New fridge attacks disrupt more than 100 European stores

More than 100 European stores were affected as supermarket fridge attacks returned, with incidents spanning Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden, and some units reported heat up to 50°C (122°F). The attacks mirror a wave that disrupted European retailers three weeks earlier, and investigators have not confirmed whether the two waves are linked.

France was hit in the first wave, when defrost faults forced tens of thousands of refrigeration units into defrost mode, spoiling food and reportedly causing fires. In the current round, firms including Delhaize, Carrefour and Colruyt reported disruptions to refrigeration across multiple locations, with an IKEA store in Mons cited among those impacted.

Security researchers and officials have highlighted that the technique remains consistent with previous exploits: internet-connected Danfoss AK-SM and AK-SC controllers, along with Copeland and Dixell XWEB systems, were the focus of the attacks. Danfoss advised stores to disconnect from the internet and reconnect only via a secure network; the firm noted many affected devices are legacy models no longer updated.

Deception security firm Lupovis said it observed suspicious activity targeting Danfoss StoreView sensors between 20 and 30 October, largely using factory-default credentials, while Censys reported more than 1,000 exposed Danfoss StoreView interfaces online worldwide, with patch status varying by country. Belgian outlets, including Delhaize and Carrefour locations, were particularly affected, with the Belgian prosecutor opening an investigation. Official commentary from EU bodies emphasised concern over food-disruption implications and resilience of the food supply chain.