Unknown Actors Remotely Trigger Defrost Cycles at European Grocers

Key points

• Unknown attackers changed defrost settings remotely at multiple supermarkets.
• Delhaize, Carrefour and Spar sites in Belgium, Luxembourg and Sweden were affected.
• Refrigeration warmed and food spoiled; no CVE was tied to the incident.
• The event came about three weeks after an attack in France.

On 2026-11-02, unidentified intruders manipulated cooling equipment at supermarkets operated by Delhaize, Carrefour and Spar across Belgium, Luxembourg and Sweden. Rather than exploiting a named software flaw, they appear to have remotely placed defrost operation into an active state, causing evaporators to warm and refrigeration to lose temperature. No CVE has been associated with the activity.

The operational effect was direct: refrigeration warmed and food spoiled across multiple supermarket sites. That matters beyond inconvenience, because grocery cooling systems support food safety, waste reduction and store continuity. The absence of a CVE also means conventional patch prioritization may not surface the risk; access paths, configuration controls and monitoring of operational technology are more relevant here.

The timing places the incident roughly three weeks after a comparable attack in France. Whether this reflects copycat activity, shared exposure among grocery chains, or unrelated opportunism remains unclear from the available facts. What is clear is that remote control of defrost settings can produce physical consequences without malware or a software vulnerability.

Store operators and IT administrators should watch for unexpected defrost-mode changes, temperature excursions, and remote sessions into refrigeration controllers. Vendor support links, shared credentials and flat networks are likely areas to review. Manual override procedures and spoilage response plans should also be tested, because the immediate risk is disruption to cooling rather than data loss.

What to do now

1. Inventory all refrigeration and HVAC controllers, including evaporator units, and document who can reach them remotely.
2. Restrict remote access to management interfaces with allowlists, strong unique credentials and multi-factor authentication where supported.
3. Segment refrigeration controls from corporate IT and the public internet; permit only required vendor and administrative paths.
4. Alert on unexpected defrost-mode changes, setpoint changes and temperature excursions, and route alerts to on-call staff.
5. Review vendor remote-support arrangements and disable dormant accounts or always-on connections that are not operationally necessary.
6. Test manual override and spoilage-response procedures so stores can maintain safe temperatures if remote control is lost.
7. Because no CVE applies, prioritize configuration hardening and access monitoring over vulnerability-only response.

Original source

Help Net Security