Dive Brief:
- Grocery stores in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden were hacked on Monday in what appears to be a second wave of cyberattacks that focus on the vulnerability of Internet-enabled refrigeration system controls, according to news reports.
- In the apparently coordinated attack, hackers in the early morning used online accessible controls to lock refrigeration and freezer units into defrost mode, causing temperatures to increase to as much as 122 degrees Fahrenheit, forcing stores to empty shelves in affected units, news reports said. Among the stores hit were Coop and ICA in Sweden; Ahold Delhaize in the Netherlands, Belgium and Luxembourg; and Spar and Carrefour in Belgium; among others, according to reports.
- The actions are “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it,” Christophe Hansen, European Union food and agriculture commissioner, told news outlets.
Dive Insight:
Grocery stores in multiple countries were forced to discard millions of dollars worth of products in the earlier incident, three weeks ago. No organization has come forward to take responsibility for either attack.
As with other building systems, refrigeration controls are vulnerable to the extent they use legacy communication protocols like BACnet and Modbus that were developed decades ago without security in mind, security specialists say.
“We’re sitting on a time bomb,” Sean Tufts, field chief technology officer at cybersecurity company Claroty, told Facilities Dive after the earlier incident. “We’ve been talking about set-point tampering … and now it happened [to] our food systems.”
Hackers appear to be targeting systems that use legacy communication protocols.
“I’ve confirmed with folks the impacted freezers … are end of life and have no patch available,” a cybersecurity specialist, Kevin Beaumont, said on Cyberplace.social. “They’ve just been left online to quite literally rot.”
Danish control system manufacturer Danfoss, whose systems were breached in both attacks, said after the first attack its AK-SM800 and AK-SC355 refrigerator regulator systems were involved. In a statement to Agence France-Presse after the first attack, Danfoss called most of the affected equipment “legacy” products that “no longer receive software or security updates.”
In the latest incident, affected systems in addition to Danfoss include those made by Copeland and one of its affiliate brands, Dixell, according to French cybersecurity agency ANSSI.
The agency lists affected systems as Danfoss AK-SC and AK-SM and Copeland and Dixell XWEB.
Cybersecurity specialists are aware of the Danfoss vulnerabilities. In a 2025 alert, the U.S. Cybersecurity and Infrastructure Security Agency disclosed an authentication flaw in Danfoss’s AK-SM 800A system managers. And Claroty’s Team82 unit called out that system’s vulnerabilities in August.
“Our research uncovered a hidden ‘code-of-the-day’ authentication mechanism that could be abused to bypass normal authentication,” the Claroty analysis said. Other vulnerabilities were found as well.
The U.S. Army is investigating whether refrigeration malfunctions at commissaries in some military installations over the summer were also hacks, The New York Times reported.
“The Army’s Criminal Investigative Division … confirmed that its Cyber Field Office was looking into what happened at the commissaries — and working with French law enforcement agencies ‘in understanding the refrigeration outages in Europe,’” the Times report said.
In an email statement to Facilities Dive, a Copeland spokesperson said some of the company’s XWEB monitoring solutions were impacted by the reported cybersecurity vulnerability.
“We are continuing to assess the circumstances and have taken the appropriate actions based on the specific products involved,” the spokesperson said. “As part of our response, we have re-communicated the recommended patching and security protocols to ensure customers have the latest guidance to protect against the identified threats. We are proactively engaging with customers and will continue to provide relevant guidance as appropriate.”
Danfoss did not immediately respond to a request for comment.
