Cold storage systems across Europe face cyberattacks, echoing similar incidents in France, exposing vulnerabilities in remote control systems and raising security concerns.
New cold storage disruptions in Europe
Three weeks after attacks on French supermarkets, new incidents are affecting cold storage systems across Europe. Local installations reveal the limits of centralized protection for retail chains. Swedish and other European stores affected
On November 2, COOP detected disruptions in the refrigeration systems of seven Swedish stores. Some equipment stopped, others operated partially, in one establishment, the system began producing heat. Other European countries also impacted
During the same night, incidents were reported in Belgium, the Netherlands, Luxembourg, Ireland, and Estonia. In Finland, a few stores also noted temperature anomalies. Similar to French attacks in October
The resemblance to the French attacks in October is more than strong. In October, cold storage systems became a visible target. During the night of October 11 to 12, refrigeration systems in hundreds of French stores were disrupted. French attacks caused massive losses
Stores had to remove and discard their fresh or frozen products. Estimates reported in the press go up to 700 affected stores, with losses estimated in the tens of millions of euros. Security vulnerabilities in remote controllers
On October 12, CERT-FR published an alert on the compromise of remote controllers. The following day, it expanded the list of affected equipment. The AK-SM and AK-SC series from DANFOSS are listed, as well as the XWEB systems from COPELAND and DIXELL. How remote controllers function
These controllers perform a discreet but essential function. They allow monitoring of installations, adjusting their parameters, and organizing their maintenance. An intervention that previously required a visit can now be carried out from a remote interface. Vulnerability in centralized systems
Maintenance commands can be used to destroy stock. The DANFOSS AK-SM 800A supervisor is a centralized management point for the refrigeration environment; its interface provides access to temperature thresholds, operating hours, notifications, and user accounts. Impact of temperature deviations
Once a command access is compromised, disrupting the installation can consist of diverting its normal functions. Understanding the damage. A setpoint adjusted to 50 °C does not mean that all products have reached this temperature. Responsibility for refrigeration security
A single name on the storefront does not mean that all stores use the same equipment or apply the same security rules. In Belgium, COLRUYT specifies that the five SPAR stores affected are operated by independent entrepreneurs with their own refrigeration systems. Challenges in securing systems
The difficulty lies in the sharing of responsibilities. The manufacturer provides updates for its equipment. The refrigeration technician installs and maintains the equipment. The retailer operates the store and suffers losses when temperatures rise. IT departments and store access
As for the IT department of the chain, it does not necessarily have access to the installations of each store. When a vulnerability is reported, who ensures that it is corrected in all stores? Post-attack changes in exposure
CENSYS data show that the first wave was followed by a significant change. The number of DANFOSS StoreView interfaces visible on the Internet in France decreased from 1,825 on October 11 to 220 on November 2, a decrease of 88 percent. Global exposure still high
The firm nevertheless still observes a little more than 1,000 instances exposed worldwide. In Belgium, it counts 138, compared to 51 in the Netherlands and 50 in Sweden. Remaining vulnerabilities
Although the number of refrigeration equipment directly accessible on the Internet has decreased, an equipment that has become inaccessible from the Internet can still be a carrier of a vulnerability. Security fixes not enough
CERT-FR reminds that resetting an equipment does not correct its security flaw. To prevent a new intrusion, it is necessary to eliminate its direct access from the Internet, apply the fixes, and secure its configuration. Response time is critical
A few minutes can change the balance. In Estonia, KITMAN COLDTECH reports an intervention in a few minutes, without significant damage, while SELVER confirms an affected store. Quick resolution in Ireland
In Ireland, MUSGRAVE announces that the incident affecting thirteen SUPERVALU stores was resolved by Monday afternoon and that restocking has begun, according to Associated Press. Importance of detection and action
These situations are not comparable, but they highlight the importance of response time. Between the initial access and the destruction of stock, the detection of a deviation, the transmission of the alert, and the mobilization of a technician can influence the economic consequences. Nighttime operations and continuity
For a manager, the continuity of operations is therefore played out in the organization of the night: who receives the alert, who can intervene, and how to preserve the goods during the restoration. Unknown perpetrators and motives
Sabotage is a hypothesis, the perpetrator remains unknown. The absence of a ransom demand reported and the destruction of goods make a sabotage objective plausible, but do not prove an official operation or a single campaign. Investigations ongoing
At the time of the information consulted, investigators have not publicly established the link between the different incidents, according to Reuters. The federal prosecutors' office in Belgium has opened an investigation. Ongoing investigations in Finland
In Finland, KESKO still indicates that it is searching for the cause of the anomalies detected in a few small stores, without ruling out a remote intervention. Key points of the incident
The key points of the dossier as of November 3, 2026. First wave: night of October 11 to 12 in France. New wave: incidents reported on November 2 in Belgium, the Netherlands, Luxembourg, Sweden, Ireland, and Estonia; anomalies still under study in Finland. Target and unknowns
Operational target: refrigeration system monitoring and control systems. Unknowns: author or authors, link between the waves, access methods used in each installation and consolidated European cost. Broader implications
This affair places maintenance equipment in the field of management decisions. Their lifespan, their software support, and their remote access directly affect operations. Beyond data security
For companies that operate these installations, a question arises: do they know who can access them, by what means, and who must intervene in case of intrusion? Maintenance contracts must specify who applies the updates, secures the access, and verifies that the protections remain effective over time. Cybersecurity as part of maintenance
The stakes go beyond data protection. A malicious command can interrupt an activity, destroy goods, or, depending on the equipment and its security devices, put people in danger. Cybersecurity is now part of maintenance: an installation can no longer be considered properly maintained if its remote access remains uncontrolled.
