New Wave of Fridge Cyberattacks Disrupts Supermarkets in Belgium, Luxembourg, Sweden and Estonia
What Happened — Over the night of 2 Nov 2026, refrigeration units in dozens of supermarkets belonging to Ahold Delhaize, Colruyt, ICA and Coop suddenly raised their temperature to ≈ 50 °C. The spike was traced to a remote manipulation of the forced‑defrost function in Danfoss‑manufactured chillers. The attack rendered freezers and fridges inoperable, caused food spoilage, and in some cases ignited fires. The incidents follow a similar campaign that hit French supermarkets in October 2026, indicating a repeatable threat against IoT‑based cold‑chain equipment across Europe.
Why It Matters for Trust & Control Assurance — The episode highlights the need for robust configuration‑management and continuous monitoring of OT assets, a control area that underpins audit readiness across multiple frameworks.
Who Is Affected — Retail & grocery chains operating IoT‑enabled refrigeration; IoT device manufacturers and their supply‑chain partners.
Recommended Actions
- Inventory all connected refrigeration assets and map them to a central configuration‑baseline.
- Deploy continuous integrity monitoring for firmware versions and command‑and‑control interfaces.
- Validate vendor security assurances and enforce secure update processes.
- Conduct tabletop exercises that include OT‑focused incident response.
Source: Security Affairs
Technical Notes — Attack vector: remote exploitation of Danfoss chillers’ forced‑defrost command (likely via unauthenticated API or default credentials). No CVE was disclosed at the time. Impacted data: operational temperature settings; physical loss of perishable goods. Source: same article