Critical infrastructure · Briefing
Suspected attacks disrupt supermarket refrigeration across Europe
Retailers report overheating and spoiled stock after overnight refrigeration incidents. Defenders should assess who can remotely change cooling controls and how unsafe commands are stopped.
Kinwilder research desk · · AI-assisted analysis
What is established
Suspected cyberattacks manipulated supermarket refrigeration overnight into 2 November 2026, with reported food spoilage. The Record’s report, published that day, identifies affected stores in Sweden, Belgium, Ireland, Estonia, the Netherlands and Luxembourg. It reports older Danfoss equipment in Estonia and Copeland equipment in Belgium. After October’s French attacks, both manufacturers described affected devices as mainly discontinued and unsupported. Source: The Record.
Security Affairs, also published on 2 November 2026, names Ahold Delhaize, Colruyt, ICA and Coop among retailers reporting incidents. It relays Sabcobel’s account of evaporators being switched into defrost mode. For October’s French attacks, it attributes an account of obtained login details and internet-exposed controls to consultant Emil Olofsson. Source: Security Affairs.
Who is behind it
Attribution is not established. The Record reports no responsibility claim for either wave and no authority identification of the perpetrators; whether the waves share operators is unknown. Source: The Record.
Analysis: Similar symptoms cannot establish shared operators, motive or state involvement. The countries above describe affected stores, not an attacker’s location.
Our analysis
Original analysis: The authorization invariant is straightforward: only explicitly authorised people and services should change refrigeration operation, and remote commands should remain subject to locally enforced safety constraints. A successful login alone cannot establish that a requested change is safe.
The reported French access route suggests a hypothesis for defenders to assess: a reachable management interface could allow unauthorised users to misuse a legitimate control function. That does not establish the entry method for November’s incidents. The investigation must distinguish account misuse, software flaws and changes made through a service provider’s access.
A practical exposure assessment should therefore cover every path capable of changing operating modes, including contractor connections. An inventory limited to corporate computers could miss the systems that directly affect stock and equipment. Watch next for confirmed controller models, access evidence, manufacturer remediation instructions and independently verified recovery information. Those details would help determine whether sites share a technical weakness or merely similar outcomes.
Defensive actions
The following are Kinwilder’s defensive recommendations, except where attributed:
-
Check physical conditions first. Have refrigeration engineers verify operating modes and compare controller readings with independent measurements. Coordinate suspected overheating with site safety procedures and food-safety staff. Agree on a safe local operating arrangement before disconnecting control equipment.
-
Restrict remote changes. Inventory controller interfaces and contractor access paths. Remove unnecessary public exposure and limit necessary administration to approved connections and named accounts. Preserve relevant evidence before changing access settings where operational safety permits. Rotate credentials if investigation identifies compromise; avoid assuming that a password change alone resolves the entry path.
-
Hunt across control and access records. Preserve controller configuration histories, authentication records, remote-access gateway logs, firewall records and contractor maintenance records where available. Look for unexpected operating-mode changes, unfamiliar sessions, repeated changes outside maintenance windows and alarms followed by configuration edits. Correlate these with independent temperature records and staff observations.
-
Match remediation to the equipment. Security Affairs reports Swedish cybersecurity authority guidance to update or patch exposed operational technology. Source. Confirm support status and obtain model-specific instructions from the manufacturer and installer. Assess replacement or isolation where support has ended. Test alarms, access restrictions and safe recovery procedures with the refrigeration team before relying on them.
Key concepts
- Operational technology: Equipment that monitors or changes physical processes, including cooling.
- Defrost mode: A normal function for removing accumulated ice; controlling when it operates matters to safe refrigeration.
- Authorization: Permission to perform a particular action. Authentication establishes identity; authorization determines what that identity may change.
Limits
Neither report supplies a CVE, exact affected model list or fixed release. The November entry method, complete impact and overall recovery status remain unconfirmed. Security Affairs draws partly on other outlets; two publishers do not establish two independent investigations. The packet does not establish data theft. Kinwilder did not reproduce the reported behaviour.
Kinwilder briefing: AI-written analysis of public reporting, checked in a separate AI review against the linked sources. No human expert review or independent reproduction is implied.