's Katell Thielemann told CSO Online that retailers own the hardware but outsource maintenance, upkeep and management — “there is some confusion about who owns what in this black box of outsourcing.” IDC's Bobby Kuzma put it in terms every incident responder will recognise: the security teams monitoring vulnerability reports and the people managing the OT side are different populations, and the former “may not have even been aware that the devices were network connected, especially if they were riding on dedicated internet circuits for manufacturer support.”

So the first check is not a scan. It's a walk. Kuzma's advice is unglamorous and correct: somebody physically goes into the telco closet at each location and asks pointed questions about what equipment is present and what it's plugged into. Kesko's statement is instructive — the affected Finnish stores' equipment sat outside Kesko's central protections. Musgrave limited its incident to one refrigeration model. Both facts point to the same thing: estate heterogeneity defeats centrally-managed assumptions.

Concretely, the exposure checks for this week:

• Enumerate every refrigeration controller on your estate — Danfoss, Copeland XWEB and anything else — including contractor-installed kit at smaller or franchised sites.
• Check each unit's firmware against the Copeland XWEB advisory: version 1.12.1 and earlier carries the authentication bypass.
• Identify every controller reachable from the public internet, including those on 4G uplinks and dedicated vendor-support circuits.
• Audit for default credentials. Danfoss says the Dutch victims were still using them.
• Ask your refrigeration contractor, in writing, how they connect remotely and whether that path matches the CERT-FR guidance.

Detection: what did the logs show?

Honest answer: we don't know, because almost nobody was collecting them. The attacks were detected by thermodynamics, not telemetry — food warming up, staff noticing, one director happening to watch a live session. ICA didn't confirm a cyberattack at all. Kesko reported unusual temperatures with the cause under investigation.

The detection opportunities here are cheap, which is what makes their absence galling:

• Alert on setpoint changes outside maintenance windows. A defrost command at 2 a.m. across dozens of stores simultaneously is not a service visit.
• Log and alert on authentication events to controllers — particularly successful logins from IP addresses that aren't your known contractors.
• Independent temperature alerting, separate from the controller itself. If the box reporting the temperature is the box being attacked, your monitoring is a hostage.
• Egress awareness: know which devices at each site talk outbound, and to where. Several victims reportedly didn't know the kit was internet-connected at all.

The Estonia case shows the ceiling of even good response: ten minutes from detection to resolution, and the freezer still rose 2–3°C. Fine for frozen stock. Consider what that same ten minutes means for a defrost cycle run on a compressor under load — the fires reported in France are the version of this story where nobody was watching at all.

Mitigation and the longer fix

The mitigations are already written down, and they work. The Dutch victims were the ones who ignored them. CERT-FR's October guidance remains the operative playbook: pull public-IP controllers off the internet, verify configurations, restore factory defaults where in doubt, reconnect via secure VPN, and — as a bridge — allow-list supplier IPs. Copeland says it has re-communicated its patching and security protocols to customers; XWEB operators should treat the firmware update as this week's work, not this quarter's.

Longer term, the uncomfortable question is the one the editor's angle poses: is remote control of supermarket refrigeration still net-positive once attackers can convert weak OT access into spoiled inventory, emergency labour, disposal costs and fire risk? The economics still favour remote management — refrigeration contractors like Sabcobel and Kitman Coldtech exist because monitoring entire estates remotely is cheaper than site visits, and deadband, defrost and compressor-pressure tuning genuinely require it. What changes the ROI is the gap between remote management done properly — segmented networks, VPN access, unique credentials — and the version the Dutch victims were running: kit hanging on the open internet behind factory passwords. Those are different products at different prices, and this week's losses are the invoice for confusing them.

Regulation may force the issue unevenly. AIMS is pushing for the food sector to get a stronger place in Britain's critical national infrastructure designations; today no individual food assets are designated, and the sector sits outside the forthcoming Cyber Security and Resilience Bill, with its fines of up to £17 million or 4% of global turnover. The EU's NIS2 does cover food production and distribution. NCSC chief executive Richard Horne called the freezer attacks “really just sort of the foothills” of what his agency's annual report warns about, and his CTO Ollie Whitehouse said he was “surprised to see some of these things being connected to the internet still in 2026, despite warnings.”

The takeaway

Two waves, three weeks apart, same technique, mostly the same class of victim. The gap between them was not attacker innovation; it was defender inaction, much of it explainable by outsourcing arrangements that left nobody holding the risk. If you run cold storage, the question isn't whether your controllers are vulnerable — it's whether anyone in your organisation could tell you, tonight, which of them can be reached from the internet. The attackers already have that list. They compiled it from public scan data while the patch sat unapplied.