Cyberattacks target supermarket refrigerators in Europe, causing food spoilage

Attacks target supermarket refrigeration systems

A suspected second wave of cyberattacks has disrupted supermarket refrigerators across Belgium, Ireland, Luxembourg, and Sweden, leading to widespread food spoilage. According to TechCrunch, hackers altered refrigerator settings to defrost, rendering stored goods unsafe and forcing supermarkets to discard large quantities of food.

Ahold Delhaize and Colruyt, two major supermarket chains, confirmed the attacks. The incidents follow a similar wave of refrigerator hacks in France last month, which affected hundreds of stores.

Unpatched IoT refrigerators identified as the vulnerability

Security researchers identified internet-connected refrigerators manufactured by Danish company Danfoss as the source of the breaches. These units, which Claroty had previously flagged for vulnerabilities, were no longer receiving security updates from the manufacturer.

Claroty warned in August about risks tied to these Danfoss refrigeration units, including remote hacks and outages. The latest attacks demonstrate how unpatched IoT devices in critical infrastructure can become vectors for disruption.

Broader risks to food supply chains

The attacks highlight the real-world consequences of cyber vulnerabilities in food distribution. In 2025, a cyberattack on U.S. food distributor UNFI caused shortages and empty shelves across grocery stores, illustrating the fragility of supply chains when critical nodes are compromised.

U.S. Department of Defense officials are reportedly investigating potential breaches of freezer units on military bases, allegedly by Iran-backed hackers. Earlier this year, Iranian hackers were also linked to cyberattacks on U.S. water providers.

Earlier warnings about Danfoss vulnerabilities

This incident follows earlier reporting on critical vulnerabilities in Danfoss AK-SM 800A refrigeration controllers. Security researchers at Claroty’s Team82 had identified flaws, including authentication bypass and command injection, which exposed thousands of systems to remote attacks. Danfoss released a firmware update to address these issues, but the latest attacks suggest some operators may not have applied the patches.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

For founders and operators in food distribution, retail, or IoT-dependent industries, these attacks are a reminder of the cascading risks tied to unsecured hardware. The reliance on internet-connected devices—especially in critical infrastructure like refrigeration—creates single points of failure that can disrupt entire supply chains. The fact that Danfoss had issued patches but operators remained vulnerable suggests a gap not just in technology, but in processes for updating and monitoring IoT systems.

The broader takeaway is the shifting focus of cyber threats. Attackers are increasingly targeting physical systems with clear economic or disruptive potential, from food spoilage to energy grids. For startups building or integrating IoT solutions, this underscores the need to prioritize security by design, rather than treating it as an afterthought. Operators of critical infrastructure, even outside traditional tech sectors, must also reassess their exposure to third-party hardware vulnerabilities and ensure patch management is treated as a non-negotiable part of operations.

Related on Lazyfounder

• Danfoss
• Critical flaws in Danfoss refrigeration controllers expose thousands to remote attacks