Key facts
- France's CERT-FR tied the compromises to remote control modules made by Danfoss and Copeland, and no group has claimed responsibility.
- Estonian units were pushed to 50°C (122 °F), and Estonia's Kitman Coldtech said they were older Danfoss models.
- Groupement Mousquetaires, which owns Intermarché and Netto, counted 300 stores affected; Cooperative U said 80 of its 2,000 shops were hit.
- Lescure said food supplies were not at risk but said the attack touches the heart of food security.
- Claroty found 2,765 Danfoss AK-SM 800A controllers exposed online, and Danfoss fixed flaws in firmware R4.3.1.
- CERT-FR advised operators to take the controllers off the public internet, and Sabcobel's CEO said older units need physical modifications.
Supermarkets in nine more European countries reported refrigeration systems that heated up overnight on Monday, after about 700 of France's 10,000 stores were affected in October, according to France's CERT-FR. Stores in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden reported problems, and Estonian units were pushed to 50°C (122 °F).
CERT-FR tied the compromises to remote control modules made by Danfoss and Copeland. No group has claimed responsibility. The agency said hackers forced a continuous defrost cycle, which spoiled food and sparked fires at some stores, and warned the campaigns were probably still ongoing.
French Finance Minister Roland Lescure told Parliament on October 13 that about 700 of the country's 10,000 supermarkets were affected. Groupement Mousquetaires, which owns Intermarché and Netto, counted 300 stores affected, while Cooperative U said 80 of its 2,000 shops were hit. Lescure said food supplies were not at risk but said the attack touches the heart of our food security. Some Mousquetaires display cases were still out of service that Tuesday.
In Belgium, Carrefour reported disruption at about 15 of its 700 stores, refrigeration contractor Sabcobel said evaporators had been switched into defrost mode, and federal prosecutors opened an investigation. Four Delhaize outlets in Luxembourg reported problems. Italy's Radenza Group, which runs Coop-branded stores in Sicily, said the attack began at 4 a.m. local time and targeted the remote-control system for frozen food sections. Ireland's Musgrave counted 13 SuperValu stores affected, and Mosqueteiros confirmed incidents at seven Intermarché stores in Portugal.
In Sweden, Coop said six of its roughly 800 stores were hit and that they ran on 4G connections, making them more exposed. Ica said a limited number of stores had problems and that the affected shops used an external Danfoss control system. Neither chain has confirmed a cyberattack, and Finland's Kesko said network interference has not been ruled out.
EU Agriculture Commissioner Christophe Hansen called the incidents a deliberate attempt to disrupt the food supply chain. Investigators have not said whether Monday's wave is linked to the French attack. Estonian refrigeration firm Kitman Coldtech said the affected units were older Danfoss models similar to those attacked in France.