1. Which countries have reported hacked freezers?
Supermarket refrigeration systems in nine more European countries began heating up overnight on Monday, November 2, extending a suspected hacking wave that first struck French grocery chains in October. Reports came from Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. In Estonia, freezer units were reportedly driven to 50°C (122°F). No group has claimed responsibility, and investigators have not named a motive.
France is where the episode started. Finance Minister Roland Lescure told Parliament on October 13 that about 700 of the country's 10,000 supermarkets had been affected. With the Monday reports, the problem now spans ten countries, which turns what looked like a national incident into a continental one.
2. What the attackers did to the equipment
France's national cybersecurity agency, CERT-FR, says the intruders forced affected equipment into a continuous defrost cycle. A defrost cycle is a normal feature of refrigeration: it periodically warms the cooling coils to melt ice. Left running without interruption, it stops the unit from cooling and instead heats the cabinet, which spoiled food and, in some stores, started fires.
CERT-FR reported numerous compromises of remote-control modules made by two manufacturers, Danfoss and Copeland. These modules let technicians and store operators monitor and adjust refrigeration from afar. That convenience is also the weakness, because a controller reachable over the internet can be commanded by anyone who finds a way past its login.
At 50°C, a freezer stops being a storage device. It behaves like a low-powered oven, or an incubator for bacteria if food is left inside for long enough. For retailers the cost is therefore both the lost stock and the work of checking and discarding whatever remained in the affected cabinets.
3. How French retailers were hit
The scale in France was large. Groupement Mousquetaires, the owner of the Intermarché and Netto chains, counted 300 affected stores. Cooperative U said 80 of its 2,000 shops had been hit. Some Mousquetaires display cases were still out of service on Tuesday, weeks after the first incidents.
Lescure said food supplies were not at risk, but he described the attack as something that touches the heart of the country's food security. The remark reflects a concern that goes beyond lost inventory: grocery distribution relies on an unbroken cold chain, and an attack on refrigeration targets a basic part of that system rather than a company's office network.
4. Incidents reported across the rest of Europe
In Belgium, Carrefour reported disruption at about 15 of its 700 stores. Sabcobel, a Belgian refrigeration contractor, said evaporators had been switched into defrost mode, and federal prosecutors opened an investigation. Four Delhaize outlets in Luxembourg also reported problems.
Italy's Radenza Group, which runs Coop-branded stores in Sicily, said the attack began at 4 a.m. local time and targeted the remote-control system for its frozen food sections. In Ireland, the retailer Musgrave counted 13 affected SuperValu stores, and in Portugal the operator Mosqueteiros confirmed incidents at seven Intermarché stores.
Sweden's picture is less settled. Coop said six of its roughly 800 stores were hit and that its shops ran on 4G connections, which left them more exposed. Ica said a limited number of stores had problems and that the affected shops used an external Danfoss control system. Neither chain has confirmed a cyberattack. In Finland, Kesko said network interference had not been ruled out.
5. Is this a coordinated attack?
Officials have been cautious about the answer. EU Agriculture Commissioner Christophe Hansen called the incidents a deliberate attempt to disrupt the food supply chain. Investigators, however, have not said whether Monday's wave is connected to the earlier French attack, and the common thread so far is the type of equipment rather than any confirmed attacker.
CERT-FR says the campaigns are probably still ongoing. That assessment matters because it suggests the affected countries may not yet have seen the full extent of the problem, and that more stores could report trouble while operators work through their equipment.
6. Which devices are vulnerable?
Kitman Coldtech, an Estonian refrigeration company, said the units affected there were older Danfoss models similar to those attacked in France. CERT-FR warned that an end-of-life device left unpatched and exposed to the internet carries a very high risk of compromise, since the manufacturer no longer issues fixes and the exposure gives attackers a direct route in.
Security firm Claroty published flaws in Danfoss AK-SM 800A controllers in August, including an authentication bypass, which lets an attacker skip the login step. The researchers found 2,765 of these devices exposed online. Danfoss fixed the flaws in firmware version R4.3.1. It remains unclear which weaknesses, if any of those, the attackers actually used.
7. Why remote refrigeration controllers are exposed
Commercial refrigeration is no longer a standalone appliance. Large stores run racks of compressors, evaporators and display cases that are managed by controllers, and those controllers are often connected to a network so that service companies can read temperatures, receive alarms and change settings without sending an engineer on site. Retailers adopted this approach because it cuts maintenance costs and shortens response times when a cabinet drifts out of range.
The trade-off is that each connected controller is a computer sitting inside a building, frequently on a mobile data link or a plain internet connection. Such devices are designed to run for many years, and they are not always updated as often as an office laptop. When a manufacturer retires a product line, known weaknesses can stay in the field indefinitely. This is what CERT-FR means in warning about end-of-life equipment that is unpatched and exposed to the internet.
The same pattern appears in the figures from August: Claroty's researchers counted 2,765 Danfoss AK-SM 800A controllers reachable online. A device that can be found from outside the network can be tested by anyone, and an authentication bypass means that the test may succeed without any password. Whether or not these specific flaws were used, the exposure illustrates how a single product family can become a shared point of failure across many retailers and several countries.
8. Why the cold chain is vulnerable
Food retail depends on what is called the cold chain, the unbroken series of refrigerated steps that carries perishable goods from producer to shopper. A fault at any step can ruin the product, and retailers are generally required to discard food that has spent too long above safe temperatures. That is why a freezer pushed to 50°C, far above any safe holding range, means a complete loss of its contents rather than a partial one.
An attack on refrigeration controllers therefore has a direct physical effect with little need for sophistication on the attacker's part. There is no data to steal and no ransom note to display; the damage comes from the equipment doing precisely what it is physically able to do once its settings are changed. The fires reported by CERT-FR show that the consequences can go beyond spoiled stock to safety risks for staff and customers.
The uncertainty over motive adds to the unease. No group has claimed the campaigns, and officials have not said what the perpetrators wanted. Disruption of this kind can be pursued for extortion, for sabotage or simply to test how far access reaches, but none of those explanations has been established, and investigators have said only that the attacks appear to be continuing.
9. What operators and retailers are being told to do
CERT-FR advises operators to take refrigeration controllers off the public internet. Removing a device from direct internet exposure is among the most effective defensive steps, because it prevents attackers from reaching the login page at all, whatever flaws lie behind it.
The advice is easier to give than to follow. Sabcobel's chief executive said many older units need physical modifications that require investment. Until those arrive, there is no real fix for the oldest equipment, leaving retailers to choose between keeping remote access, with its risks, and giving up the monitoring that remote access provides.
For grocers, the immediate task is practical: identify which controllers they operate, whether any are reachable from the internet and which are old enough to lack current firmware. The fixed Danfoss firmware, R4.3.1, addresses the flaws Claroty published in August, but the oldest units cannot simply be updated, as Sabcobel's chief executive pointed out, because they may require hardware changes.
Refrigeration contractors face a related decision. Remote access is a service they sell and a convenience their customers value, yet CERT-FR's guidance to keep controllers off the public internet means that connections may need to be redesigned, for instance by placing them behind secured gateways. Retailers that decide to disconnect devices will lose some visibility until such arrangements are in place.
Regulators and governments are also being drawn in. The agriculture commissioner's description of a deliberate attempt to disrupt the food supply chain places the incidents in the realm of critical infrastructure, and Italy's planned cybersecurity meeting suggests that national authorities are treating the matter as more than an isolated commercial problem.
10. What's next
Italy's government was due to hold a cybersecurity meeting on Tuesday, November 3, in response to the incidents. Belgian federal prosecutors are investigating, and national agencies across the ten affected countries are expected to compare findings. The questions to watch are whether investigators can link the French and Monday incidents, whether a perpetrator is identified, and whether additional retailers report problems as the campaigns continue.