Carrefour

Summary

Supermarket chains across several European countries were hit by suspected cyberattacks that remotely manipulated refrigeration and freezer systems, causing temperatures to rise as high as 55 degrees Celsius and forcing retailers to discard spoiled food. Carrefour reported disruptions at about 15 of its more than 700 stores in Belgium, while other affected retailers included Ahold Delhaize, Spar, Musgrave Group, ICA, Coop, Ikea, and Selver. The attacks targeted internet-connected Danfoss refrigeration controllers, many running legacy software or default passwords on unsecured networks, with similar incidents previously affecting hundreds of stores in France. No group has claimed responsibility, and investigators have not established a financial motive.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In October 2026, a cyberattack targeted refrigeration systems at hundreds of supermarkets across France, affecting approximately 700 stores. The Carrefour chain was among the retailers impacted, along with Intermarche and Cooperative U. Attackers remotely manipulated refrigeration controllers, disabling refrigeration systems and in some cases pushing temperatures above 50 degrees Celsius. The incident forced shops to throw out damaged food and caused extensive food losses, with fires reported at some locations. The compromised equipment included controllers from multiple manufacturers, including older Danfoss and Copeland systems, some of which had reached the end of their supported life and no longer received security updates. Following the attacks, many retailers took vulnerable Danfoss refrigeration-control systems offline for repairs or replacement. Despite these efforts, nearly 5,000 systems remained exposed online and potentially vulnerable as of the week before the next wave of incidents.

On November 2, 2026, a new series of incidents struck refrigeration systems across at least seven European Union countries, including Belgium, Ireland, Sweden, Finland, Estonia, Luxembourg, and the Netherlands. Carrefour Belgium confirmed that refrigeration problems affected about 15 of its more than 700 stores. A spokesperson for Ahold Delhaize said an overnight IT incident affected refrigerators and freezers at dozens of stores in Belgium and Luxembourg. In Ireland, Musgrave Group reported that refrigeration systems at 13 SuperValu stores were affected, forcing some chilled and frozen products to be removed from sale as a precaution. Swedish supermarket chains Coop and ICA reported disruptions, with an ICA supermarket in Sjoebo recording freezer temperatures of 50 degrees Celsius and an ICA Nära store in Boda reaching 55 degrees Celsius. In Estonia, attackers accessed a computer controlling refrigeration equipment at a Selver supermarket and set the temperature to 50 degrees Celsius before the issue was detected and resolved within minutes. In Finland, Kesko detected temperature problems at several smaller K-food stores whose equipment was not covered by centralized security protections. The Netherlands reported targeting of refrigeration and freezer systems at at least 17 businesses, including butcher shops, small neighborhood stores, and a frozen-food storage facility.

The affected systems included internet-connected refrigeration controllers from Danfoss, with some remaining connected to unsecured networks and still using default passwords. Equipment from Copeland was also reported affected in Belgium. Unauthorized access allowed attackers to change temperature settings or activate extended defrost cycles, potentially spoiling large quantities of temperature-sensitive food. Retailers responded by removing affected products from sale, and Musgrave Group stated that all stores were operating as normal after the issue was resolved. Cybersecurity researchers identified more than 20 confirmed attacks against refrigeration systems since the start of the year, many linked to pro-Russian hacktivist groups, though no group publicly claimed responsibility for the November incidents. Even after the attacks became public, nearly 1,000 potentially vulnerable Danfoss systems remained online. Authorities had not identified the attackers or established their motive, and no group had claimed responsibility for the latest wave.

Sources

Sources available to members: 2 sources.