1. Executive summary
A second wave of attacks on internet-exposed refrigeration control systems has spoiled chilled and frozen food at supermarkets in Belgium, Luxembourg and Sweden, three weeks after a comparable campaign hit hundreds of French stores in early October. The affected equipment is manufactured by Danfoss, Copeland and Dixell, and the attackers remotely switched evaporators into defrost mode, warming the units; in Sweden freezer temperatures were reported turned up to 50 degrees Celsius. The root cause is unchanged: management interfaces reachable from the internet running unpatched, often end-of-life firmware with no fix available. No CVE has been assigned and no actor has been attributed. Direct exposure to EMEA financial services is low, but any client whose estate includes internet-facing building-management or cold-storage controllers, or that finances or insures retail supply chains, should treat the exposed-interface pattern as the actionable risk.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
The confirmed sequence, as reported:
- Refrigeration controllers with management interfaces reachable from the internet are identified.
- The attacker remotely changes the operating mode of the unit's evaporator to defrost, which warms the cabinet rather than cooling it.
- Chilled and frozen stock spoils before staff intervene; technicians then disconnect affected units from the network.
Belgian news agency Belga reported that fridges and freezers at Delhaize, Carrefour and Spar were affected, and that the mechanism is "exactly the same" as the October attack on hundreds of French shops. Stephan Moelans, CEO of refrigeration manufacturer and installer Sabcobel, told Belga the attack began around midnight on Sunday and that technicians worked "all night and morning to disconnect the affected units from the network." Delhaize stores in Luxembourg were also hit, per RTL Today. In Sweden, Coop and Ica reported freezer temperatures turned up to 50 degrees Celsius (The Local); an Ica spokesperson told Dagens Nyheter that a small number of stores "have their connection outside Ica's central network" were affected. Colruyt and Intermarche confirmed "technical problems" at some stores but did not attribute them to a cyberattack.
The October campaign, per French cybersecurity agency Anssi, targeted refrigeration control systems from Danfoss, Copeland and Dixell and was made possible by remotely exploitable vulnerabilities in the monitoring systems' internet-exposed management interfaces. Security researcher Kevin Beaumont said the units affected today are "all [management] interface facing internet, same issue and vuln as last time," and that many are end of life with no patch available and "left online."
What public reporting does not give: no CVE identifier, no affected or fixed firmware versions, no specific interface path, port or protocol, no initial-access detail beyond internet exposure of the management interface, and no malware, payload or command-and-control indicators. Moelans said a thorough fix requires a software update plus physical modification of the units; no vendor patch or advisory is named. No actor has been attributed; the source states it is unclear who is behind either wave. The claim that the mechanism is identical to October rests on Belga's reporting and Beaumont's comment, both single-sourced to those parties.
4. Mitigation & containment
P1 (within 24 hours)
- Inventory every refrigeration, cold-storage and building-management controller in the estate and identify which management interfaces are reachable from the internet. Where a unit does not need remote management, remove it from internet reachability at the firewall or by disconnecting it from the network, the action Sabcobel technicians took on affected units.
- For units that must be managed remotely, restrict access to a secure connection rather than direct internet exposure, the change Moelans said most French customers made after the October attack.
- Where a unit is end of life with no patch available, as Beaumont described, treat network isolation as the only control and schedule replacement.
P2 (within 72 hours)
- Apply the vendor software update for Danfoss, Copeland and Dixell controllers where one exists. No specific fixed version is named in public reporting; confirm availability with the manufacturer. Moelans stated a software update alone is insufficient and the units also require physical modification.
- Add monitoring for mode changes on refrigeration controllers (defrost activation outside scheduled cycles, setpoint changes) and alert on them.
P3 (within 7 days)
- For clients that finance, insure or supply retail and cold-chain operators, add internet-exposed refrigeration and building-management interfaces to third-party and counterparty exposure review.
5. Indicators of compromise
No indicators of compromise available in the source material.
The sources describe a behaviour (remote switching of evaporators to defrost via internet-facing management interfaces) but give no atomic indicators, file names, hashes, IPs or domains.
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- Help Net Security, "Second wave of refrigeration cyberattacks hits European supermarkets", https://www.helpnetsecurity.com/2026/11/02/european-supermarkets-refrigeration-units-cyberattacks/, 2026-11-02
8. Adverse Trace position
Adverse Trace assesses this as a low-severity item for EMEA financial services: the victims are retail grocery operators, no CVE has been assigned, no actor is attributed, and no source links the campaign to financial services. The transferable risk is the exposed management interface on unpatched, often end-of-life operational technology, which is common well beyond retail. The mechanism and the October linkage rest on Belga's reporting and Beaumont's comment and are single-sourced; verify against Anssi's October statement before relying on them. We will monitor for a CVE assignment, vendor advisories from Danfoss, Copeland and Dixell, and any Anssi update, and will reissue if attribution or a financial-sector link emerges. Clients with internet-facing refrigeration or building-management controllers should complete the P1 isolation steps now.
Published via PulseTrace — Adverse Trace threat intelligence.