European supermarkets hit by a new wave of refrigeration-controller attacks

This is a new November wave, distinct from the French attacks covered by the October CERT-FR alert. Belga’s direct interview with Sabcobel describes attackers switching evaporators into defrost mode at Belgian supermarkets, including Delhaize, Carrefour and Spar. In a separate interview, Ahold Delhaize confirmed refrigeration disruption to Supermarket News. Broader country and store counts remain provisional; this article does not treat installer estimates as a final victim count or quantify losses.

Kevin Beaumont’s original November 2 post says he confirmed internet-facing management on affected systems with contacts, and that many systems have no patch because they are end of life. That is a researcher’s attributed observation, not a published forensic demonstration of one exploit across all stores. No specific CVE, shared attacker or connection to other retail/US incidents has been established here.

The earlier CERT-FR alert names Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb. It confirms previous compromises and supplies actionable isolation and recovery guidance, but does not establish that every November victim uses those models. Apply its steps with the device manufacturer and refrigeration contractor; there is no verified universal firmware threshold for this new wave.

The case is rated L4 because reported attacks are already disrupting physical refrigeration and putting food stock at risk. Changing a controller password or resetting it while leaving an unpatched management interface public does not remove the exposure.