Loading signal...
Signal
Submitted
Nov 2, 2026, 17:12 UTC
A Danish food producer’s refrigeration systems were targeted in an attempted cyberattack detected via an alarm from its refrigeration‑plant supplier; the producer stopped the attack with prior preventive measures, and DI believes no other Danish companies were hit, though similar food‑sector cyber incidents have recently affected supermarkets in multiple European countries.
According to Danish media, a Danish food producer's refrigeration systems were subjected to an attempted cyberattack late Sunday night (described as "in the night to Monday"). The incident was disclosed by Dansk Industri (DI) cybersecurity consultant Jeppe Engell in an interview with DR, as reported by B.T. The company received an alarm from its refrigeration‑plant supplier stating that they had been attacked and that the supplier had failed to stop the attack. However, the Danish food producer itself managed to stop the attack after implementing some preventive measures in advance, and thus avoided operational disruption. Engell declined to identify the specific producer but confirmed that it is not a supermarket.
Jeppe Engell stated that DI does not believe more Danish companies were attacked in this wave: "We are more than 100 percent sure of that. Everyone I have been in contact with has reported that everything is running smoothly," he said. Nevertheless, the attack is seen in the broader context of ongoing threats to food retail and cold‑chain infrastructure. The story references the earlier large‑scale ransomware incident against supermarket chains in July (implied, but not dated in the text), where Coop and several other supermarket chains in Denmark were affected when software from the supplier Wolt (not named here; instead, he notes supermarkets had to close temporarily). Specifically, the article cites that supermarket chains such as Coop and others, including the Rema 1000 group (via Rema owner Reitan, referred to as "Ritzu"/"Ritzau" in the text), were impacted in that earlier case.
Salling Group is also mentioned as having experienced issues in connection with previous supermarket cyber incidents abroad, but the present article stresses that the current attack was confined to the single Danish food producer and was thwarted. DI safety director Jacob Nielsen is quoted emphasizing that the incident is being treated as an attempted cyberattack, and that the industry remains focused on risk mitigation. He notes that this case underlines how critical it is to have visibility into supply‑chain dependencies, since the alarm originated from the refrigeration‑plant supplier whose systems were initially compromised. The article closes by recalling that Monday’s (earlier, separate) attack wave abroad had affected food stores in Sweden, Ireland, Belgium, Estonia and Luxembourg, illustrating that food distribution IT and refrigeration control systems are attractive targets for cyber actors.
Confidence: Medium
The report describes a deliberate attempted cyber intrusion targeting refrigeration systems of a Danish food producer, which are part of critical food supply infrastructure. Although the attacker is not attributed and the attack was stopped before causing damage, it constitutes hostile cyber activity against critical infrastructure. The article’s focus is on the incident itself rather than on planned defensive exercises or procurements, fitting the HYBRID_SIGNAL category. Confidence is medium...
Source URL
https://bt.dk/erhverv/di-dansk-foedevareproducent-udsat-for-cyberangreb
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "3dbcb4a0-0883-4da5-8607-1bd7b87afa4a",
"url": "https://bt.dk/erhverv/di-dansk-foedevareproducent-udsat-for-cyberangreb",
"source": "extension",
"status": "processed",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
"country": "Denmark",
"source_reliability": "B",
"info_credibility": "2",
"tags": [
"Denmark",
"food sector",
"refrigeration systems",
"industrial control systems",
"critical infrastructure",
"cyberattack attempt",
"supply-chain compromise",
"supermarket sector",
"Nordic-Baltic",
"Europe-wide incident linkage"
],
"nodes": [],
"countries": [],
"where_text": "Cyberspace",
"headline": null,
"description": "According to Danish media, a Danish food producer's refrigeration systems were subjected to an attempted cyberattack late Sunday night (described as \"in the night to Monday\"). The incident was disclosed by Dansk Industri (DI) cybersecurity consultant Jeppe Engell in an interview with DR, as reported by B.T. The company received an alarm from its refrigeration‑plant supplier stating that they had been attacked and that the supplier had failed to stop the attack. However, the Danish food producer itself managed to stop the attack after implementing some preventive measures in advance, and thus avoided operational disruption. Engell declined to identify the specific producer but confirmed that it is not a supermarket.\n\nJeppe Engell stated that DI does not believe more Danish companies were attacked in this wave: \"We are more than 100 percent sure of that. Everyone I have been in contact with has reported that everything is running smoothly,\" he said. Nevertheless, the attack is seen in the broader context of ongoing threats to food retail and cold‑chain infrastructure. The story references the earlier large‑scale ransomware incident against supermarket chains in July (implied, but not dated in the text), where Coop and several other supermarket chains in Denmark were affected when software from the supplier Wolt (not named here; instead, he notes supermarkets had to close temporarily). Specifically, the article cites that supermarket chains such as Coop and others, including the Rema 1000 group (via Rema owner Reitan, referred to as \"Ritzu\"/\"Ritzau\" in the text), were impacted in that earlier case.\n\nSalling Group is also mentioned as having experienced issues in connection with previous supermarket cyber incidents abroad, but the present article stresses that the current attack was confined to the single Danish food producer and was thwarted. DI safety director Jacob Nielsen is quoted emphasizing that the incident is being treated as an attempted cyberattack, and that the industry remains focused on risk mitigation. He notes that this case underlines how critical it is to have visibility into supply‑chain dependencies, since the alarm originated from the refrigeration‑plant supplier whose systems were initially compromised. The article closes by recalling that Monday’s (earlier, separate) attack wave abroad had affected food stores in Sweden, Ireland, Belgium, Estonia and Luxembourg, illustrating that food distribution IT and refrigeration control systems are attractive targets for cyber actors.",
"summary_short": "A Danish food producer’s refrigeration systems were targeted in an attempted cyberattack detected via an alarm from its refrigeration‑plant supplier; the producer stopped the attack with prior preventive measures, and DI believes no other Danish companies were hit, though similar food‑sector cyber incidents have recently affected supermarkets in multiple European countries.",
"summary_extended": null,
"actor_primary": "Dansk Industri (DI)",
"target_primary": null,
"location_text": "Denmark (unspecified food production facility)",
"location_region": null,
"location_coordinates_lat": 56.26392,
"location_coordinates_lon": 9.501785,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "Medium",
"classification_rationale": "The report describes a deliberate attempted cyber intrusion targeting refrigeration systems of a Danish food producer, which are part of critical food supply infrastructure. Although the attacker is not attributed and the attack was stopped before causing damage, it constitutes hostile cyber activity against critical infrastructure. The article’s focus is on the incident itself rather than on planned defensive exercises or procurements, fitting the HYBRID_SIGNAL category. Confidence is medium...",
"event_time_utc": "2026-11-02T17:12:00.895Z",
"end_time_utc": null,
"event_time_confidence": "unknown",
"created_at": "2026-11-02T17:12:00.895Z",
"updated_at": "2026-11-04T02:48:27.947Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "unknown",
"severity_band": "minor",
"attribution_confidence_band": "low",
"attribution_basis": "single_source"
}Source reliability
B
Info credibility
2
Event time
Nov 2, 2026, 17:12 UTC
Event time confidence
unknown
Location
Denmark (unspecified food production facility)
Primary actor
Dansk Industri (DI)
Country
Denmark
Tags
Denmark, food sector, refrigeration systems, industrial control systems, critical infrastructure, cyberattack attempt, supply-chain compromise, supermarket sector, Nordic-Baltic, Europe-wide incident linkage
Signal
Submitted
Nov 2, 2026, 17:12 UTC
A Danish food producer’s refrigeration systems were targeted in an attempted cyberattack detected via an alarm from its refrigeration‑plant supplier; the producer stopped the attack with prior preventive measures, and DI believes no other Danish companies were hit, though similar food‑sector cyber incidents have recently affected supermarkets in multiple European countries.
According to Danish media, a Danish food producer's refrigeration systems were subjected to an attempted cyberattack late Sunday night (described as "in the night to Monday"). The incident was disclosed by Dansk Industri (DI) cybersecurity consultant Jeppe Engell in an interview with DR, as reported by B.T. The company received an alarm from its refrigeration‑plant supplier stating that they had been attacked and that the supplier had failed to stop the attack. However, the Danish food producer itself managed to stop the attack after implementing some preventive measures in advance, and thus avoided operational disruption. Engell declined to identify the specific producer but confirmed that it is not a supermarket.
Jeppe Engell stated that DI does not believe more Danish companies were attacked in this wave: "We are more than 100 percent sure of that. Everyone I have been in contact with has reported that everything is running smoothly," he said. Nevertheless, the attack is seen in the broader context of ongoing threats to food retail and cold‑chain infrastructure. The story references the earlier large‑scale ransomware incident against supermarket chains in July (implied, but not dated in the text), where Coop and several other supermarket chains in Denmark were affected when software from the supplier Wolt (not named here; instead, he notes supermarkets had to close temporarily). Specifically, the article cites that supermarket chains such as Coop and others, including the Rema 1000 group (via Rema owner Reitan, referred to as "Ritzu"/"Ritzau" in the text), were impacted in that earlier case.
Salling Group is also mentioned as having experienced issues in connection with previous supermarket cyber incidents abroad, but the present article stresses that the current attack was confined to the single Danish food producer and was thwarted. DI safety director Jacob Nielsen is quoted emphasizing that the incident is being treated as an attempted cyberattack, and that the industry remains focused on risk mitigation. He notes that this case underlines how critical it is to have visibility into supply‑chain dependencies, since the alarm originated from the refrigeration‑plant supplier whose systems were initially compromised. The article closes by recalling that Monday’s (earlier, separate) attack wave abroad had affected food stores in Sweden, Ireland, Belgium, Estonia and Luxembourg, illustrating that food distribution IT and refrigeration control systems are attractive targets for cyber actors.
Confidence: Medium
The report describes a deliberate attempted cyber intrusion targeting refrigeration systems of a Danish food producer, which are part of critical food supply infrastructure. Although the attacker is not attributed and the attack was stopped before causing damage, it constitutes hostile cyber activity against critical infrastructure. The article’s focus is on the incident itself rather than on planned defensive exercises or procurements, fitting the HYBRID_SIGNAL category. Confidence is medium...
Source URL
https://bt.dk/erhverv/di-dansk-foedevareproducent-udsat-for-cyberangreb
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "3dbcb4a0-0883-4da5-8607-1bd7b87afa4a",
"url": "https://bt.dk/erhverv/di-dansk-foedevareproducent-udsat-for-cyberangreb",
"source": "extension",
"status": "processed",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
"country": "Denmark",
"source_reliability": "B",
"info_credibility": "2",
"tags": [
"Denmark",
"food sector",
"refrigeration systems",
"industrial control systems",
"critical infrastructure",
"cyberattack attempt",
"supply-chain compromise",
"supermarket sector",
"Nordic-Baltic",
"Europe-wide incident linkage"
],
"nodes": [],
"countries": [],
"where_text": "Cyberspace",
"headline": null,
"description": "According to Danish media, a Danish food producer's refrigeration systems were subjected to an attempted cyberattack late Sunday night (described as \"in the night to Monday\"). The incident was disclosed by Dansk Industri (DI) cybersecurity consultant Jeppe Engell in an interview with DR, as reported by B.T. The company received an alarm from its refrigeration‑plant supplier stating that they had been attacked and that the supplier had failed to stop the attack. However, the Danish food producer itself managed to stop the attack after implementing some preventive measures in advance, and thus avoided operational disruption. Engell declined to identify the specific producer but confirmed that it is not a supermarket.\n\nJeppe Engell stated that DI does not believe more Danish companies were attacked in this wave: \"We are more than 100 percent sure of that. Everyone I have been in contact with has reported that everything is running smoothly,\" he said. Nevertheless, the attack is seen in the broader context of ongoing threats to food retail and cold‑chain infrastructure. The story references the earlier large‑scale ransomware incident against supermarket chains in July (implied, but not dated in the text), where Coop and several other supermarket chains in Denmark were affected when software from the supplier Wolt (not named here; instead, he notes supermarkets had to close temporarily). Specifically, the article cites that supermarket chains such as Coop and others, including the Rema 1000 group (via Rema owner Reitan, referred to as \"Ritzu\"/\"Ritzau\" in the text), were impacted in that earlier case.\n\nSalling Group is also mentioned as having experienced issues in connection with previous supermarket cyber incidents abroad, but the present article stresses that the current attack was confined to the single Danish food producer and was thwarted. DI safety director Jacob Nielsen is quoted emphasizing that the incident is being treated as an attempted cyberattack, and that the industry remains focused on risk mitigation. He notes that this case underlines how critical it is to have visibility into supply‑chain dependencies, since the alarm originated from the refrigeration‑plant supplier whose systems were initially compromised. The article closes by recalling that Monday’s (earlier, separate) attack wave abroad had affected food stores in Sweden, Ireland, Belgium, Estonia and Luxembourg, illustrating that food distribution IT and refrigeration control systems are attractive targets for cyber actors.",
"summary_short": "A Danish food producer’s refrigeration systems were targeted in an attempted cyberattack detected via an alarm from its refrigeration‑plant supplier; the producer stopped the attack with prior preventive measures, and DI believes no other Danish companies were hit, though similar food‑sector cyber incidents have recently affected supermarkets in multiple European countries.",
"summary_extended": null,
"actor_primary": "Dansk Industri (DI)",
"target_primary": null,
"location_text": "Denmark (unspecified food production facility)",
"location_region": null,
"location_coordinates_lat": 56.26392,
"location_coordinates_lon": 9.501785,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "Medium",
"classification_rationale": "The report describes a deliberate attempted cyber intrusion targeting refrigeration systems of a Danish food producer, which are part of critical food supply infrastructure. Although the attacker is not attributed and the attack was stopped before causing damage, it constitutes hostile cyber activity against critical infrastructure. The article’s focus is on the incident itself rather than on planned defensive exercises or procurements, fitting the HYBRID_SIGNAL category. Confidence is medium...",
"event_time_utc": "2026-11-02T17:12:00.895Z",
"end_time_utc": null,
"event_time_confidence": "unknown",
"created_at": "2026-11-02T17:12:00.895Z",
"updated_at": "2026-11-04T02:48:27.947Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "unknown",
"severity_band": "minor",
"attribution_confidence_band": "low",
"attribution_basis": "single_source"
}Source reliability
B
Info credibility
2
Event time
Nov 2, 2026, 17:12 UTC
Event time confidence
unknown
Location
Denmark (unspecified food production facility)
Primary actor
Dansk Industri (DI)
Country
Denmark
Tags
Denmark, food sector, refrigeration systems, industrial control systems, critical infrastructure, cyberattack attempt, supply-chain compromise, supermarket sector, Nordic-Baltic, Europe-wide incident linkage