Second Wave of Suspected Cyberattacks Hits European Supermarket Freezers

On November 2, a wave of grocery stores across Belgium, Estonia, Ireland, Luxembourg, the Netherlands, and Sweden started to report issues with their in-store refrigeration and freezer units, due to suspected cyberattacks. The attacks have reportedly impacted dozens of supermarkets, forcing some to discard food.

The latest wave of attacks comes three weeks after hundreds of supermarkets across France reported that attackers had manipulated system settings in internet-connected refrigerator management systems. 

“The attacks resemble those in France in both timing, targeting, and execution—early morning temperature adjustments meant employees were least likely to be able to immediately respond, and refrigerator temperatures in some stores were reportedly raised to 50 degrees Celsius (122 degrees Fahrenheit),” according to researchers with the Censys ARC research team in a Monday analysis of the attack. 

Supermarket chains Carrefour, Coop, Delhaize, ICA, Selver, SuperValu, and Spar are among those impacted. In a Facebook post earlier today, Swedish retailer ICA said the temperature of refrigerators were set to 50 degrees Celsius (122 degrees Fahrenheit).

The previous set of attacks in France were linked back to internet-connected refrigeration controller models (specifically the AK-SC series and AK-SM series) from Danfoss, a Danish manufacturing company whose popular controllers help manage refrigeration infrastructure in supermarkets, warehouses, and more. While not all the controller models in this more recent attack have been confirmed, at least one supermarket (ICA) has reportedly pointed to Danfoss models in its environment.

Since these systems provide centralized management for refrigeration equipment, attackers that compromise them can potentially tamper with refrigerator units themselves. In an August report, Claroty’s Team82 researchers uncovered multiple flaws in Danfoss models, including one that could enable privileged access to the device’s web management interface via a specially crafted authentication request containing a generated “code of the day” (CVE-2025-41450), and another that could enable remote code execution (CVE-2025-41451).

In a November 2 post to Twitter, researchers with Previdian said that they observed an IP (188.208.141[.]210) send three identical StoreView login attempts to Previdian’s Danfoss AK-SM decoys using factory default credentials that are publicly documented by Danfoss.

“This activity is different from CVE-2025-41450,” researchers said. “The requests were normal StoreView authentication attempts using the default credentials, not the authentication bypass technique associated with that vulnerability… To be clear. There is currently no evidence connecting this source IP or login activity to the supermarket incidents. Although the timing is significant. We had not seen these attacks before October 27th.”

By tracking each StoreView host’s Last-Modified HTTP header and matching it to the timestamp to the build date of the firmware, Censys was able to track exposed devices, and found over 1,000 Danfoss StoreView instances exposed globally. Researchers said that France, Belgium, and the U.S. are the leading countries with exposed Danfoss StoreView interfaces.

“We note that France continues to show dramatic declines in StoreView exposures; prior to the attack in October, we observed 1,825 total exposures—regardless of firmware version—in France, with a steep decline over the subsequent days, landing at 537 on October 14,” said Censys analysts. “At the time of analysis, we observe only 220 total exposures of StoreView in France, 41% of which appear to be running a patched firmware version.”

No group has claimed responsibility for the attacks, and authorities have not given any official attribution on the group behind it. This is a developing story, and we will continue to update this post as more information emerges.