European authorities probe ongoing attacks targeting grocery refrigerators

Authorities are investigating a new wave of cyberattacks targeting refrigeration devices in supermarkets across multiple European countries.

Hackers accessed dozens of internet-exposed refrigerator devices at major grocery chains and reset the controls to defrost. The attacks follow a similar incident at hundreds of French supermarkets in October.

The European Commission is in direct contact with various national authorities and convened a meeting Tuesday with the EU interinstitutional task force, according to a spokesperson. The meeting will include agencies responsible for law enforcement and cybersecurity across the region.

“These incidents show once again how cyberattacks can disrupt essential services, affect businesses and have very real consequences for people's daily lives,” the EU spokesperson told Cybersecurity Dive.

Military outages

U.S. military officials in October confirmed they were working with French law enforcement to investigate a series of refrigerator outages at U.S. military commissaries. At least a half-dozen refrigerator systems at U.S. military facilities were impacted by mysterious outages in August.

The Department of Army Criminal Investigation Division (CID) has been working with the Defense Commissary Agency and the Defense Criminal Investigative Service to understand what led to the outages, a spokesperson for Army CID told Cybersecurity Dive.

The attacks impacted major supermarket chains across multiple countries in Europe.

Sweden-based ICA said a suspected cyberattack affected refrigeration and freezers at 23 of its stores. The incident involved control systems supplied by an external provider.

“All affected stores had their equipment connected outside ICA’s centrally managed store network,” a spokesperson told Cybersecurity Dive via email.” Eight of the stores have had to dispose of refrigerated and frozen products, while the impact on the remaining stores has been more limited.

The company said its central IT systems have not been affected by the attack. The company is providing assistance to the affected stores, with logistics, IT security and food-safety guidance.

Finland-based Kesko confirmed that it “detected temperature irregularities” in the refrigeration equipment at a few of its K Group grocery stores, according to a spokesperson. The company said the disruption was not widespread, impacting “only a handful” of its 1,100 stores.

“We are still investigating the cause, and network-based interference has not yet been ruled out,” the spokesperson told Cybersecurity Dive.

Ahold Delhaize said it detected an incident impacting refrigerators at dozens of stores on Monday. The company said that operations have since returned to normal.

“Deliveries are proceeding as planned, and Delhaize stores are once again fully operational,” the spokesperson told Cybersecurity Dive.

Colruyt Group, a Belgian grocery retailer, confirmed the incident impacted refrigeration at five of its Spar stores.

“These stores are operated by independent entrepreneurs who have their own refrigeration systems,” a spokesperson told Cybersecurity Dive. “There are issues with different suppliers.”

Risky devices

In an August report, researchers at Claroty warned of critical flaws in Danfoss refrigerator controllers. The operational technology specialists found that an authentication-bypass flaw in Danfoss AK-SM 800A allowed attackers to bypass standard password requirements and achieve remote code execution.

The flaws were tracked as CVE-2025-41450 and CVE-2025-41451. Researchers originally notified Danfoss of the vulnerabilities in 2025 and waited until August 2026 under a coordinated disclosure agreement to give the company time to mitigate the flaws and notify customers.

“This second wave of attacks on refrigeration systems in Europe highlights a growing trend: threat actors are increasingly targeting widespread, high-impact disruptions to essential services,” said Amir Preminger, CTO at Claroty.

Thousands of refrigerator controllers have been exposed to the internet and are at risk of hacking, according to researchers. A report Monday from Censys shows about 1,000 Danfoss StoreView systems are exposed globally.