A second wave of attacks on internet-connected supermarket refrigerators has spoiled food at dozens of stores in Belgium, Ireland, Luxembourg and Sweden, with Ahold Delhaize and Colruyt both confirming intrusions overnight. According to Reuters, a Belgian firm that runs Delhaize's systems said the attackers switched the units into defrost mode, pushing temperatures up and forcing stores to discard thawed stock. The campaign follows attacks in France last month that hit hundreds of supermarkets, and researchers have tied the exposure to Danfoss refrigeration equipment that no longer receives security updates.

What happened

The incidents came to light within a single overnight window. Ahold Delhaize and Colruyt acknowledged the compromises, and the Belgian operator responsible for Delhaize's refrigeration systems told Reuters that the intruders altered device settings so the units would run a defrost cycle rather than hold their configured cold setpoints.

The operational result is straightforward and expensive: cases warm up, frozen and chilled goods cross their safe temperature thresholds, and staff have to pull product from shelves. Stores across the four affected countries reported significant losses from food that had defrosted or was otherwise unfit to sell.

This is the second reported wave. Last month, refrigerators at hundreds of supermarkets in France were deliberately pushed to higher temperatures, producing comparable spoilage. Investigators and security researchers attributed that earlier activity to internet-connected refrigerators manufactured by the Danish firm Danfoss, which is no longer shipping security updates for the affected equipment. Claroty had warned in August that these refrigerator units could be remotely attacked and taken out of service.

Why defrost mode is an effective target

A commercial display case is not a single thermostat. It runs a controller that manages cooling cycles, door heaters, fan behavior and periodic defrost cycles, during which the evaporator is warmed to clear ice buildup. During a normal defrost the compressor is held off and the cabinet temperature rises by design; the controller then returns to cooling and the temperature drops back.

An attacker who can write to that controller's configuration can stretch a defrost cycle, suppress the return to cooling, or simply raise the setpoint. Nothing crashes, no alarm necessarily fires at the moment of the change, and the cabinet keeps running — it just stops refrigerating. For a retailer, the damage shows up hours later as a temperature excursion and a dumpster full of product rather than as an outage dashboard turning red.

The recurring theme in both waves is exposure. These controllers are frequently internet-reachable so that facility managers, contractors and cloud dashboards can adjust them remotely, and devices that have reached end-of-support stop receiving the firmware fixes that would close known flaws. Claroty's August warning described precisely this combination for the Danfoss units: remote reachability plus unpatched, unsupported firmware.

Technical background

The following section describes the general class of weakness rather than the specifics of these incidents; no exploit code, addresses or device identifiers from the affected retailers are public.

Refrigeration and building-automation controllers commonly speak industrial protocols such as Modbus/TCP, BACnet or vendor-specific cloud APIs. Many expose readable and writable registers or objects for setpoints, defrost schedules and operating modes. If port 502 (Modbus/TCP) is reachable from the internet and the device accepts unauthenticated writes — the original protocol has no authentication — a setpoint change is a single packet.

An illustrative read of holding registers from a Modbus/TCP device, using the generic pymodbus client, looks like this:

from pymodbus.client import ModbusTcpClient

client = ModbusTcpClient("192.0.2.10", port=502)
client.connect()
# Read 8 holding registers starting at address 0
rr = client.read_holding_registers(address=0, count=8, slave=1)
print(rr.registers)
client.close()

A generic check for exposed Modbus endpoints on a network you are authorised to test:

nmap -Pn -p 502 --script modbus-discover 192.0.2.0/24

The defensive lesson is not about any one protocol. It is that a thermostat with a public IP address and a writable mode register is an unauthenticated control interface for the food inside the case.

Detection and mitigation

Because the attack manifests as a legitimate-looking configuration change, detection has to lean on baselines and physics rather than signatures.

• Alert on any write to setpoint, defrost schedule or operating-mode registers outside an approved change window, and log who made it and from where.
• Baseline normal defrost duration and cabinet recovery time. A defrost cycle that runs materially longer than its historical pattern, or a compressor that stays off afterward, is worth a page.
• Treat temperature excursions as security events as well as facilities events, and correlate them with network activity on the refrigeration VLAN.
• Monitor outbound connections from refrigeration and HVAC subnets. Controllers should talk to a known management endpoint, not to arbitrary hosts.
• Inventory every internet-facing controller, including inherited equipment at acquired sites, and check it against the manufacturer's end-of-support list.

On the hardening side: place refrigeration controllers on a segmented network with no direct inbound internet access, and require access through a VPN or jump host with logging. Disable remote cloud management where it is not operationally needed. Change default credentials, restrict which source addresses may write to control registers, and apply firmware updates for any unit still covered. For equipment that has reached end-of-support — the situation Claroty flagged for the Danfoss units in August — the realistic options are compensating network controls or replacement, since no patch is coming.

Retailers should also keep a manual fallback: the ability to force a cabinet back into cooling locally, and a documented procedure for verifying product safety after a temperature event rather than relying on the controller's own reporting.

Wider context

Refrigeration is one more reminder that cyberattacks can produce physical, non-digital harm. In 2025, an attack on food distributor UNFI contributed to shortages and empty shelves at grocery stores across the United States.

Military infrastructure has drawn similar scrutiny. U.S. Department of Defense officials are reportedly examining whether freezer units on military bases were compromised by Iran-backed hackers, and Iranian actors were also blamed for attacks on U.S. water providers earlier this year.

For grocers, the practical takeaway from the European incidents is that the threat model now includes the cold chain itself — and that unsupported, internet-connected controllers are the softest link in it. Further security coverage is available via TechCrunch's security section.