Cyberattack on Belgian Supermarkets Reveals Global Risk

Hackers target supermarket cooling systems in Europe: nearly 13,000 refrigeration controllers are accessible across 99 countries, from supermarkets to hospitals and farms, running obsolete software.

A cyberattack has hit the refrigeration systems of dozens of Belgian supermarkets, forcing stores to throw away approximately €100,000 worth of food.

Around 40 Delhaize supermarkets were affected, along with at least 15 Carrefour stores, five Spar locations, and the butcher shop group De Laet en Van Haver. Belgian media reported that temperatures inside refrigerators soared to as high as 70°C.

A spokesperson for Delhaize told Euronews that the company had "identified an IT incident affecting refrigeration systems in several dozen stores."

Issues were also reported in several stores belonging to the Swedish chain ICA. This incident follows a similar attack on October 12, when hundreds of French supermarkets had their refrigeration systems tampered with.

So, how can someone seize control of a supermarket refrigerator or freezer without physically being in the store?

Why are refrigerators connected?

In large supermarkets, refrigeration systems are operated by central management units that monitor temperature, defrost cycles, and alarms for every refrigerated cabinet and freezer throughout the store.

According to research published in October by cybersecurity firm Forescout, connecting these units to the internet has long been an available option. It enables refrigeration contractors to diagnose faults and adjust settings remotely, rather than dispatching a technician to every location.

Danfoss, one of Europe's leading suppliers, states that connecting refrigeration control systems to the internet typically reduces unnecessary technician visits by 15% to 30%, as faults can often be resolved remotely.

The company adds that remote monitoring allows supermarkets to automatically maintain the temperature logs required by food safety regulations, instead of manually checking each unit up to four times a day.

Manufacturers' own installation guides explain how to make these systems accessible from the outside—for instance, by configuring the store router to forward internet traffic directly to the refrigeration controller.

According to Forescout, the underlying issue stems from fragmented responsibilities. A contractor might manage the software, the store owns the hardware, and its IT department oversees the internet connection. Without clearly defined roles, "no single party may have full visibility of the exposed service," the researchers noted.

Some of the hardware is also outdated. One of the affected Danfoss controllers has not been supported since May 2021, meaning it can no longer receive security updates, leaving it vulnerable to external intrusions.

How widespread is the risk?

Using Shodan, a search engine that scans for internet-connected devices, Forescout identified 12,976 exposed refrigeration management services across 6,017 IP addresses in 99 countries and territories.

Most of these belonged to two product families: Copeland and Dixell's XWEB systems (7,075) and Danfoss's StoreView (4,697).

Among the Danfoss services, 80% were running firmware older than the version that fixes known security vulnerabilities. These figures reflect exposed systems, not necessarily those that have been breached.

The risk extends well beyond supermarkets. The same systems are deployed in food processing facilities, wineries, fruit storage warehouses, agricultural operations, and hospital cooling units.

Attackers do not require sophisticated malware. Once inside the system, they can use built-in functions to alter temperatures, initiate defrost cycles, or silence alarms. Forescout highlighted that these modifications can easily blend in with routine operational activity.

What can be done?

Forescout's primary recommendation is to disconnect refrigeration management systems from the open internet and restrict contractor access exclusively through secure remote-access tools.

The firm also urges operators to replace hardware that no longer receives security updates, phase out shared passwords among contractors in favor of individual credentials backed by multi-factor authentication, and maintain comprehensive audit logs of anyone modifying sensitive settings.

Also worth reading

UK and Germany to jointly develop military AI

Dutch lawmaker proposes ban on addictive digital designs

Cyberattack on Belgian supermarkets reveals global risk