Europe’s freezer botnet turns cold storage into a very hot crypto problem

A cyberattack disrupted refrigeration systems at supermarkets across nine European countries on Monday, with Estonia reporting temperatures reaching 50°C (122 °F) as hackers forced freezer units into continuous defrost cycles. No group has claimed responsibility, and investigators have not said whether the latest incidents are linked to the attack in France, where Finance Minister Roland Lescure told Parliament on Oct. 13 that about 700 of the country’s 10,000 supermarkets were affected.

France’s CERT-FR said numerous remote-control modules made by Danfoss and Copeland were compromised, causing spoiled food and fires at some stores. Groupement Mousquetaires, which owns Intermarché and Netto, counted 300 affected stores, while Cooperative U reported that 80 of its 2,000 shops were hit. Lescure said food supplies were not at risk but acknowledged the attack “touches the heart of our food security.” Some Mousquetaires display cases remained out of service on Tuesday.

The Monday wave also hit several chains in Belgium, where Carrefour reported disruption at about 15 of its 700 stores. Belgian refrigeration contractor Sabcobel said evaporators had been switched into defrost mode, and federal prosecutors opened an investigation. Four Delhaize outlets in Luxembourg reported problems. Italy’s Radenza Group, which runs Coop-branded stores in Sicily, said the attack began at 4 a.m. local time and targeted the remote-control system for frozen food sections.

Ireland’s Musgrave counted 13 affected SuperValu stores, while Mosqueteiros confirmed incidents at seven Intermarché stores in Portugal. In Sweden, Coop said six of its roughly 800 stores were affected and that they ran on 4G connections, making them “more exposed.” Ica reported problems at a limited number of stores using an external Danfoss control system, while Finland’s Kesko said network interference had not been ruled out. Neither chain confirmed a cyberattack, although EU Agriculture Commissioner Christophe Hansen called the incidents a “deliberate attempt” to disrupt the food supply chain.

Estonian refrigeration firm Kitman Coldtech said the affected units were older Danfoss models similar to those attacked in France. CERT-FR warned that leaving an end-of-life device without security patches exposed to the internet carries a very high risk of compromise. Claroty researchers published flaws in Danfoss AK-SM 800A controllers in August, including an authentication bypass, and found 2,765 of the devices exposed online.