The latest wave of refrigeration cyberattacks has moved well beyond the Belgian and Luxembourg stores that first reported disruptions, with affected supermarkets now confirmed in Sweden, Ireland, the Netherlands, Estonia, Finland, and reportedly Italy and Portugal, suggesting a coordinated operation that security officials are treating with mounting alarm . By Tuesday morning, Delhaize, Carrefour, and Spar had all confirmed their refrigeration systems were functioning normally again, but the damage assessment at Delhaize remains ongoing, and the chain has advised its independent operators to work with technical partners to harden their systems against further intrusion . The European Commission convened two crisis meetings on Tuesday, bringing together its own services, the EU cybersecurity agency Enisa, Europol, and the network of national cyber crisis liaisons, a spokesperson emphasizing that the incidents are not isolated and require a collective response because they span multiple member states .
What makes this second wave particularly troubling is the apparent replication of a technique that security researchers had already flagged after the October attack in France, where attackers forced evaporators into defrost mode and pushed temperatures as high as 50C, spoiling food and in some cases sparking fires . Stephan Moelans, chief executive of the Belgian refrigeration firm Sabcobel, said after the French incident that his company had been working to protect customer fridges against the vulnerability but that the units required physical modifications, not merely software updates, a detail that points to a structural weakness in internet-connected cooling controllers that cannot be patched overnight . The affected equipment has been linked in reporting to controllers manufactured by Danfoss and Copeland, though the precise attack vector and the question of whether outdated firmware or default credentials opened the door remain under investigation .
The attribution question looms larger with each passing day, and the absence of any claim of responsibility has done little to quiet speculation. Irish security sources have said investigators are examining whether the operation was a test run for future ransomware demands, a hostile state action, or a hybrid of both, while analysts cited in European media have pointed to patterns consistent with Russian state-sponsored activity without offering definitive proof . The European Commission’s spokesperson declined to be drawn on attribution, saying only that national authorities are leading the inquiry, but the agriculture commissioner has described the attacks as a deliberate attempt to disrupt the food supply chain and undermine consumer confidence . What is clear is that the attackers achieved something rare: a physically consequential cyber operation with no ransom note, no data theft, and no apparent motive beyond disruption itself.
For retailers and the technicians who keep their cold aisles running, the immediate challenge is less about identifying the culprit than about closing an exposure that has now been demonstrated twice in three weeks. The simplest fix, according to Moelans, is to manage fridges over a secure internet connection rather than leaving controllers reachable through public networks, a migration most of his customers made after the French attack but which evidently left gaps . Whether those gaps were closed in time, or whether a third wave is already being prepared, is the question no one in Brussels or in the affected supermarkets can yet answer with confidence.
#freezerhack #cyberattack #Europe #foodsecurity #criticalinfrastructure #Danfoss #OTsecurity