Intermarché

Summary

Intermarché reported that fifteen of its 153 stores in Belgium were affected by a cyberattack that raised refrigeration temperatures and led to food disposal. A spokesperson said security measures contained most of the incident while a few locations suffered stock losses that were less severe than a prior wave targeting other retailers in the sector.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Overnight from 1 to 2 November 2026, supermarkets in at least seven European countries experienced sharp temperature increases in refrigeration and freezer units as part of a second wave of cyberattacks within three weeks. The affected countries included Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands, and Sweden. In Belgium, Intermarché reported problems with its refrigeration systems, with media outlet Le Soir counting approximately 15 Intermarché shops affected. CNBC later reported that Intermarché France stated 15 stores out of 153 in total were impacted in Belgium. The incident followed an earlier wave in October 2026 that had targeted hundreds of French supermarkets, causing fires, overheating fridges, and spoiled food. On 12 October 2026, France's CERT-FR had issued an alert regarding numerous compromises of remote controllers for refrigeration installations, specifically naming Danfoss AK-SM and AK-SC series along with Copeland XWEB and Dixell XWEB systems. In the November wave, Swedish, Estonian, Dutch, and Belgian sources again pointed to Danfoss-supplied refrigeration control systems, and Danfoss told Danish broadcaster DR that the incidents reported in several European countries also involved its products. Danfoss and its partners attributed the issues to outdated or end-of-life software.

An Intermarché spokesperson told CNBC that in most cases the security measures in place made it possible to quickly contain the attack, though a few stores did suffer some stock losses, although nothing comparable to the attack in mid-October. The spokesperson added that, at that stage, the information available indicated the bulk of the attack affected other players in the sector, notably Carrefour and Delhaize. Intermarché's owner, Les Mousquetaires, had previously told CNBC during the October incident that it was expecting damages of several million euros. Across the broader November event, temperatures in some affected units climbed as high as 50 degrees Celsius, forcing retailers to discard chilled and frozen food and, in some cases, close stores temporarily or operate with empty cold shelves. In Belgium, the federal prosecutor opened a criminal investigation, and the country's food-safety agency FAVV/AFSCA reminded stores that they must check whether products had exceeded maximum temperatures. The Centre for Cybersecurity Belgium stated it was aware of the incident but had no further information. No group claimed responsibility for the attacks, and Reuters was unable to establish who was behind the 2 November attacks or whether they were linked to the October attacks in France.

Technical reporting established that the targeted systems were remote supervisory and management controllers for commercial refrigeration, which set setpoints, defrost schedules, and alarms for display cases and cold rooms rather than forming part of retailers' core IT infrastructure. Attackers forced evaporators into defrost mode or raised setpoints, pushing cabinet temperatures to approximately 50 degrees Celsius. In France during the earlier wave, Le Monde reported via SecurityWeek that defrost cycles were stretched from one hour to as many as eight, which delayed alarms. Danfoss stated that most affected systems were legacy AK-SM 800 and AK-SC 355 units that no longer receive software or security updates, and that affected AK-SM 800A units were running outdated firmware. A Danfoss spokesperson told VTM NIEUWS on 2 November that the vulnerability lay primarily in outdated software. The initial access method had not been publicly tied to any specific CVE, and no public indicators of compromise had been released by CERT-FR, Belgium's CCB, Sweden's NCSC, or the vendors as of 3 November 2026. Investigations by national authorities and EU agencies, including ENISA and Europol, remained ongoing.

Sources

Sources available to members: 2 sources.