Over 100 European Stores Hit as Supermarket Fridge Attacks Return

Hi, what are you looking for?

Attackers again tampered with internet-exposed refrigeration controllers, this time at stores in Belgium, Sweden, Ireland and beyond.

By

Flipboard

Reddit

Whatsapp

Whatsapp

Email

More than 100 stores in several European countries saw their fridges and freezers heat up overnight from Sunday to Monday, and several retailers have blamed a cyberattack. The incidents closely resemble the attacks that disrupted European supermarkets three weeks ago.Theaffected businesses, ranging from major chains to small butcher shops, are in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden. Some units were set as high as 50°C (122°F), and problems have also been reported in Finland, Italy and Portugal.Nobody has taken responsibility for the attacks. Investigators have not established whether the two waves are connected.Thefirst wavehit France overnight from October 11 to 12. Around 700 supermarkets had their refrigeration units forced into defrost mode, including Intermarché, Carrefour, Coopérative U and Monoprix stores. Food was spoiled, and the attacks reportedly caused fires.CERT-FR, the incident response team of France’s cybersecurity agency ANSSI, initially linked the compromises to Danfoss AK-SM and AK-SC series controllers. A day later, itexpanded its alertto cover Copeland and Dixell XWEB systems. Danfoss said most of the hacked units were legacy products it no longer updated.Exposed Danfoss, Copeland controllers hijacked in new attacksThe technique appears to be the same. Stephan Moelans, CEO of Belgian refrigeration firm Sabcobel, told the Belga news agency that the attackersforced the units’ evaporators into defrost mode, as happened in France.Advertisement. Scroll to continue reading.According to Moelans, a software update is not enough to fully resolve the weakness, and the affected equipment also needs to be physically modified.Dutch broadcaster NOSreportedthat, as far as is known, the targeted devices were made by Danfoss and Copeland. An Estonian refrigeration supplier said the units attacked there were older Danfoss models.Danfoss said that on October 13 it had told its customers to cut their systems’ internet connections and to reconnect only through a secure network. “Most stores took action at that time, but a small number did not,” a company spokesperson told NOS.Security researcherKevin Beaumontsaid people he spoke with had confirmed that every freezer hit on Monday had a management interface reachable from the internet. According to Beaumont, many of the devices are end-of-life and have no available patch.Officials have not publicly explained how the attackers got in.Deception security firm Lupovis toldSecurityWeekthat, between October 20 and 30, it saw suspicious activity aimed at its Danfoss AK-SM refrigeration controller sensors, including sensors in some of the affected regions. Most of the login attempts relied on factory-default credentials that Danfoss documents publicly, while others appeared to be trying to fingerprint specific Danfoss controller components.“The activity peaked on 26 October, and importantly, we had not observed this behaviour on these sensors before 20 October. All authentication attempts were rejected by our sensors,” said Lupovis CEO Xavier Bellekens, adding that the timing is noteworthy.Censyshas found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. “France continues to lead Danfoss StoreView exposures globally, followed by Belgium and the US,” the internet intelligence firm said.The number of exposed StoreView instances in France has fallen sharply, from 1,825 before the October attacks to 220 at the time of Censys’ latest analysis.By matching firmware build dates, Censys estimates that 41% of the French instances still online run a patched version. It counted 138 exposed instances in Belgium, 51 in the Netherlands and 50 in Sweden, of which 68%, 37% and 58%, respectively, appear to be patched.Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Theaffected businesses, ranging from major chains to small butcher shops, are in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden. Some units were set as high as 50°C (122°F), and problems have also been reported in Finland, Italy and Portugal.Nobody has taken responsibility for the attacks. Investigators have not established whether the two waves are connected.Thefirst wavehit France overnight from October 11 to 12. Around 700 supermarkets had their refrigeration units forced into defrost mode, including Intermarché, Carrefour, Coopérative U and Monoprix stores. Food was spoiled, and the attacks reportedly caused fires.CERT-FR, the incident response team of France’s cybersecurity agency ANSSI, initially linked the compromises to Danfoss AK-SM and AK-SC series controllers. A day later, itexpanded its alertto cover Copeland and Dixell XWEB systems. Danfoss said most of the hacked units were legacy products it no longer updated.Exposed Danfoss, Copeland controllers hijacked in new attacksThe technique appears to be the same. Stephan Moelans, CEO of Belgian refrigeration firm Sabcobel, told the Belga news agency that the attackersforced the units’ evaporators into defrost mode, as happened in France.Advertisement. Scroll to continue reading.According to Moelans, a software update is not enough to fully resolve the weakness, and the affected equipment also needs to be physically modified.Dutch broadcaster NOSreportedthat, as far as is known, the targeted devices were made by Danfoss and Copeland. An Estonian refrigeration supplier said the units attacked there were older Danfoss models.Danfoss said that on October 13 it had told its customers to cut their systems’ internet connections and to reconnect only through a secure network. “Most stores took action at that time, but a small number did not,” a company spokesperson told NOS.Security researcherKevin Beaumontsaid people he spoke with had confirmed that every freezer hit on Monday had a management interface reachable from the internet. According to Beaumont, many of the devices are end-of-life and have no available patch.Officials have not publicly explained how the attackers got in.Deception security firm Lupovis toldSecurityWeekthat, between October 20 and 30, it saw suspicious activity aimed at its Danfoss AK-SM refrigeration controller sensors, including sensors in some of the affected regions. Most of the login attempts relied on factory-default credentials that Danfoss documents publicly, while others appeared to be trying to fingerprint specific Danfoss controller components.“The activity peaked on 26 October, and importantly, we had not observed this behaviour on these sensors before 20 October. All authentication attempts were rejected by our sensors,” said Lupovis CEO Xavier Bellekens, adding that the timing is noteworthy.Censyshas found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. “France continues to lead Danfoss StoreView exposures globally, followed by Belgium and the US,” the internet intelligence firm said.The number of exposed StoreView instances in France has fallen sharply, from 1,825 before the October attacks to 220 at the time of Censys’ latest analysis.By matching firmware build dates, Censys estimates that 41% of the French instances still online run a patched version. It counted 138 exposed instances in Belgium, 51 in the Netherlands and 50 in Sweden, of which 68%, 37% and 58%, respectively, appear to be patched.Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Nobody has taken responsibility for the attacks. Investigators have not established whether the two waves are connected.Thefirst wavehit France overnight from October 11 to 12. Around 700 supermarkets had their refrigeration units forced into defrost mode, including Intermarché, Carrefour, Coopérative U and Monoprix stores. Food was spoiled, and the attacks reportedly caused fires.CERT-FR, the incident response team of France’s cybersecurity agency ANSSI, initially linked the compromises to Danfoss AK-SM and AK-SC series controllers. A day later, itexpanded its alertto cover Copeland and Dixell XWEB systems. Danfoss said most of the hacked units were legacy products it no longer updated.Exposed Danfoss, Copeland controllers hijacked in new attacksThe technique appears to be the same. Stephan Moelans, CEO of Belgian refrigeration firm Sabcobel, told the Belga news agency that the attackersforced the units’ evaporators into defrost mode, as happened in France.Advertisement. Scroll to continue reading.According to Moelans, a software update is not enough to fully resolve the weakness, and the affected equipment also needs to be physically modified.Dutch broadcaster NOSreportedthat, as far as is known, the targeted devices were made by Danfoss and Copeland. An Estonian refrigeration supplier said the units attacked there were older Danfoss models.Danfoss said that on October 13 it had told its customers to cut their systems’ internet connections and to reconnect only through a secure network. “Most stores took action at that time, but a small number did not,” a company spokesperson told NOS.Security researcherKevin Beaumontsaid people he spoke with had confirmed that every freezer hit on Monday had a management interface reachable from the internet. According to Beaumont, many of the devices are end-of-life and have no available patch.Officials have not publicly explained how the attackers got in.Deception security firm Lupovis toldSecurityWeekthat, between October 20 and 30, it saw suspicious activity aimed at its Danfoss AK-SM refrigeration controller sensors, including sensors in some of the affected regions. Most of the login attempts relied on factory-default credentials that Danfoss documents publicly, while others appeared to be trying to fingerprint specific Danfoss controller components.“The activity peaked on 26 October, and importantly, we had not observed this behaviour on these sensors before 20 October. All authentication attempts were rejected by our sensors,” said Lupovis CEO Xavier Bellekens, adding that the timing is noteworthy.Censyshas found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. “France continues to lead Danfoss StoreView exposures globally, followed by Belgium and the US,” the internet intelligence firm said.The number of exposed StoreView instances in France has fallen sharply, from 1,825 before the October attacks to 220 at the time of Censys’ latest analysis.By matching firmware build dates, Censys estimates that 41% of the French instances still online run a patched version. It counted 138 exposed instances in Belgium, 51 in the Netherlands and 50 in Sweden, of which 68%, 37% and 58%, respectively, appear to be patched.Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Thefirst wavehit France overnight from October 11 to 12. Around 700 supermarkets had their refrigeration units forced into defrost mode, including Intermarché, Carrefour, Coopérative U and Monoprix stores. Food was spoiled, and the attacks reportedly caused fires.CERT-FR, the incident response team of France’s cybersecurity agency ANSSI, initially linked the compromises to Danfoss AK-SM and AK-SC series controllers. A day later, itexpanded its alertto cover Copeland and Dixell XWEB systems. Danfoss said most of the hacked units were legacy products it no longer updated.Exposed Danfoss, Copeland controllers hijacked in new attacksThe technique appears to be the same. Stephan Moelans, CEO of Belgian refrigeration firm Sabcobel, told the Belga news agency that the attackersforced the units’ evaporators into defrost mode, as happened in France.Advertisement. Scroll to continue reading.According to Moelans, a software update is not enough to fully resolve the weakness, and the affected equipment also needs to be physically modified.Dutch broadcaster NOSreportedthat, as far as is known, the targeted devices were made by Danfoss and Copeland. An Estonian refrigeration supplier said the units attacked there were older Danfoss models.Danfoss said that on October 13 it had told its customers to cut their systems’ internet connections and to reconnect only through a secure network. “Most stores took action at that time, but a small number did not,” a company spokesperson told NOS.Security researcherKevin Beaumontsaid people he spoke with had confirmed that every freezer hit on Monday had a management interface reachable from the internet. According to Beaumont, many of the devices are end-of-life and have no available patch.Officials have not publicly explained how the attackers got in.Deception security firm Lupovis toldSecurityWeekthat, between October 20 and 30, it saw suspicious activity aimed at its Danfoss AK-SM refrigeration controller sensors, including sensors in some of the affected regions. Most of the login attempts relied on factory-default credentials that Danfoss documents publicly, while others appeared to be trying to fingerprint specific Danfoss controller components.“The activity peaked on 26 October, and importantly, we had not observed this behaviour on these sensors before 20 October. All authentication attempts were rejected by our sensors,” said Lupovis CEO Xavier Bellekens, adding that the timing is noteworthy.Censyshas found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. “France continues to lead Danfoss StoreView exposures globally, followed by Belgium and the US,” the internet intelligence firm said.The number of exposed StoreView instances in France has fallen sharply, from 1,825 before the October attacks to 220 at the time of Censys’ latest analysis.By matching firmware build dates, Censys estimates that 41% of the French instances still online run a patched version. It counted 138 exposed instances in Belgium, 51 in the Netherlands and 50 in Sweden, of which 68%, 37% and 58%, respectively, appear to be patched.Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

CERT-FR, the incident response team of France’s cybersecurity agency ANSSI, initially linked the compromises to Danfoss AK-SM and AK-SC series controllers. A day later, itexpanded its alertto cover Copeland and Dixell XWEB systems. Danfoss said most of the hacked units were legacy products it no longer updated.Exposed Danfoss, Copeland controllers hijacked in new attacksThe technique appears to be the same. Stephan Moelans, CEO of Belgian refrigeration firm Sabcobel, told the Belga news agency that the attackersforced the units’ evaporators into defrost mode, as happened in France.Advertisement. Scroll to continue reading.According to Moelans, a software update is not enough to fully resolve the weakness, and the affected equipment also needs to be physically modified.Dutch broadcaster NOSreportedthat, as far as is known, the targeted devices were made by Danfoss and Copeland. An Estonian refrigeration supplier said the units attacked there were older Danfoss models.Danfoss said that on October 13 it had told its customers to cut their systems’ internet connections and to reconnect only through a secure network. “Most stores took action at that time, but a small number did not,” a company spokesperson told NOS.Security researcherKevin Beaumontsaid people he spoke with had confirmed that every freezer hit on Monday had a management interface reachable from the internet. According to Beaumont, many of the devices are end-of-life and have no available patch.Officials have not publicly explained how the attackers got in.Deception security firm Lupovis toldSecurityWeekthat, between October 20 and 30, it saw suspicious activity aimed at its Danfoss AK-SM refrigeration controller sensors, including sensors in some of the affected regions. Most of the login attempts relied on factory-default credentials that Danfoss documents publicly, while others appeared to be trying to fingerprint specific Danfoss controller components.“The activity peaked on 26 October, and importantly, we had not observed this behaviour on these sensors before 20 October. All authentication attempts were rejected by our sensors,” said Lupovis CEO Xavier Bellekens, adding that the timing is noteworthy.Censyshas found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. “France continues to lead Danfoss StoreView exposures globally, followed by Belgium and the US,” the internet intelligence firm said.The number of exposed StoreView instances in France has fallen sharply, from 1,825 before the October attacks to 220 at the time of Censys’ latest analysis.By matching firmware build dates, Censys estimates that 41% of the French instances still online run a patched version. It counted 138 exposed instances in Belgium, 51 in the Netherlands and 50 in Sweden, of which 68%, 37% and 58%, respectively, appear to be patched.Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

The technique appears to be the same. Stephan Moelans, CEO of Belgian refrigeration firm Sabcobel, told the Belga news agency that the attackersforced the units’ evaporators into defrost mode, as happened in France.Advertisement. Scroll to continue reading.According to Moelans, a software update is not enough to fully resolve the weakness, and the affected equipment also needs to be physically modified.Dutch broadcaster NOSreportedthat, as far as is known, the targeted devices were made by Danfoss and Copeland. An Estonian refrigeration supplier said the units attacked there were older Danfoss models.Danfoss said that on October 13 it had told its customers to cut their systems’ internet connections and to reconnect only through a secure network. “Most stores took action at that time, but a small number did not,” a company spokesperson told NOS.Security researcherKevin Beaumontsaid people he spoke with had confirmed that every freezer hit on Monday had a management interface reachable from the internet. According to Beaumont, many of the devices are end-of-life and have no available patch.Officials have not publicly explained how the attackers got in.Deception security firm Lupovis toldSecurityWeekthat, between October 20 and 30, it saw suspicious activity aimed at its Danfoss AK-SM refrigeration controller sensors, including sensors in some of the affected regions. Most of the login attempts relied on factory-default credentials that Danfoss documents publicly, while others appeared to be trying to fingerprint specific Danfoss controller components.“The activity peaked on 26 October, and importantly, we had not observed this behaviour on these sensors before 20 October. All authentication attempts were rejected by our sensors,” said Lupovis CEO Xavier Bellekens, adding that the timing is noteworthy.Censyshas found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. “France continues to lead Danfoss StoreView exposures globally, followed by Belgium and the US,” the internet intelligence firm said.The number of exposed StoreView instances in France has fallen sharply, from 1,825 before the October attacks to 220 at the time of Censys’ latest analysis.By matching firmware build dates, Censys estimates that 41% of the French instances still online run a patched version. It counted 138 exposed instances in Belgium, 51 in the Netherlands and 50 in Sweden, of which 68%, 37% and 58%, respectively, appear to be patched.Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

According to Moelans, a software update is not enough to fully resolve the weakness, and the affected equipment also needs to be physically modified.Dutch broadcaster NOSreportedthat, as far as is known, the targeted devices were made by Danfoss and Copeland. An Estonian refrigeration supplier said the units attacked there were older Danfoss models.Danfoss said that on October 13 it had told its customers to cut their systems’ internet connections and to reconnect only through a secure network. “Most stores took action at that time, but a small number did not,” a company spokesperson told NOS.Security researcherKevin Beaumontsaid people he spoke with had confirmed that every freezer hit on Monday had a management interface reachable from the internet. According to Beaumont, many of the devices are end-of-life and have no available patch.Officials have not publicly explained how the attackers got in.Deception security firm Lupovis toldSecurityWeekthat, between October 20 and 30, it saw suspicious activity aimed at its Danfoss AK-SM refrigeration controller sensors, including sensors in some of the affected regions. Most of the login attempts relied on factory-default credentials that Danfoss documents publicly, while others appeared to be trying to fingerprint specific Danfoss controller components.“The activity peaked on 26 October, and importantly, we had not observed this behaviour on these sensors before 20 October. All authentication attempts were rejected by our sensors,” said Lupovis CEO Xavier Bellekens, adding that the timing is noteworthy.Censyshas found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. “France continues to lead Danfoss StoreView exposures globally, followed by Belgium and the US,” the internet intelligence firm said.The number of exposed StoreView instances in France has fallen sharply, from 1,825 before the October attacks to 220 at the time of Censys’ latest analysis.By matching firmware build dates, Censys estimates that 41% of the French instances still online run a patched version. It counted 138 exposed instances in Belgium, 51 in the Netherlands and 50 in Sweden, of which 68%, 37% and 58%, respectively, appear to be patched.Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Dutch broadcaster NOSreportedthat, as far as is known, the targeted devices were made by Danfoss and Copeland. An Estonian refrigeration supplier said the units attacked there were older Danfoss models.Danfoss said that on October 13 it had told its customers to cut their systems’ internet connections and to reconnect only through a secure network. “Most stores took action at that time, but a small number did not,” a company spokesperson told NOS.Security researcherKevin Beaumontsaid people he spoke with had confirmed that every freezer hit on Monday had a management interface reachable from the internet. According to Beaumont, many of the devices are end-of-life and have no available patch.Officials have not publicly explained how the attackers got in.Deception security firm Lupovis toldSecurityWeekthat, between October 20 and 30, it saw suspicious activity aimed at its Danfoss AK-SM refrigeration controller sensors, including sensors in some of the affected regions. Most of the login attempts relied on factory-default credentials that Danfoss documents publicly, while others appeared to be trying to fingerprint specific Danfoss controller components.“The activity peaked on 26 October, and importantly, we had not observed this behaviour on these sensors before 20 October. All authentication attempts were rejected by our sensors,” said Lupovis CEO Xavier Bellekens, adding that the timing is noteworthy.Censyshas found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. “France continues to lead Danfoss StoreView exposures globally, followed by Belgium and the US,” the internet intelligence firm said.The number of exposed StoreView instances in France has fallen sharply, from 1,825 before the October attacks to 220 at the time of Censys’ latest analysis.By matching firmware build dates, Censys estimates that 41% of the French instances still online run a patched version. It counted 138 exposed instances in Belgium, 51 in the Netherlands and 50 in Sweden, of which 68%, 37% and 58%, respectively, appear to be patched.Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Danfoss said that on October 13 it had told its customers to cut their systems’ internet connections and to reconnect only through a secure network. “Most stores took action at that time, but a small number did not,” a company spokesperson told NOS.Security researcherKevin Beaumontsaid people he spoke with had confirmed that every freezer hit on Monday had a management interface reachable from the internet. According to Beaumont, many of the devices are end-of-life and have no available patch.Officials have not publicly explained how the attackers got in.Deception security firm Lupovis toldSecurityWeekthat, between October 20 and 30, it saw suspicious activity aimed at its Danfoss AK-SM refrigeration controller sensors, including sensors in some of the affected regions. Most of the login attempts relied on factory-default credentials that Danfoss documents publicly, while others appeared to be trying to fingerprint specific Danfoss controller components.“The activity peaked on 26 October, and importantly, we had not observed this behaviour on these sensors before 20 October. All authentication attempts were rejected by our sensors,” said Lupovis CEO Xavier Bellekens, adding that the timing is noteworthy.Censyshas found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. “France continues to lead Danfoss StoreView exposures globally, followed by Belgium and the US,” the internet intelligence firm said.The number of exposed StoreView instances in France has fallen sharply, from 1,825 before the October attacks to 220 at the time of Censys’ latest analysis.By matching firmware build dates, Censys estimates that 41% of the French instances still online run a patched version. It counted 138 exposed instances in Belgium, 51 in the Netherlands and 50 in Sweden, of which 68%, 37% and 58%, respectively, appear to be patched.Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Security researcherKevin Beaumontsaid people he spoke with had confirmed that every freezer hit on Monday had a management interface reachable from the internet. According to Beaumont, many of the devices are end-of-life and have no available patch.Officials have not publicly explained how the attackers got in.Deception security firm Lupovis toldSecurityWeekthat, between October 20 and 30, it saw suspicious activity aimed at its Danfoss AK-SM refrigeration controller sensors, including sensors in some of the affected regions. Most of the login attempts relied on factory-default credentials that Danfoss documents publicly, while others appeared to be trying to fingerprint specific Danfoss controller components.“The activity peaked on 26 October, and importantly, we had not observed this behaviour on these sensors before 20 October. All authentication attempts were rejected by our sensors,” said Lupovis CEO Xavier Bellekens, adding that the timing is noteworthy.Censyshas found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. “France continues to lead Danfoss StoreView exposures globally, followed by Belgium and the US,” the internet intelligence firm said.The number of exposed StoreView instances in France has fallen sharply, from 1,825 before the October attacks to 220 at the time of Censys’ latest analysis.By matching firmware build dates, Censys estimates that 41% of the French instances still online run a patched version. It counted 138 exposed instances in Belgium, 51 in the Netherlands and 50 in Sweden, of which 68%, 37% and 58%, respectively, appear to be patched.Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Officials have not publicly explained how the attackers got in.Deception security firm Lupovis toldSecurityWeekthat, between October 20 and 30, it saw suspicious activity aimed at its Danfoss AK-SM refrigeration controller sensors, including sensors in some of the affected regions. Most of the login attempts relied on factory-default credentials that Danfoss documents publicly, while others appeared to be trying to fingerprint specific Danfoss controller components.“The activity peaked on 26 October, and importantly, we had not observed this behaviour on these sensors before 20 October. All authentication attempts were rejected by our sensors,” said Lupovis CEO Xavier Bellekens, adding that the timing is noteworthy.Censyshas found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. “France continues to lead Danfoss StoreView exposures globally, followed by Belgium and the US,” the internet intelligence firm said.The number of exposed StoreView instances in France has fallen sharply, from 1,825 before the October attacks to 220 at the time of Censys’ latest analysis.By matching firmware build dates, Censys estimates that 41% of the French instances still online run a patched version. It counted 138 exposed instances in Belgium, 51 in the Netherlands and 50 in Sweden, of which 68%, 37% and 58%, respectively, appear to be patched.Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Deception security firm Lupovis toldSecurityWeekthat, between October 20 and 30, it saw suspicious activity aimed at its Danfoss AK-SM refrigeration controller sensors, including sensors in some of the affected regions. Most of the login attempts relied on factory-default credentials that Danfoss documents publicly, while others appeared to be trying to fingerprint specific Danfoss controller components.“The activity peaked on 26 October, and importantly, we had not observed this behaviour on these sensors before 20 October. All authentication attempts were rejected by our sensors,” said Lupovis CEO Xavier Bellekens, adding that the timing is noteworthy.Censyshas found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. “France continues to lead Danfoss StoreView exposures globally, followed by Belgium and the US,” the internet intelligence firm said.The number of exposed StoreView instances in France has fallen sharply, from 1,825 before the October attacks to 220 at the time of Censys’ latest analysis.By matching firmware build dates, Censys estimates that 41% of the French instances still online run a patched version. It counted 138 exposed instances in Belgium, 51 in the Netherlands and 50 in Sweden, of which 68%, 37% and 58%, respectively, appear to be patched.Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

“The activity peaked on 26 October, and importantly, we had not observed this behaviour on these sensors before 20 October. All authentication attempts were rejected by our sensors,” said Lupovis CEO Xavier Bellekens, adding that the timing is noteworthy.Censyshas found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. “France continues to lead Danfoss StoreView exposures globally, followed by Belgium and the US,” the internet intelligence firm said.The number of exposed StoreView instances in France has fallen sharply, from 1,825 before the October attacks to 220 at the time of Censys’ latest analysis.By matching firmware build dates, Censys estimates that 41% of the French instances still online run a patched version. It counted 138 exposed instances in Belgium, 51 in the Netherlands and 50 in Sweden, of which 68%, 37% and 58%, respectively, appear to be patched.Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Censyshas found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. “France continues to lead Danfoss StoreView exposures globally, followed by Belgium and the US,” the internet intelligence firm said.The number of exposed StoreView instances in France has fallen sharply, from 1,825 before the October attacks to 220 at the time of Censys’ latest analysis.By matching firmware build dates, Censys estimates that 41% of the French instances still online run a patched version. It counted 138 exposed instances in Belgium, 51 in the Netherlands and 50 in Sweden, of which 68%, 37% and 58%, respectively, appear to be patched.Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

The number of exposed StoreView instances in France has fallen sharply, from 1,825 before the October attacks to 220 at the time of Censys’ latest analysis.By matching firmware build dates, Censys estimates that 41% of the French instances still online run a patched version. It counted 138 exposed instances in Belgium, 51 in the Netherlands and 50 in Sweden, of which 68%, 37% and 58%, respectively, appear to be patched.Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

By matching firmware build dates, Censys estimates that 41% of the French instances still online run a patched version. It counted 138 exposed instances in Belgium, 51 in the Netherlands and 50 in Sweden, of which 68%, 37% and 58%, respectively, appear to be patched.Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Only a handful of exposed instances were seen in Luxembourg, Ireland and Estonia. Censys did not indicate whether any patched devices were among those compromised on Monday.Belgium among hardest hitBelgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Belgium appears to have taken the biggesthit. Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

An IKEA store in Mons was hit as well, and the Belgian federal prosecutor’s office has opened an investigation.In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

In Luxembourg, four Delhaize outlets were affected. In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Swedish grocer ICA confirmed that a limited number of its stores were impacted, while Coop reported problems at a handful of locations. An ICA store manager said they had to throw out significant amounts of food.In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

In the Netherlands, Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers.Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Finnish retailer Kesko said a few of its smaller stores had temperature disruptions. In Italy, the operator of several Coop-branded supermarkets in Sicily alerted the national cybersecurity agency, and in Portugal, the Mosqueteiros group confirmed incidents at seven Intermarché stores.EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

EU agriculture commissioner Christophe Hansen called the attacks a deliberate bid to disrupt the food supply chain and erode consumer trust. “The repeated occurrence of these cyberattacks is deeply concerning,” hesaid.Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Hansen said the bloc’s food security is not under threat for now, but he acknowledged the food that had to be thrown away and the harm to businesses.Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Related:Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareRelated:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Related:Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

General Paul M. Nakasone has joined Armadin’s Board of Directors.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Got a confidential news tip? We want to hear from you.

Reach a large audience of enterprise cybersecurity professionals

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.