Supermarket freezer attacks reach at least six European countries, and the record linking them to US base failures stays thin

Editor’s Note: Attackers changed refrigeration controller settings overnight into Monday, Nov. 2, at over 100 stores in at least six European countries, including Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden, according to SecurityWeek. Retailers in Italy and Portugal have also confirmed incidents. The wave came three weeks after about 700 French supermarkets were hit. Danfoss and Copeland equipment is named in the European cases, but no official body has identified who did it. Reuters reported that the Pentagon is treating late-August freezer failures at six or more U.S. military commissaries as a suspected hack, and Defense One reported that U.S. officials suspect Iran-linked hackers, citing two people who said that view could change; no report names the bases’ equipment.

For cybersecurity, information governance and eDiscovery professionals, the open question is records custody. France’s CERT-FR tells operators of a compromised Danfoss controller to restart it or restore factory settings, with no step for preserving logs first, while Italy’s National Cybersecurity Agency tells operators to preserve logs and configurations before any step that could erase them.

Neither names incident-specific custodians or divides that duty between retailers and contractors. Watch whether investigators link the waves and whether claims or lawsuits turn on reset devices.

News Analysis – Cybersecurity Beat

Supermarket freezer attacks reach at least six European countries, and the record linking them to US base failures stays thin

ComplexDiscovery Staff

A freezer at a Selver supermarket in Estonia was remotely set to 50 degrees Celsius early Monday, Nov. 2, and its stock survived because the store’s refrigeration partner responded within 10 minutes. Stores in at least five other European countries were hit that night, and U.S. military investigators are asking whether something similar spoiled food at base commissaries in August.

Jann Mutso, head of the refrigeration technology maker and distributor Kitman Coldtech, told public broadcaster ERR that attackers got into an older-generation Danfoss system’s control computer. He said the freezer warmed by only 2 to 3 degrees Celsius before normal temperature returned. Selver communications chief Mariann Järvela told ERR that the chain had been updating its refrigeration controllers store by store. “This was the last Selver store where the new system had not yet been taken into use,” she said. The Estonian near miss is the cleanest data point in a story built otherwise on partial counts, unnamed officials and a few equipment makers’ names. It also raises the question that will matter once insurers and litigants arrive: who holds the record of what changed, when and from where.

How far the Nov. 2 wave spread

That question now reaches far beyond one Estonian store. By Tuesday, SecurityWeek counted over 100 affected stores. It listed businesses hit in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden. Retailers in Italy and Portugal have also confirmed incidents. Belgium carried the heaviest load: Delhaize said an “IT incident” affected refrigeration at several dozen stores, mostly in Belgium with a few in Luxembourg, and Carrefour said 15 of its over 700 Belgian stores were affected. Ireland’s Musgrave pulled chilled and frozen products from 13 SuperValu stores where one refrigeration model was involved. In Sweden, ICA said only “a limited number” of stores were affected. Finland’s Kesko reported unusual temperatures at a few smaller stores and said the cause was under investigation, so the Finnish case rests on a retailer’s description rather than a confirmed attack. In Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores, SecurityWeek reported. In Italy, the Radenza group confirmed an attack on the remote control system for frozen food sections at four or more Coop supermarkets it runs in Sicily, according to AFP, and alerted the national cybersecurity agency, according to SecurityWeek. The agency republished its refrigeration bulletin on Nov. 3, citing recent events detected in the country.

That wave followed a larger one in France. French Finance Minister Roland Lescure told Parliament on Oct. 13 that about 700 of France’s 10,000 supermarkets were affected by attacks overnight from Oct. 11 to 12. The Paris prosecutor’s office put the number of victims at around 700 in comments to Recorded Future News. Reuters has described the French attack as reaching over 350 establishments, a figure that need not conflict with the official count, though the reports do not show that each counted the same way.

Equipment, not an actor, ties the European cases

Across both waves, the public record ties the European cases together through equipment makers and a method, not an identified actor. CERT-FR, the incident response team of France’s national cybersecurity agency, ANSSI, issued an alert on Oct. 12 naming Danfoss AK-SM and AK-SC series controllers. It added Copeland xweb and Dixell xweb devices the next day. In the Nov. 2 wave, Mutso named the older Danfoss system in Estonia, and an ICA spokesperson told AFP that all of the chain’s affected stores were connected to an outside control system supplied by Danfoss. A Danfoss spokesperson told Dutch broadcaster NOS that at least 17 businesses in the Netherlands were hit, and a Belgian butcher told NOS that Copeland equipment was also attacked. Musgrave’s statement in Ireland did not name a maker.

Contractors and the vendor describe a common method as well. Stephan Moelans, chief executive of the Belgian installer Sabcobel, told the Belga news agency that attackers forced units into defrost mode, as in France, and Danfoss said the Dutch attacks matched the French one in kind. A similar technique is not the same as a common culprit, and no official body has named one. “It is not known who is behind this attack, and it may never be possible to identify them,” Katrien Eggers, spokesperson for the Centre for Cybersecurity Belgium, told Recorded Future News. Belgium’s federal prosecutor’s office has opened a criminal investigation, and no group has claimed either wave. Even the EU’s political response stops short of a name. Agriculture Commissioner Christophe Hansen described the attacks as aimed deliberately at the food supply chain and at consumer trust, while saying the bloc’s food security was not currently threatened, SecurityWeek reported.

The American thread runs through unnamed officials

On the U.S. side, the evidence is thinner still. Reuters reported on Oct. 29 that the Pentagon was treating late-August freezer failures at military bases as a suspected hack, citing four officials. A Reuters review of the bases’ own Facebook posts and website updates found at least six commissaries affected. Reuters said Fort Huachuca, Arizona, posted on Aug. 26 that its freezer had gone into defrost mode and heated the food, the same symptom French and Belgian stores reported. The Pentagon said a Cyber Command unit was “working in close coordination with interagency and law enforcement partners,” according to Reuters, and the Army Criminal Investigation Division said it was working with French law enforcement.

Defense One reported on Nov. 2 that U.S. officials suspect Iran-linked hackers, citing two people familiar with the matter. The same report said the assessments might shift as the inquiry develops. Neither report identifies the equipment involved, and Reuters said it was unable to determine which make of controller, Danfoss or otherwise, the affected bases used. In September, the Defense Commissary Agency said separate refrigeration outages at four of its stores in Germany and England were unrelated to the U.S. failures. As of Nov. 3, the transatlantic link rests on investigators talking to one another and on a shared symptom, not on any device, vendor or integrator named in the public record.

Two national alerts treat the records differently

That gap matters because the records that could close it likely sit on the devices and with whoever services them, and official cleanup guidance reaches those devices first. CERT-FR’s alert, last updated Oct. 16, tells operators of a compromised Danfoss device to remove its internet exposure and restart it or, failing that, restore factory settings. The operator then reconfigures the device before returning it to service. The alert explains that a reset removes a compromised instance’s persistence, though an unpatched end-of-life device left online will almost certainly be compromised again. Its steps, as last updated, contain no instruction to preserve logs or configuration before the restart or reset.

Italy’s National Cybersecurity Agency, ACN, goes further in a bulletin first issued Oct. 13 and republished Nov. 3. It tells operators to preserve logs, configurations and other material useful for analysis before any operation that could erase them, as far as securing the equipment allows. Restarts, factory resets and reconfigurations should be planned with the manufacturer or maintenance contractor, preserving that material where possible, the bulletin says. It also asks operators to analyze available logs going back 90 days where they are retained, and to correlate controller events with VPN, firewall, identity and remote-support records. Neither alert names the custodians of a given incident’s records or divides legal responsibility for keeping them between retailers and their contractors.

The French alert adds one more pointer to where data travels. It tells operators to check their insurance contract before cutting the internet data feed to their refrigeration contractor, a sign that the device’s data flows to that contractor.

The device itself keeps records worth asking about. Danfoss’s April 2026 user guide for its AK-SM 800A system manager lists an audit trail, cleared alarms, a system report, the database and HACCP data among items an operator can export to a USB drive. HACCP, short for Hazard Analysis and Critical Control Points, is the food-safety control system under which stores track cold-chain temperatures. The guide says HACCP-tagged data points are kept on the system manager for 18 months before being overwritten. How long general history stays in its active and archive stores depends on how many points are sampled and how often, it says. It advises exporting a database backup before software updates or major changes, but it does not state how long the audit trail is kept or whether any record survives a factory reset. That guide covers the newer 800A series, while the units hit in France were mostly older models that Danfoss no longer updates, according to the company, so what those older units retain is less clear.

Who holds the record in each country

Whatever the devices retain, several accounts so far place the equipment, or the company managing it, outside the retailer’s own systems. Store refrigeration controllers can be networked so that outside contractors can watch them and repair faults without a site visit, The Hacker News reported. Sabcobel manages hundreds of units in Belgium and knew of about 20 affected, and Moelans told Belgian media that attackers entered individual supermarkets’ systems rather than the contractors’ own, according to The Hacker News. In Portugal, the Mosqueteiros group’s incident appeared to target an outside company managing refrigeration, according to AFP. Sweden’s case differs in kind: ICA has said its affected stores were connected outside its central network, on a control system supplied by Danfoss, which establishes an outside network link rather than who serviced the equipment. Kesko said its affected stores’ equipment sits outside its central protections.

Some of the most precise timing data sits further away still. Lupovis, a deception security firm, told SecurityWeek that its Danfoss AK-SM decoy sensors, including some in affected regions, saw login attempts between Oct. 20 and 30. Most attempts used factory-default credentials, activity peaked Oct. 26, and the firm said it had not observed that behavior before Oct. 20. Internet intelligence firm Censys counted 138 exposed Danfoss StoreView interfaces in Belgium, 51 in the Netherlands and 50 in Sweden. Both are commercially collected data, and neither firm has tied its observations to a specific store hit on Nov. 2.

What a preservation request would have to reach

That scatter shapes the practical work for counsel and investigators, which starts before attribution does. A request tied to a refrigeration incident would first identify the controller’s make, model and firmware, and the contractor or integrator with remote access. It would then reach that contractor’s monitoring logs, the store’s firewall or VPN logs and the exports the device itself supports, ideally taken before anyone restarts or resets it. Italy’s bulletin already names many of the same sources for operators’ own analysis. The insurance contract belongs on the list as well, since CERT-FR told operators to check its terms before cutting the data feed to their refrigeration contractor.

In U.S. federal courts, the sanctions rule for lost electronic records turns on that timing. Federal Rule of Civil Procedure 37(e) applies when “electronically stored information that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it.” The information must also be impossible to restore or replace through additional discovery. On finding prejudice to another party from the loss, a court may order “measures no greater than necessary to cure the prejudice,” and the 2015 advisory committee note says that in an appropriate case those measures may be serious ones. The sanctions listed in Rule 37(e)(2) rest on a different finding: that the party acted “with the intent to deprive another party of the information’s use in the litigation.” Only then may a court presume the lost information was unfavorable or instruct a jury that it may or must so presume. The same finding is required before a court may dismiss the action or enter a default judgment. The committee note says Rule 37(e)(2) requires no separate finding of prejudice.

That rule turns on a party’s loss, and where a controller log sits does not settle whose information it is. Rule 34 reaches material in a party’s “possession, custody, or control,” so contract terms that give a retailer access to its contractor’s records can bear on whether a reset log counts as the retailer’s loss.

The Selver store lost nothing because its refrigeration partner responded quickly. That partner sits outside the store, as do the companies managing equipment in Belgium and Portugal, which likely places the people best able to reconstruct what changed outside the retailer too. Investigators on two continents have not established whether they face one campaign or several. Italy’s agency has told operators to preserve logs before cleanup, but neither national alert says which party, retailer or contractor, must keep a given incident’s records while investigators decide. When the next freezer is set to 50 degrees Celsius, will the first call go to the technician who resets it or to the person who decides what must be kept first?

News Sources

• Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (CERT-FR, Agence nationale de la sécurité des systèmes d’information)
• Misure urgenti di verifica e mitigazione per operatori della distribuzione alimentare e della filiera del freddo (Agenzia per la Cybersicurezza Nazionale, CSIRT Italia)
• Rule 37. Failure to Make Disclosures or to Cooperate in Discovery; Sanctions (Legal Information Institute, Cornell Law School)
• Rule 34. Producing Documents, Electronically Stored Information, and Tangible Things, or Entering onto Land, for Inspection and Other Purposes (Legal Information Institute, Cornell Law School)
• User Guide: AK-System Manager, AK-SM 800A series (Danfoss)
• Exclusive-Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say (Reuters via ThePrint)
• Cyberattacks disrupt refrigeration systems at European supermarkets (Associated Press via PBS News)
• Freezers at supermarkets in several European countries hit by apparent cyberattacks, ruining food (Associated Press via PBS News)
• Officials suspect Iran of cyberattacks on military base freezers (Defense One)
• Refrigeration failures affect 4 military commissaries in Europe (Stars and Stripes)
• Ook koelsystemen in Nederland aangevallen, bij 17 bedrijven temperatuur aangepast (NOS)
• Hackers raised freezer temperature at Selver supermarket to +50°C (ERR News)
• Second wave of suspected cyberattacks hits supermarket freezers across Europe (The Record from Recorded Future News)
• Over 100 European Stores Hit as Supermarket Fridge Attacks Return (SecurityWeek)
• New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food (The Hacker News)
• Cyberattacks hit European grocers: French supermarket freezers hijacked, Dutch and Belgian stores disrupted (Help Net Security)

Assisted by GAI and LLM Technologies

Additional reading

• Microsoft finds 2 North Korean groups using ARTEX, a tool that alone cannot name an attacker
• With over 40 percent of the record Binance theft frozen, getting it back becomes a legal project
• Estonia’s cyber authority saw no state-sector PHP crisis as three state institutions shut or restricted services
• AI recording spreads in Estonian health care as the regulator says the audio needs its own legal basis

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.