Ahold Delhaize and Colruyt said an overnight IT incident disrupted refrigeration in dozens of stores in Belgium and Luxembourg. Their report came after a separate French alert from CERT-FR, which documented compromised refrigeration controllers and offered security guidance for the equipment covered by its advisory.
What operators reported in Belgium and Luxembourg
Ahold Delhaize and Colruyt described the Belgian and Luxembourg disruptions as an overnight IT incident affecting fridges and freezers. A November 2 Associated Press report also described refrigeration disruptions in Sweden, Ireland and Estonia, alongside Belgium and Luxembourg, as apparent cyberattacks.
Commercial refrigeration systems can be monitored and maintained remotely. The English-language BBC News explainer discusses remote access and the European reports.
What CERT-FR’s French advisory covers
CERT-FR’s alert, first published October 12 and updated October 16, said the agency knew of numerous compromises involving remote refrigeration controllers in France. It listed four product families: Copeland xweb, Danfoss AK-SC, Danfoss AK-SM and Dixell xweb. The alert addresses the French compromises; the later operator reports concern stores in Belgium and Luxembourg.
NeoTeo previously covered the French supermarket refrigeration incident.
How the advisory recommends securing and recovering equipment
CERT-FR says a refrigeration management interface should not be exposed to the public internet. Its advisory recommends removing that exposure from affected equipment and other units reachable at public IP addresses. If remote access is needed, it should use a secure VPN or protected network. Filtering access to trusted service-provider IP addresses is an emergency measure, not a lasting solution.
The advisory also calls for checking the full configuration, including defrost schedules. For compromised Danfoss equipment, it describes restarting the unit or restoring factory settings, then reconfiguring it. Its Danfoss hardening example includes updating firmware, enabling Strict security mode and replacing default passwords.
A factory reset alone is insufficient if vulnerable, end-of-life equipment remains exposed to the internet.
