European authorities probe ongoing attacks targeting grocery refrigerators

Authorities are investigating a new wave of cyberattacks targeting refrigeration devices in supermarkets across multiple European countries.

Hackers accessed dozens of internet-exposed refrigerator devices at major grocery chains and reset the controls to defrost. The attacks follow a similar incident at hundreds of French supermarkets in October.

The European Commission is in direct contact with various national authorities and convened a meeting Tuesday with the EU interinstitutional task force, according to a spokesperson. The meeting will include agencies responsible for law enforcement and cybersecurity across the region.

"These incidents show once again how cyberattacks can disrupt essential services, affect businesses and have very real consequences for people's daily lives," the EU spokesperson told Cybersecurity Dive.

The U.K. National Cyber Security Centre confirmed it is working with international partners to investigate attacks on devices in that country.

"We are aware of a small number of U.K. organisations that may be affected by this incident as a result of vulnerabilities on their systems, and the NCSC is supporting those that may be impacted," a spokesperson told Cybersecurity Dive.

In the U.S., the Retail and Hospitality Information Sharing and Analysis Center (RH-ISAC) issued two advisories on the refrigerator hacks in October and is scheduled to discuss the matter with experts Thursday.

RH-ISAC's operational technology working group will meet with security experts from Google Cloud, to get an overview of the attacks and learn how to help network defenders better protect their environments

Military outages

U.S. military officials in October confirmed they were working with French law enforcement to investigate a series of refrigerator outages at U.S. military commissaries. At least a half-dozen refrigerator systems at U.S. military facilities were impacted by mysterious outages in August.

The Department of Army Criminal Investigation Division (CID) has been working with the Defense Commissary Agency and the Defense Criminal Investigative Service to understand what led to the outages, a spokesperson for Army CID told Cybersecurity Dive.

The attacks impacted major supermarket chains across multiple countries in Europe.

Sweden-based ICA said a suspected cyberattack affected refrigeration and freezers at 23 of its stores. The incident involved control systems supplied by an external provider.

"All affected stores had their equipment connected outside ICA's centrally managed store network," a spokesperson told Cybersecurity Dive via email." Eight of the stores have had to dispose of refrigerated and frozen products, while the impact on the remaining stores has been more limited.

The company said its central IT systems have not been affected by the attack. The company is providing assistance to the affected stores, with logistics, IT security and food-safety guidance.

Finland-based Kesko confirmed that it "detected temperature irregularities" in the refrigeration equipment at a few of its K Group grocery stores, according to a spokesperson. The company said the disruption was not widespread, impacting "only a handful" of its 1,100 stores.

"We are still investigating the cause, and network-based interference has not yet been ruled out," the spokesperson told Cybersecurity Dive.

Ahold Delhaize said it detected an incident impacting refrigerators at dozens of stores on Monday. The company said that operations have since returned to normal.

"Deliveries are proceeding as planned, and Delhaize stores are once again fully operational," the spokesperson told Cybersecurity Dive.

Colruyt Group, a Belgian grocery retailer, confirmed the incident impacted refrigeration at five of its Spar stores.

"These stores are operated by independent entrepreneurs who have their own refrigeration systems," a spokesperson told Cybersecurity Dive. "There are issues with different suppliers."

Risky devices

In an August report, researchers at Claroty warned of critical flaws in Danfoss refrigerator controllers. The operational technology specialists found that an authentication-bypass flaw in Danfoss AK-SM 800A allowed attackers to bypass standard password requirements and achieve remote code execution.

The flaws were tracked as CVE-2025-41450 and CVE-2025-41451. Researchers originally notified Danfoss of the vulnerabilities in 2025 and waited until August 2026 under a coordinated disclosure agreement to give the company time to mitigate the flaws and notify customers.

"This second wave of attacks on refrigeration systems in Europe highlights a growing trend: threat actors are increasingly targeting widespread, high-impact disruptions to essential services," said Amir Preminger, CTO at Claroty.

Thousands of refrigerator controllers have been exposed to the internet and are at risk of hacking, according to researchers. A report Monday from Censys shows about 1,000 Danfoss StoreView systems are exposed globally.

Copeland previously told Cybersecurity Dive that a number of the prior attacks may have involved xweb devices that were no longer receiving support.

The compqny confirmed Tuesday some of its xweb controllers were targeted in the latest round of attacks, in relation to the previously disclosed vulnerabilities.

Editor's note: Updates with comment from RH-ISAC, the UK NCSC and Copeland.