Cyberattacks on Danfoss Refrigerators Destroy Food Across Europe

A second wave of cyberattacks hit supermarket refrigeration systems across Europe, causing widespread food spoilage at dozens of locations in Belgium, Ireland, Luxembourg and Sweden. Supermarket operators Ahold Delhaize and Colruyt confirmed the hacks occurred overnight. According to Reuters, one Belgian company managing Delhaize’s refrigeration systems reported that hackers had changed unit settings to defrost mode, triggering temperature rises that destroyed perishable goods across multiple stores.

How the Attack Unfolded

The Defrost Mechanism and Scale

The attackers accessed internet-connected refrigerators and altered their temperature control settings, causing the units to shift from freezing to defrost mode. This change raised internal temperatures above safe food storage levels, spoiling frozen and refrigerated items. Supermarkets reported significant losses, forced to discard large quantities of defrosted produce, meat, dairy and prepared foods. The impact extended across dozens of retail locations, suggesting either a coordinated attack or rapid exploitation of the same vulnerability across multiple targets in the region.

The Danfoss Problem

Security researchers identified the compromised refrigerators as models manufactured by Danish company Danfoss. Danfoss had ceased providing security updates to the affected equipment, leaving the systems exposed to known attack methods. Without patches from the manufacturer, retailers operating older Danfoss units had no official pathway to address the vulnerabilities, even if they recognized the risks.

A Predictable Failure

Read also: Binance Resumes Phased Withdrawals After $6.3 Billion Theft · Binance suffers largest crypto theft in history from North Korean group · Binance halts withdrawals after suspected $2 billion-plus crypto theft

Claroty’s August Warning

Security firm Claroty had published warnings in August that Danfoss refrigeration systems were at serious risk of remote exploitation and potential outages. The researchers detailed how the equipment could be compromised remotely, yet supermarket chains did not appear to act on the guidance in the months that followed. The gap between the publication of vulnerability details and actual remediation by retail operators created the conditions for these attacks to succeed.

Earlier Attacks in France

These incidents followed a nearly identical attack pattern in France last month, where hackers targeted internet-connected refrigerators at hundreds of supermarkets and deliberately raised temperatures to cause food spoilage. The similarity in method and target across geographic regions suggests either the same threat actor replicating a successful technique or multiple groups exploiting the same known Danfoss weaknesses. The repeated targeting of food infrastructure across consecutive months indicates this is not an isolated incident but an emerging threat category.

The Broader Food Supply Threat

The refrigerator attacks represent the latest in a series of cyberattacks targeting the food supply chain. In 2025, a cyberattack against distributor giant UNFI caused food shortages and empty shelves at grocery stores and supermarkets across the United States. Where the UNFI incident disrupted logistics and distribution, the refrigerator attacks destroy inventory in place, creating immediate product loss. Together, these incidents demonstrate that food supply security now faces significant cybersecurity risks beyond traditional physical threats.

Military and Intelligence Dimensions

U.S. Department of Defense officials are investigating whether similar freezer units on military bases were compromised by Iran-backed hackers. If confirmed, the incidents would represent a significant expansion of Iranian cyber operations into American critical infrastructure. Iranian hacking groups have already conducted cyberattacks against U.S. water providers earlier in 2025, establishing a pattern of targeting essential services. The potential military base connection elevates these refrigerator hacks from retail incidents to questions of national security and infrastructure protection.

The End-of-Life Device Problem

The attacks highlight a vulnerability inherent in deploying internet-connected industrial equipment across distributed retail networks. When manufacturers cease security updates, older equipment becomes increasingly exploitable. Supermarkets and other large operations must choose between replacing hundreds or thousands of devices at significant cost or operating with known security gaps. The incidents raise unresolved questions about manufacturer responsibility for end-of-life support, retailer obligation to upgrade infrastructure, and whether regulators should mandate minimum security support periods for connected devices managing critical functions like food storage.

Source: TechCrunch