Summary

• Refrigeration systems at retailers in several European countries were attacked on 2 November, following earlier disruption in France.
• Forescout identified 12,976 exposed refrigeration service observations across 99 countries and territories.
• Exploiting remote management functions can damage stock and interrupt operations, while outdated firmware and weak access controls create further exposure.

Cyberattacks against supermarket refrigeration systems have spread across Europe, with retailers in Belgium, Sweden, Ireland, Estonia, Luxembourg, and the Netherlands reporting incidents in which remotely accessible equipment was manipulated to disrupt temperature-controlled storage.

The attacks took place during the early hours of 2 November and affected stores operated by several major supermarket groups, as well as smaller food businesses. In some reported cases, attackers increased refrigeration temperature settings to 50°C, leaving operators to remove affected products and assess whether they remained safe for sale.

The incidents follow similar attacks against hundreds of supermarkets in France during October, where attackers interfered with commercial refrigeration controls. Although the latest incidents show similarities in timing, equipment, and reported behaviour, investigators have not established whether they were conducted by the same people or through the same method of access.

Researchers at Censys identified Danfoss StoreView supervisory controllers among the systems reportedly affected. Such equipment allows authorised operators and maintenance contractors to monitor refrigeration units and change operating settings remotely, reducing the need for technicians to visit individual stores. Once sufficient access is obtained, however, the same functions can be used to interfere with physical equipment.

Exposure extends far beyond France

Earlier research by Forescout identified 12,976 internet-exposed refrigeration service observations across 6,017 public IP addresses in 99 countries and territories. The findings included substantial exposure in Italy and Greece, extending the potential attack surface across markets that had not been associated with the original French incidents.

Forescout’s figures cover ten product groups used to monitor or manage refrigeration equipment. Copeland and Dixell XWEB services accounted for 7,075 observations, while Danfoss StoreView represented another 4,697. An observation records an exposed service rather than an individual compromised machine, and a single management interface may control several pieces of equipment.

The researchers also identified outdated firmware across a substantial proportion of the observed Danfoss systems. Of the 4,697 StoreView service observations, 3,762, approximately 80%, were associated with firmware older than version 4.3.1 on AK-SM 800A equipment. Those versions are affected by known vulnerabilities addressed through later updates.

Public exposure and outdated software are important indicators of risk, although the presence of either does not establish how an individual intrusion occurred. Attackers may obtain access through software vulnerabilities, weak credentials, misconfigured remote connections, or other weaknesses in the systems and organisations responsible for equipment maintenance.

Following the French attacks, Forescout warned that refrigeration management systems remained accessible in several other European countries. Subsequent incidents involving retailers in Belgium and Sweden have demonstrated how broadly the consequences of insecure control equipment can extend.

Censys conducted a separate assessment following the 2 November attacks and observed just over 1,000 publicly exposed StoreView instances globally. Its figures reflect a different observation period and a narrower product group than Forescout’s wider survey. In Belgium, Censys estimated that 68% of the StoreView instances it identified were running patched firmware, compared with 58% in Sweden.

These measurements illustrate how software maintenance varies between locations and systems. Even where a majority of identified controllers have received updates, equipment that remains publicly accessible requires appropriate authentication and access restrictions to prevent unauthorised changes.

Physical damage through ordinary controls

Refrigeration equipment presents a different operational target from the files and databases commonly associated with ransomware attacks. Rather than encrypting information or demanding payment, an attacker with sufficient access may manipulate temperature setpoints, initiate defrost cycles, or change alarms using functions already available within the management software.

Those changes can affect goods long before staff identify the problem. Chilled and frozen products must remain within appropriate temperature ranges, and businesses may need to discard stock when they cannot demonstrate that safe storage conditions have been maintained.

The resulting costs extend beyond the value of damaged food. Stores may close temporarily, employees must clean and restock affected areas, and operators need to inspect equipment and repeat food safety checks before returning it to service. Disruption across a large retail estate can require considerable coordination even when individual technical changes are relatively simple.

Patrick Lamplmair, CTO and Co-Founder of Tributech, described the expansion of attacks beyond France as evidence that the technique presents a repeatable operational threat.

“Three weeks after France, supermarkets in Belgium and Sweden have been hit in the same way. This is no longer a one-off incident. It is a method that works, and attackers will keep using it until it stops working.”

Lamplmair argued that organisations should regard refrigeration controls as part of their wider operational security responsibilities, particularly where remote maintenance connections can provide access across multiple sites.

Claims of earlier attacks across the food chain

Forescout has tracked more than 20 claimed attacks against refrigeration systems since January 2026. Its research identifies pro-Russian hacktivist groups Z-Pentest Alliance and NoName057(16) among the more active groups making such claims, with reported targets including fruit storage facilities, wineries, supermarkets, and agricultural processing businesses in Spain, Italy, and other European countries.

These historical claims concern a broader series of incidents and do not establish responsibility for the latest attacks. Censys reported that no group had claimed the 2 November wave when it published its assessment, while the precise route used to access the affected controllers remained unconfirmed.

The variety of reported targets reflects the extensive use of connected refrigeration beyond supermarkets. Food producers, logistics companies, agricultural businesses, and healthcare operators may depend on similar systems to maintain temperature-sensitive products and equipment.

Maintenance arrangements can complicate responsibility for securing that infrastructure. Refrigeration equipment may be owned by one organisation, monitored by a specialist contractor, and connected through networking services administered by another provider. Software updates and access reviews require coordination across those relationships, particularly when equipment has been operating for many years.

Lamplmair recommended that operators identify connected equipment, remove unnecessary public internet exposure, and install available security updates. He also advocated checks within the equipment itself to ensure that commands come from authorised sources and remain within permitted physical limits.

“A freezer should never accept an instruction to heat to 50°C, no matter who sends it.”

That approach would place additional controls between a management interface and the physical equipment. Its practicality depends on controller design, the capabilities of installed software, and whether older systems can be updated or must be replaced to support stronger protections.

European product security requirements

The EU Cyber Resilience Act is introducing security obligations for products with digital elements, including requirements governing vulnerability handling and the maintenance of supported products. Its vulnerability reporting provisions began applying in September 2026, while broader product security requirements are scheduled to apply from December 2027.

For manufacturers of connected industrial equipment, the legislation strengthens the importance of secure design, documented support periods, and processes for addressing vulnerabilities. Operators must meanwhile manage existing installations that may remain in service for many years, often using equipment purchased before the newer requirements were established.

Removing public management interfaces, restricting contractor access, maintaining software, and monitoring configuration changes can reduce exposure across current equipment estates. Where a refrigeration system cannot enforce safe operating limits independently, organisations must also consider how unauthorised commands could affect physical operations.

Investigations into the November incidents remain under way, and the full extent of damaged stock and business interruption has yet to be established. With similar management technology deployed throughout Europe’s food and temperature-controlled supply chains, the exposure extends well beyond the retailers already affected.