From France to Sweden, attackers are manipulating connected refrigeration systems, destroying food stocks and exposing a dangerous weakness in Europe’s digital infrastructure. The latest incidents raise an urgent question: how secure is the technology keeping the continent’s food supply cold?
By Open Chronicle
2 November 2026 | Cybersecurity | Cyberwarfare & Critical Infrastructure
Across Europe, supermarket refrigerators are becoming an unexpected target of cyberattacks.
In the early hours of Monday, November 2, retailers in Belgium, Luxembourg and Sweden discovered that refrigeration systems had stopped operating normally. Temperatures were rising, frozen products were thawing, and store employees were being called in to prevent the destruction of perishable food.
Similar incidents were also reported in Ireland, Estonia and the Netherlands, expanding the geographical reach of a problem that first attracted widespread attention in France three weeks earlier.
In some affected locations, refrigeration controls were reportedly changed to temperatures of 50°C or higher. Instead of preserving food, equipment designed to maintain cold storage was operating under dangerously abnormal conditions.
The consequences were immediate: spoiled meat, discarded frozen products, interrupted sales and substantial financial losses.
The incidents follow a major cyberattack against French supermarket refrigeration systems on October 12, when hundreds of stores were affected and some equipment overheated sufficiently to cause fires.
Unlike conventional cybercrime, which often involves stolen passwords, financial information or ransomware, these attacks demonstrate how interference with digital controls can produce physical damage.
The targets are not just computers.
They are the systems responsible for keeping food safe.
And the latest incidents suggest that vulnerabilities in these systems remain a serious problem across Europe.
A New Wave Hits European Supermarkets
The latest disruption began overnight between Sunday, November 1, and Monday, November 2.
In Belgium, Delhaize reported an IT incident affecting refrigeration equipment at approximately 40 stores.
Carrefour Belgium confirmed problems at 15 locations, while Spar outlets and specialist food retailers also reported incidents.
The disruption affected stores in different parts of Belgium, including convenience shops and supermarket branches.
Some employees were alerted during the night and rushed to their workplaces to protect refrigerated products.
According to Belgian reporting, refrigeration settings had been changed remotely, and equipment had been switched into defrost mode.
That distinction is important.
The problem was not necessarily a conventional power failure. In affected systems, the refrigeration equipment itself had received or accepted altered operating instructions.
The resulting temperature increases could make stored food unsafe for sale even when the equipment remained electrically powered.
Delhaize said it had taken measures to keep stores operational and protect product freshness, although some refrigerated and frozen goods were temporarily unavailable.
Sweden: Freezers Reportedly Set to 50°C
In Sweden, supermarkets belonging to ICA and Coop experienced similar problems.
An ICA store in Sjöbo, southern Sweden, reported that its refrigeration equipment had been set to approximately 50°C.
The abnormal temperature rendered food stocks unusable and disrupted normal operations.
Coop reported problems at six stores in central Sweden, while ICA confirmed that a limited number of its locations had been affected.
At another ICA location on the island of Öland, a store manager reported discovering water on the floor and a freezer temperature reading of 55°C.
The incidents prompted emergency responses from employees attempting to save stock and restore refrigeration.
Not every retailer initially confirmed that its own incident was caused by a cyberattack. Some companies described the events as refrigeration malfunctions while investigations continued.
However, the similarity of the reported temperature changes and the timing of the disruptions intensified concerns about deliberate interference with connected equipment.
Ireland, Estonia and the Netherlands Also Report Incidents
The geographical scope expanded as further reports emerged on Monday.
In Ireland, Musgrave reported refrigeration problems at 13 SuperValu stores.
In Estonia, refrigeration technology provider Kitman Coldtech said attackers had accessed a computer controlling refrigeration equipment and changed the temperature to 50°C.
The company reported that the problem was addressed within minutes, preventing significant damage. Retailer Selver confirmed that one of its stores was affected.
In the Netherlands, broadcaster NOS reported that refrigeration systems at at least 17 businesses had been targeted.
A Danfoss spokesperson said the affected locations included smaller retailers, butcher shops and frozen-food storage facilities.
At one facility, a system intended to operate at minus 20°C was reportedly changed to minus 10°C. The abnormal setting was discovered quickly enough for staff to intervene.
According to the supplier, affected Dutch systems had not been placed behind sufficiently secure network connections and still used default passwords.
These reports demonstrate that the problem is not confined to one supermarket chain or one country.
The French Attack That Exposed the Danger
The latest incidents follow a major attack in France during the night of October 11 to 12.
Hundreds of supermarkets experienced abnormal refrigeration temperatures after attackers gained access to connected control systems.
Affected retailers included Intermarché, Netto, Coopérative U, Carrefour, E.Leclerc and Monoprix.
French authorities subsequently indicated that approximately 700 supermarkets had been affected, although individual reports and company estimates varied as the investigation developed.
In several locations, attackers changed refrigeration settings to approximately 50°C.
Some systems were placed into extended defrost cycles, preventing normal cooling and delaying the detection of the problem.
The result was widespread food spoilage.
Stores discarded meat, dairy products, vegetables and frozen goods that could no longer be considered safe.
Some retailers reported substantial losses, and the combined financial damage was estimated in the tens of millions of euros.
French prosecutors confirmed that the incidents had also caused fires when equipment overheated.
The French National Cybersecurity Agency, ANSSI, became involved in the investigation, and Europol subsequently assisted authorities.
The scale of the disruption transformed what might initially have appeared to be a technical refrigeration problem into a significant European cybersecurity concern.
How Can Hackers Control a Supermarket Refrigerator?
Modern commercial refrigeration is increasingly dependent on digital control systems.
Large supermarkets operate numerous refrigerated display cabinets, cold rooms and freezers that must maintain specific temperatures.
To manage this equipment efficiently, retailers and maintenance companies use electronic controllers.
These systems can regulate compressors, fans, temperature settings, alarms and defrost cycles.
They may also allow technicians to monitor equipment remotely.
Remote access can be useful.
It allows engineers to diagnose faults, adjust operating parameters and respond to problems without travelling to each store.
However, the same connectivity creates a potential attack surface.
If a control system is directly accessible through the internet, uses weak authentication or runs outdated software, an unauthorised person may be able to interfere with its operation.
The consequences can be more serious than those of an ordinary computer malfunction.
Changing a refrigeration setting can destroy food, damage equipment and disrupt business operations.
The European incidents demonstrate how cyberattacks against operational technology, often called OT, can move beyond digital disruption into the physical environment.
The Defrost Function Became a Weapon
Commercial refrigeration systems periodically use defrost cycles to remove ice that accumulates on cooling equipment.
Under normal conditions, these cycles are controlled to maintain safe operating temperatures.
During the French incidents, attackers reportedly manipulated these settings, causing refrigeration equipment to remain in defrost mode for unusually long periods.
At some locations, temperature settings were raised and defrost periods extended.
This combination increased the likelihood that food would spoil before staff could intervene.
Belgian refrigeration specialists reported a similar mechanism during the November 2 incidents.
According to Sabcobel, technicians worked through the night to disconnect affected equipment from networks and regain control of the systems.
The attack illustrates a particularly troubling characteristic of industrial cybersecurity incidents.
An attacker does not necessarily need to destroy machinery or disable an entire network.
Altering a small number of operating parameters can be sufficient to cause serious financial and physical consequences.
The Vulnerable Technology Identified by French Authorities
The French cybersecurity authority issued a formal warning on October 12, subsequently updated on October 16.
The alert identified compromises involving several refrigeration control product families:
REFRIGERATION CONTROLLERS IDENTIFIED BY CERT-FR
| Danfoss | AK-SM series |
| Danfoss | AK-SC series |
| Copeland | xweb controllers |
| Dixell | xweb controllers |
Source: CERT-FR alert CERTFR-2026-ALE-012, updated October 16, 2026.
The French authority warned that exposing equipment management interfaces directly to the internet was contrary to established security practices.
The agency recommended restricting remote access, updating systems where possible and investigating equipment that may already have been compromised.
The problem is particularly serious for older controllers that no longer receive security updates.
Such devices may remain in operation for many years because replacing industrial equipment is expensive and disruptive.
However, continuing to operate unsupported devices can leave businesses exposed to vulnerabilities that are difficult or impossible to correct through ordinary software updates.
The official warning demonstrates that the issue is not limited to one manufacturer’s equipment.
Why This Is More Than a Supermarket Problem
The attacks highlight a broader weakness in Europe’s digitally connected infrastructure.
Operational technology controls physical processes across numerous industries.
It is used in manufacturing plants, water treatment facilities, energy networks, transport systems, warehouses and commercial buildings.
Many of these systems were originally designed for reliability and long service lives rather than continuous exposure to internet-based threats.
As remote monitoring became more common, some equipment was connected to external networks without equivalent improvements in cybersecurity.
The result is a growing collection of devices that perform essential physical functions while remaining vulnerable to unauthorised access.
Refrigeration systems are particularly sensitive because their failure can produce immediate losses.
A compromised office computer may interrupt administrative work.
A compromised cold-storage controller can destroy valuable products within hours.
In food distribution, prolonged disruption can also affect deliveries, product availability and confidence in the integrity of the cold chain.
The latest incidents do not demonstrate that Europe’s entire food supply is at risk of collapse.
They do show that relatively small technical weaknesses can have consequences across multiple countries and businesses.
The Food Safety Consequences
The immediate concern for supermarkets is whether products remain safe after refrigeration temperatures rise.
Different food categories have different storage requirements.
Frozen food that has thawed may become unsuitable for sale, depending on the duration and extent of the temperature change.
Fresh meat, fish, dairy products and other perishable goods are particularly sensitive to interruptions in temperature control.
Retailers therefore cannot simply restore refrigeration and assume that all products remain safe.
They must assess temperature records, exposure times and applicable food safety requirements.
When those conditions cannot be verified, products may need to be discarded.
This creates a difficult situation.
Food that is physically intact may nevertheless be unsafe because its storage conditions can no longer be guaranteed.
The financial losses can be substantial, but the priority must remain consumer safety.
The incidents also demonstrate why reliable temperature monitoring and independent alarm systems are important safeguards.
If the same compromised controller manages both refrigeration and its alerts, operators may not receive timely warnings.
Could the Attacks Be Coordinated?
The geographical spread and technical similarities have prompted questions about whether the incidents are part of a coordinated campaign.
However, investigators have not established a common perpetrator.
No group has publicly claimed responsibility for the latest wave, and authorities have not confirmed whether the November incidents were carried out by the same individuals responsible for the October attacks in France.
It is also too early to determine whether the motive was financial, disruptive, ideological or simply opportunistic.
Some cybersecurity specialists have noted that insecure industrial equipment can be compromised without the resources normally associated with sophisticated state-backed operations.
The absence of a ransom demand in the French incidents has added uncertainty.
Attributing cyberattacks requires technical evidence, including network records, forensic analysis and reliable connections between infrastructure and identifiable actors.
Similar methods alone are not sufficient.
For now, the most defensible conclusion is that European retailers are experiencing a series of closely resembling attacks against vulnerable refrigeration technology.
Whether those incidents represent one organised campaign remains unresolved.
Why Security Updates Alone May Not Be Enough
The incidents have exposed a difficult problem for retailers and equipment manufacturers.
Many refrigeration controllers were installed years before cybersecurity became a major consideration in commercial building management.
Some operate outdated firmware. Others may use default passwords or provide remote access through poorly protected internet connections.
According to Dutch broadcaster NOS, Danfoss said the systems affected in the Netherlands had not been adequately secured following warnings issued after the French attacks.
Belgian refrigeration company Sabcobel also indicated that some equipment requires physical modifications rather than a straightforward software update.
This means the solution may involve additional investment, network redesign and the replacement of older equipment.
France’s CERT-FR has advised organisations to reduce the exposure of refrigeration controllers to public networks and investigate potentially compromised systems.
The priority is not simply to restore normal temperatures.
Businesses must also establish whether unauthorised access remains possible.
What European Retailers Should Learn
The attacks provide a clear warning to organisations operating connected equipment.
Cybersecurity must extend beyond payment systems, customer databases and office computers.
Refrigeration controllers, building automation systems and other operational technologies require their own security assessments.
For retailers and refrigeration contractors, the essential safeguards include restricting internet access to control interfaces, replacing default credentials, maintaining supported firmware, separating operational networks from ordinary business systems and monitoring equipment through independent alarms.
Incident response plans should also include procedures for isolating affected controllers, restoring safe operation and evaluating potentially compromised food.
These measures cannot guarantee that every attack will be prevented.
They can, however, reduce the likelihood that a single vulnerable device will disrupt an entire store.
A Warning for Europe’s Critical Infrastructure
The November incidents have revealed an uncomfortable reality about digital transformation.
Connected technology can make commercial infrastructure more efficient while simultaneously creating new forms of vulnerability.
The same remote access that allows technicians to maintain refrigeration equipment can become dangerous when inadequately protected.
And the consequences extend beyond financial records or stolen information.
Food can be destroyed. Machinery can overheat. Businesses can lose access to essential equipment.
The October attacks in France demonstrated the potential scale of the damage.
The November incidents show that the underlying problem has not disappeared.
For European authorities, retailers and equipment manufacturers, the challenge is now to determine how widespread these weaknesses are and how quickly they can be addressed.
The most important lesson is that a cyberattack no longer needs to shut down a supermarket’s computers to disrupt its business. Sometimes, changing the temperature of a freezer is enough.
Sources and Further Reading
The following references provide the reporting and technical foundation for this investigation.
1. Reuters | Cyberattack on Fridges Hits Supermarkets Across Europe
2 November 2026 | International Reporting
Main international report covering Belgium, Luxembourg, Sweden, Ireland and Estonia, including retailer responses, food losses and the ongoing investigation.
2. Associated Press | Freezers at Supermarkets in Several European Countries Hit by Apparent Cyberattacks
2 November 2026 | Independent News Reporting
Independent reporting on affected retailers, abnormal temperature settings and operational consequences.
3. CERT-FR / ANSSI | Security Incident Targeting Remote Refrigeration Controllers
12 October 2026, updated 16 October | Official Cybersecurity Alert
Official French cybersecurity alert identifying affected equipment families and recommended protective measures.
4. Le Monde | A Disastrous Day for French Supermarkets After Massive Cyberattack Targets Refrigeration Systems
13 October 2026 | French Investigative Reporting
Detailed reporting on the French incidents, compromised refrigeration controls, food losses and investigations.
5. NOS | Refrigeration Systems Attacked at 17 Dutch Businesses
2 November 2026 | Netherlands Reporting
Dutch reporting based on statements from Danfoss, including insecure connections, default passwords and affected cold-storage facilities.
6. The Brussels Times | Suspected Cyberattack Hits Fridges and Freezers at Dozens of Belgian Supermarkets
2 November 2026 | Belgian News Reporting
Reporting on Belgian retailers, remote changes to refrigeration settings and emergency responses.
7. Retail & Hospitality ISAC | French Supermarket Refrigeration Systems Hit by Cyberattacks
15 October 2026 | Cyber Threat Intelligence
Cyber threat intelligence analysis of the French attacks, exposed operational technology and security implications for retailers.
8. The Record | EU Cyber Law Won’t Force Fixes for Fridge Controllers Hit in French Attack
20 October 2026 | Cybersecurity Regulation
Analysis of cybersecurity responsibilities, unsupported industrial equipment and the limitations of European regulatory requirements.
Editorial Note
This article was prepared on November 2, 2026, using Reuters, Associated Press, European news organisations and technical guidance published by France’s national cybersecurity authorities. The incidents are developing, and the number of affected locations, financial losses and technical findings may change as investigations continue. Although several incidents involve similar manipulation of refrigeration controls, no common perpetrator or coordinated campaign has been conclusively established. Reported temperatures refer to individual equipment readings or control settings and should not be interpreted as uniform conditions across all affected stores. Technical explanations and assessments of wider infrastructure risks are based on documented vulnerabilities and established operational technology security principles.