Overnight into November 2, attackers switched supermarket fridges and freezers to defrost in Belgium, Ireland, Sweden, the Netherlands and Luxembourg. Three weeks earlier, hundreds of stores in France were reportedly hit the same way. In both waves, the reported way in was a refrigeration controller that anyone on the internet could reach.
What happened in the supermarket fridge hacks?
In one Swedish store, the manager arrived on Monday to a puddle of water and freezers set to 55°C. According to The Register, the November attacks hit about 40 Delhaize stores, around 15 Carrefour stores, at least 13 SuperValu stores in Ireland and six Coop stores in Sweden. A single Delhaize store put its damage at 60,000 euros.
The first wave hit France on the night of October 11 to 12. Carrefour, Coopérative U, Intermarché and Monoprix stores were among those affected, with refrigeration units reaching as high as 50°C. Nobody has claimed either wave, and a link between them is not confirmed.
Belgium's federal prosecutor has opened a criminal investigation. EU food commissioner Christophe Hansen said food security was not at risk, but that the food waste and the damage to businesses were real.
We're writing this on November 3, the day after the second wave. Store counts are still coming in, so some of these numbers may change.
How did attackers reach the supermarket fridges?
A supermarket refrigeration system is run by a small computer with a web login. Engineers, often from an outside contractor, use it to check temperatures and set defrost cycles remotely. The Grocer reports that the hackers exploited login pages on fridge controllers exposed to the open internet.
France's national cyber agency, CERT-FR, issued an alert about "numerous compromises" of these controllers. Its advice: remove them from the internet, check the whole configuration (especially the defrost schedules), allow remote access only through a secure VPN or protected network, update the firmware and change default passwords. On equipment that no longer gets security updates, a factory reset alone is not enough.
In the Netherlands, Danfoss told the broadcaster NOS that at least 17 butchers and small shops were hit. Their systems "were not on a secure network and still used a default password."
Was the Ahold Delhaize cyberattack part of this?
No link has been shown. In October, Ahold Delhaize detected suspicious activity and took systems offline, including the websites and apps of brands such as Albert Heijn. The company blamed "the malicious actions of others," and Delhaize later said it was checking for a connection to the fridge attacks.
That incident is a reminder that a supermarket cyberattack can also start at the head office. In April 2025, attackers got into M&S by impersonating someone. The chairman told MPs they "appeared as somebody with their details." Co-op said the data of all 6.5 million of its members was stolen in an attack the same month. Press reports linked the M&S attack to a group called Scattered Spider, which a US government advisory describes calling IT help desks to "reset passwords and/or transfer MFA tokens."
External attack surface management, step by step in Imperum
Here is how both ways in look to a security team running Imperum. These are checks to test in your own setup, not a reconstruction of any store's incident. The screens use made-up data, except Cognitio's catalog values.
Step 1: Find what faces the internet with Defensum
External attack surface management in Defensum starts with declared scope and verified ownership. Configured discovery and scanning then show what is reachable from outside. Active scanning needs a registered scan engine and authorized scope.
Internet exposure combined with a critical or known-exploited vulnerability can raise an asset's priority, and findings that cross your threshold can open or update a case with their risk context.
One catch: a store's controllers can sit on a contractor's connection, outside your declared ranges. Ask your contractors which addresses they use, and put those in scope too.
Step 2: Look up the help desk callers in Cognitio
Security vendors track Scattered Spider under many names, including Octo Tempest, UNC3944 and Muddled Libra. Search any of them in Cognitio and you land on the same profile, MITRE ATT&CK G1015. The Detections tab shows which of your synced Sigma detection rules match the group's techniques.
A profile is a research reference. It doesn't mean the group is in your network.
Step 3: Triage the password reset with Virtus Triage
Say your identity provider flags an IT administrator's account: a password reset, a new multi-factor authentication (MFA) device and a sign-in from an unfamiliar network, all within half an hour. A Modus rule routes the alert to Virtus Triage.
Triage adds context first: asset criticality, whether the account is privileged, and related events from the last 24 hours. An administrator account matches the privileged-account gate, so the alert escalates at full confidence and skips the model's verdict. By default, that opens a case and starts a Virtus Pilot investigation. An analyst can override it with a written reason.
Step 4: Contain the account with an approved playbook
Locking an administrator out at 3 a.m. can stop real work, so someone should own that call before the incident. In Automatio, the team builds the response as a playbook. An Alert Trigger starts it, and a Human Approval step waits for the person who owns the decision. Approval runs a containment action through a supported, configured identity connector, such as suspending the account.
If nobody answers within the wait time (60 minutes by default), the playbook takes the rejected branch, which can notify the team. Execution History shows each step's inputs, outputs and errors, so you can check the account was actually suspended.
What to check this week
- List every device in your stores with a web login, including the ones your refrigeration and building contractors manage.
- Check which of them the internet can reach. Follow CERT-FR's advice on remote access, firmware, default passwords and defrost schedules.
- Ask your help desk how it confirms a caller's identity before it resets a password or MFA device, especially for administrators.
Questions about the supermarket hacks
Who is behind the supermarket fridge hacks?
Nobody knows yet. No group has claimed either wave. Belgium's federal prosecutor has opened a criminal investigation, and the head of Belgium's cybersecurity center says criminals, state-backed groups and hacktivists are all possible. Nobody has confirmed that the French and November waves are the same campaign, either.
Was customer data stolen in the Ahold Delhaize cyberattack?
In its October 19 update, Ahold Delhaize said it had no evidence at that moment that sensitive customer, associate or partner data was taken. That statement covers the October IT incident only, which has no proven link to the fridge hacks.
What is external attack surface management?
External attack surface management is the practice of finding the systems an organization exposes to the internet and deciding which ones should not be there. In Imperum, Defensum covers this work: it starts with scope you declare and verify, then shows what is reachable from outside.
Would external attack surface management have stopped these attacks?
The public facts don't support that claim. Investigators haven't said exactly how each controller was reached. What attack surface management offers is earlier sight of the problem: a login page on the internet can show up as a finding with its risk context, so the team can take it offline or move it behind a VPN before someone else finds it.
