Europe’s Supermarket Freezer Attacks: How Did Hackers Spoil the Food?

Remote controls, physical consequences

Retailers in Belgium, Sweden, the Netherlands, Luxembourg, Ireland, and Estonia reported disruption. A Swedish store reported freezer settings changed to 50°C. That was a controller setpoint, not evidence that every freezer or its contents reached that temperature. Other systems shut down or entered defrost cycles.

Commercial supervisory controllers let contractors manage refrigeration remotely. Unauthorized access can therefore affect connected equipment without an attacker entering the premises or compromising each cooling unit separately.

Warnings followed the French incidents

CERT-FR’s October 12 alert, updated October 16, identified compromises involving Danfoss AK-SM and AK-SC controllers and Copeland/Dixell XWEB systems. It advised removing public access to management interfaces, reviewing configurations, and restoring remote access through protected networks or secure VPNs. It also called for firmware updates and replacement of default passwords.

The entry method and attackers remain uncertain

The Record reported that the Paris prosecutor’s office counted around 700 victims in the earlier French wave. That figure describes a separate incident period and should not be combined with November’s store count as a definitive total. Its November 2 reporting did not establish whether the same attackers conducted both waves.

The sources reviewed do not establish one initial-access method across every installation. Known controller weaknesses and exposed interfaces warrant attention, but do not prove a particular CVE caused every compromise. The incidents show how unauthorized changes to ordinary equipment controls can interrupt operations without a conventional data breach.