Danfoss refrigeration systems have been caught up in a new wave of cyberattacks that disrupted supermarket fridges and freezers across Europe on Monday, 2 November, including stores in Sweden. Attackers remotely altered cooling controls, in some cases raising temperature settings to 50°C and forcing retailers to discard food.
The Danish engineering company Danfoss confirmed to public broadcaster DR that incidents in several countries involved its products. The company identified controllers including the AK-SM800 and AK-SC355, the same models involved in attacks on French supermarkets three weeks earlier. It said it had been helping customers respond to the threat.
Swedish ICA and Coop stores throw away food
In Sweden, both ICA and Coop reported disruption. According to DR’s account of the incidents, at least seven ICA stores and seven Coop shops were affected.
At an ICA supermarket in Sjöbo, southern Sweden, the refrigeration settings were changed to 50°C overnight. The store temporarily closed on Monday morning, while staff removed chilled and frozen products. Store manager Rickard Nilsson told TV4 that staff could not adjust the controls and the food had been ruined.
Swedish public broadcaster SVT also reported affected shops in Skåne, Öland, Värmland and Stockholm. Sweden’s National Cybersecurity Centre (Nationellt cybersäkerhetscenter), working within the National Defence Radio Establishment (Försvarets radioanstalt, FRA), is assisting with the response. Coop confirmed that its problems involved unauthorised manipulation of cooling equipment, according to DR.
Refrigeration attacks spread beyond Sweden
In Belgium, federal prosecutors opened a criminal investigation following reports of attacks affecting at least 76 supermarket and retail locations, including Delhaize, Carrefour and Spar outlets. Delhaize stores in Luxembourg also reported problems, while an IKEA store in Belgium was affected.
In the Netherlands, Danfoss told NOS that cooling systems at at least 17 smaller businesses, including butchers and local food shops, had been attacked. A Selver supermarket in Estonia was also affected, while Ireland‘s SuperValu reported disruptions at 13 shops, with chilled and frozen products withdrawn from sale.
There were also reports from two other Nordic countries, although the circumstances differed. In Finland, a few smaller K-food stores recorded abnormal refrigeration temperatures, but the cause remained under investigation. Kesko said it could not rule out external interference, according to Yle. In Denmark, an unnamed food producer was targeted in an attempted attack on its cooling equipment, but its supplier intervened before operations were disrupted. Danish supermarket operators Coop and Salling Group reported normal operations.
Danfoss refrigeration systems were also targeted in France
The latest incidents come three weeks after cyberattacks on French supermarkets previously covered by NordiskPost. On 12 October, hackers manipulated refrigeration controllers and forced stores to dispose of large quantities of food. The Paris prosecutor’s office has put the number of victims in that wave at around 700, according to Recorded Future News.
Danfoss said that older controllers and systems running outdated software had been involved in the French incidents. It has advised operators not to expose refrigeration equipment directly to the internet, to update supported software and to protect remote connections with firewalls or VPNs. Its Dutch spokesperson told NOS that most customers had acted on warnings issued after the French attack, but some had not.
It is not yet known who carried out Monday’s attacks or whether they were organised by the same people responsible in France. European Commissioner for Agriculture and Food Christophe Hansen described the new incidents as an attempt to disrupt the food supply chain, while stressing that Europe’s food security was not currently at risk, according to Reuters.
