A widespread cyberattack targeting supermarket refrigeration systems has expanded across Europe, affecting approximately 700 stores in France and triggering incidents in nine other countries including Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, and Sweden. The attacks, which began in October in France, involve hackers forcing continuous defrost cycles on remote control modules manufactured by Danfoss and Copeland. This manipulation has resulted in spoiled food, equipment overheating—reaching 50°C in Estonian units—and even minor fires in some locations.
French Finance Minister Roland Lescure confirmed the scale of the initial outbreak, noting that while food supplies remain secure, the attack strikes at the core of national food security. Major retail groups such as Groupement Mousquetaires and Cooperative U reported significant store closures or disruptions. In Belgium, federal prosecutors have opened an investigation after Carrefour and other chains experienced similar malfunctions. No group has claimed responsibility for the attacks, leaving authorities to investigate the source and motive.
Security researchers from Claroty identified vulnerabilities in Danfoss AK-SM 800A controllers in August, including authentication bypasses, which may have been exploited. With thousands of these devices exposed online, CERT-FR has advised operators to disconnect controllers from public internet access. However, many older units require physical modifications to mitigate risks, a process that demands investment and time. As the campaigns appear to be ongoing, European governments are convening emergency cybersecurity meetings to address the operational and safety implications of this emerging threat to critical infrastructure.
The expansion of this cyberattack beyond France into multiple European nations highlights a systemic vulnerability in legacy industrial control systems used within the retail sector. Unlike traditional data breaches, this incident directly impacts physical operations and public health safety by compromising cold chain integrity. The reliance on unpatched, end-of-life devices connected to the internet creates a low-barrier entry point for attackers, suggesting that supply chain security protocols for IoT devices in commercial settings are inadequate.
Regulators and industry leaders must now confront the reality that operational technology (OT) in retail is a viable target for disruption. The lack of attribution complicates response strategies, but the immediate priority is isolating vulnerable systems to prevent further spread. Long-term, this event underscores the urgent need for standardized security certifications for industrial controllers and mandatory patch management policies for critical infrastructure components, regardless of their perceived non-critical status.
