Attackers remotely heat refrigeration units at Belgian supermarkets
Attackers remotely set refrigeration controllers to defrost mode at over 60 Belgian supermarkets and butcher shops in the early hours of November 2, raising temperatures to around 15 degrees Celsius. At least 40 Delhaize stores, 15 Carrefour locations, five Spar outlets and the De Laet & Van Haver butcher chain received alarms around 03:00. Some stores caught the intrusion in time, others had to discard stock.
The method matches an October attack in France that targeted Copeland xweb, Danfoss AK-SC and AK-SM, and Dixell xweb controllers. The Centre for Cybersecurity Belgium warned operators on October 13 to remove public internet exposure from these units. Sabcobel, a Belgian refrigeration installer, mobilized technicians from 01:00 to disconnect roughly 20 of the hundreds of installations it manages. The company's CEO confirmed that a firmware update alone does not fix the problem: the units must be taken off the public internet and accessed only through a VPN or secured internal network.
Many refrigeration controllers ship with remote access enabled by default, often still using factory credentials. If your operation depends on cold chain equipment, check whether the controllers are reachable from the internet. The CCB advisory lists affected models and recommends removing public exposure, updating firmware, and changing default passwords. CERT-FR published additional technical indicators after the French incidents.
If you run or support facilities with networked refrigeration, ITIFY can help you audit controller exposure, design a segmented access architecture, and plan the physical and network changes needed to secure these systems. Get in touch if you want a second look at your operational technology perimeter.