OPEN CHRONICLE | EUROPEAN AFFAIRS | CYBERSECURITY & CRITICAL INFRASTRUCTURE
SPECIAL INVESTIGATION | NOVEMBER 11, 2026
By Open Chronicle News Desk
Cyberattacks on refrigeration systems have disrupted supermarkets across Europe, destroyed food stocks and exposed weaknesses in equipment designed to keep essential services running. As the European Parliament examines the incidents, the crisis raises a larger question: are Europe’s hospitals, energy networks, water systems and supply chains sufficiently protected against attacks that move from computers into the physical world?
Introduction | When a cyberattack reaches the supermarket aisle
For most shoppers, a supermarket refrigerator is simply part of everyday life. It keeps food fresh, preserves frozen products and operates almost invisibly in the background.
But in October and November 2026, refrigeration equipment became the focus of an unusual series of cyberattacks across Europe.
Attackers interfered with remotely managed refrigeration systems, raising temperatures and forcing supermarkets to discard food that could no longer be safely sold.
The disruption affected stores in several European countries, including France, Belgium, Sweden and Portugal.
Unlike a conventional data breach, the attacks did not primarily involve the theft of passwords, payment details or personal information.
They interfered with machinery.
The consequences were physical, immediate and expensive.
In some cases, refrigerated goods were lost. Businesses had to disconnect equipment from external networks, inspect their systems and restore safe operating conditions.
The attacks have now reached the European political agenda.
On November 11, members of the European Parliament are discussing the incidents and the wider protection of critical infrastructure and supply chains.
The debate comes amid competing accusations about who was responsible.
French authorities have attributed the initial attacks to an Iranian-linked cyber unit, an allegation rejected by Tehran. Italian officials have raised concerns about possible involvement by groups sympathetic to Russia.
These assessments should not be confused with a conclusive public attribution of every incident. The perpetrators of the second wave have not been definitively established in the reporting reviewed for this article.
The immediate story concerns supermarket refrigeration.
The larger story concerns the growing dependence of European society on connected systems that can control temperatures, pumps, doors, ventilation, industrial machinery and other essential equipment.
The central vulnerability is not necessarily sophisticated artificial intelligence or an advanced computer virus.
Sometimes, it is an ordinary device connected to the internet without adequate protection.
1. Two waves of attacks in less than a month
The first major wave took place on October 11 and 12, 2026.
Approximately 700 stores in France were affected, according to reporting published by Al Jazeera.
Attackers reportedly manipulated refrigeration controls, with some equipment reaching temperatures as high as 50°C.
Food products were spoiled, and some incidents were associated with fires.
A second wave followed on November 2 and 3.
Reuters reported that supermarkets in eight European countries were affected by the November 2 attacks. Subsequent reporting described incidents across at least nine countries during the broader wave.
The differing totals reflect the reporting scope and timing, rather than necessarily conflicting accounts.
The countries identified in subsequent coverage included Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. Germany was also identified in Reuters reporting about affected supermarket equipment.
The exact number of stores and countries may be revised as investigations continue.
The incidents involved both major retail groups and independently operated supermarkets.
This distinction is important.
Large retail brands may have centralized cybersecurity teams, but individual franchise operators can maintain separate equipment, internet connections and service contracts.
As a result, two supermarkets displaying the same commercial name may have very different levels of protection.
The attacks exposed this fragmentation.
In Sweden, the supermarket chain ICA reported that equipment at 23 affected stores was connected outside the company’s centrally managed network.
Coop said seven affected stores had resumed operations, but their refrigeration systems had been disconnected from the internet.
Carrefour reported that 15 franchised stores in Belgium were affected during the second wave, after 80 franchised stores in France had experienced similar disruption in October.
These examples suggest that remote refrigeration systems can create vulnerabilities outside the cybersecurity controls normally applied to corporate networks.
2. How a refrigeration system becomes a target
Modern supermarkets use automated systems to control refrigeration.
A central controller may monitor temperatures, manage defrost cycles, report faults and allow maintenance contractors to adjust equipment remotely.
These capabilities are useful.
They can reduce energy consumption, prevent food spoilage and allow technicians to identify problems without visiting every store.
But remote management also creates an entry point.
If the controller is accessible from the public internet, an unauthorized person may attempt to interact with it.
The risks increase when equipment uses weak passwords, outdated software or poorly configured remote access.
Investigations into the European incidents identified weaknesses involving refrigeration management systems associated with manufacturer Danfoss.
Reporting by Euronews described attackers exploiting inadequately secured controllers, including devices that could be accessed using default credentials.
Once access was obtained, the attackers reportedly manipulated legitimate refrigeration functions, including defrost settings.
That is a critical distinction.
The attacker did not necessarily need to destroy the equipment’s software.
Instead, an ordinary operational function could be misused to produce a harmful physical outcome.
The attack illustrates how a system can behave exactly as commanded while still producing dangerous results because the person issuing the command is unauthorized.
3. The security failures investigators identified
The incidents exposed several weaknesses that frequently appear in operational technology environments.
Internet exposure. Some controllers were directly reachable from external networks, making them easier to discover and target.
Weak authentication. Devices using default or insufficiently protected credentials can be vulnerable to unauthorized access.
Outdated equipment. Older systems may no longer receive regular security updates or may be difficult to upgrade without interrupting operations.
Fragmented management. Equipment installed by external contractors may not be included in the organization’s central cybersecurity inventory.
Limited monitoring. Security teams may detect suspicious activity on office computers while overlooking unusual commands sent to refrigeration controllers.
These weaknesses are not unique to supermarkets.
They are common concerns in environments where information technology interacts with physical machinery.
Cybersecurity specialists describe this category as operational technology, or OT.
It includes industrial control systems, building management equipment and other technologies used to monitor or operate physical processes.
The distinction between IT and OT matters because the consequences of a compromise can be different.
An attack on an office computer may result in stolen files.
An attack on an industrial controller may interrupt a physical process.
Depending on the system, that could affect temperature, pressure, movement, access or production.
4. The warning signs before the second wave
One of the most revealing aspects of the investigation concerns activity detected before the November attacks.
Cybersecurity company Lupovis reported observing reconnaissance attempts targeting refrigeration controllers during October.
According to Euronews, the company recorded more than 276 attempts associated with 91 distinct threat actors during a ten-day period from October 20 to 30.
Activity reportedly peaked on October 26.
The company said the attempts involved identifying and probing components associated with Danfoss refrigeration management systems.
This does not prove that every observed actor participated in the subsequent attacks.
Reconnaissance activity can originate from different sources, including unrelated malicious actors and automated scanning systems.
Nevertheless, the findings illustrate a significant challenge.
Internet-connected equipment can attract attention before an organization realizes it is exposed.
A system may operate normally while unauthorized parties examine its accessibility.
The eventual disruption can therefore appear sudden even when suspicious activity has occurred earlier.
This creates an important role for threat intelligence and early warning.
If researchers, manufacturers and national cybersecurity agencies can identify patterns of hostile activity, they may be able to alert operators before an attack causes physical damage.
The European incidents raise questions about how quickly such warnings can reach small retailers and independent businesses.
5. Why supermarkets were vulnerable despite existing cybersecurity investment
Supermarkets are not unfamiliar with digital security.
Large retailers process millions of transactions, operate online stores and manage extensive customer databases.
Many invest substantially in protecting payment systems and personal information.
Yet refrigeration equipment often sits outside those traditional priorities.
It may be managed by a facilities department rather than an IT security team.
The manufacturer may install the controller, while a separate contractor maintains it.
Remote access may be configured for convenience and left unchanged for years.
Responsibility can become unclear.
Who is accountable for changing passwords?
Who checks whether a controller is exposed to the internet?
Who approves software updates?
Who responds when a cybersecurity agency identifies a vulnerability?
These questions matter because a device can remain operationally reliable while becoming increasingly insecure.
The absence of visible faults does not mean that remote access is safe.
The European attacks suggest that cybersecurity governance must extend beyond servers, employee laptops and payment terminals.
It must also include the machinery that keeps businesses functioning.
6. From supermarkets to hospitals: the cold chain problem
The implications become more serious when refrigeration is used to preserve medical supplies.
Hospitals, pharmacies, research laboratories and blood banks rely on controlled temperatures.
Some medicines, vaccines, blood products and biological samples must remain within specific storage ranges.
If temperature controls are compromised, the consequences may extend beyond financial loss.
Medical products could become unusable.
Laboratories could lose valuable samples.
Healthcare providers might face interruptions in treatment or supply.
French cybersecurity authorities have highlighted similarities between refrigeration technology used in supermarkets and equipment deployed in healthcare environments.
Euronews reported that blood banks in France were among the organizations affected by the November incidents.
The possibility of attacks affecting medical refrigeration is therefore not purely hypothetical.
However, the existence of shared technology does not establish that every hospital or medical storage facility is vulnerable in the same way.
Security depends on the configuration, network architecture, maintenance and protections applied to each system.
The broader lesson is that connected temperature control equipment should be treated as part of the organization’s security environment.
For healthcare providers, that includes protecting both digital systems and the physical processes that preserve medical supplies.
7. Europe’s critical infrastructure is more connected than ever
The refrigeration incidents reveal a wider problem.
Essential services increasingly depend on networks of sensors, controllers, remote maintenance systems and cloud-connected applications.
The advantages are substantial.
Utilities can monitor infrastructure remotely. Hospitals can manage complex facilities. Transport operators can coordinate services across large geographic areas. Manufacturers can optimize production.
But every additional connection introduces another relationship that must be secured.
Where Connected Equipment Creates Physical Risks
Connected operational technology supports essential services across Europe. When inadequately secured, these systems can expose physical operations to cyber risks.
Illustrative examples of connected operational technology. These sectors are not being presented as victims of the November supermarket attacks. Image source credits identify the referenced publishers or organizations and do not imply their involvement in the incidents.
A compromise in one environment does not automatically imply that attackers could compromise another.
Different systems have different safeguards.
But the supermarket incidents demonstrate why operators cannot assume that equipment is safe simply because it performs a relatively ordinary function.
8. The European threat landscape: what official data reveals
The European Union’s cybersecurity agencies have documented a complex and increasingly interconnected threat environment.
ENISA’s 2025 Threat Landscape report analyzed nearly 4,900 selected cybersecurity incidents between July 2024 and June 2025.
Public administration accounted for approximately 38% of the reported sectoral targeting in that dataset.
The report also identified phishing and vulnerability exploitation as major methods of gaining access to systems.
Hacktivist activity represented almost 80% of the incidents recorded, although many involved relatively low-impact distributed denial-of-service attacks.
The figures should not be interpreted as a complete census of every cyberattack in Europe. They describe ENISA’s selected and curated dataset.
CERT-EU’s April 2026 report provides another perspective.
It identified at least 174 distinct threat actors targeting EU institutions or their ecosystem during 2025, compared with 110 in 2024.
Cyberespionage and prepositioning accounted for 38% of the activity it recorded, while cybercrime represented 30%.
The report also highlighted the exploitation of internet-facing software and vulnerabilities in network equipment.
Seven of the nine significant incidents to which CERT-EU responded in 2025 involved vulnerability exploitation as the initial access method.
These findings do not prove that the supermarket incidents were conducted by the same groups.
They establish the broader security context in which the attacks occurred.
European organizations face threats from criminals, politically motivated groups and state-linked operators, often using vulnerabilities that could have been reduced through established security practices.
9. Was Iran responsible? What investigators have established
Attribution is among the most sensitive questions surrounding the attacks.
French authorities have publicly accused an Iranian-linked cyber unit, identified in reporting as Shahid Kaveh, of responsibility for the initial wave against French supermarkets.
Iran has rejected the allegation.
Italian officials have separately raised concerns about possible activity by groups sympathetic to Russia.
The second wave affected multiple countries, but the identity of those responsible has not been conclusively established in the public reporting reviewed.
Cybersecurity researchers have described reconnaissance patterns that could be consistent with coordinated activity.
Such findings are relevant, but they do not independently identify a government or organization responsible for the attacks.
Technical evidence, intelligence assessments and official attribution statements can provide different levels of confidence.
They should not be treated as interchangeable.
A government accusation is an important development, but it remains an attributed claim unless supported by publicly assessable evidence or other reliable confirmation.
Likewise, similarities between incidents do not necessarily establish that they were conducted by the same attackers.
For the Open Chronicle investigation, the strongest established conclusion is that multiple European countries experienced disruptive attacks on connected refrigeration equipment.
The identity and coordination of the perpetrators remain subjects of investigation.
10. NIS2: Europe’s cybersecurity obligations
The European Union has already adopted legislation intended to strengthen cybersecurity across important economic sectors.
The NIS2 Directive establishes requirements for cybersecurity risk management, incident reporting and oversight.
It covers a wider range of organizations than its predecessor, including entities operating in sectors such as energy, transport, health, digital infrastructure and certain areas of food production, processing and distribution.
However, NIS2 does not automatically cover every supermarket, refrigerator or small business.
Whether an organization falls within its scope depends on the relevant sector, its characteristics, applicable size criteria and national implementing rules, subject to specified exceptions.
The directive requires covered organizations to adopt proportionate technical, operational and organizational measures.
Those measures include incident handling, supply chain security, vulnerability management and business continuity.
The supermarket attacks demonstrate why these obligations cannot be understood as applying only to conventional office computing.
A refrigeration controller may be essential to the continuity of a business even if it is managed by a maintenance contractor rather than the central IT department.
Compliance is not simply a matter of having a written cybersecurity policy.
It requires understanding which systems are connected, who can access them and what happens if they fail.
11. The Cyber Resilience Act: making connected products safer
A second major component of the European response is the Cyber Resilience Act.
The legislation introduces cybersecurity requirements for products with digital elements placed on the EU market.
Its purpose is to improve security throughout a product’s lifecycle.
Manufacturers will have to address cybersecurity risks, manage vulnerabilities and provide appropriate security support.
The legislation is especially relevant to the broader market for connected devices.
Its main obligations are scheduled to apply from December 11, 2027.
Reporting obligations began applying on September 11, 2026.
The European Commission published additional implementation guidance in 2026 to clarify product scope, support periods and reporting responsibilities.
The distinction between NIS2 and the Cyber Resilience Act is important.
NIS2 primarily concerns cybersecurity responsibilities for organizations within its scope.
The Cyber Resilience Act focuses on security requirements for products and their manufacturers and other economic operators.
Neither framework guarantees that every attack will be prevented.
But together they address two related problems: the security of connected products and the responsibilities of organizations using digital systems.
12. The supply chain problem: one supplier, many customers
The refrigeration incidents also illustrate the risks associated with shared technology suppliers.
A controller manufacturer may supply equipment to hundreds or thousands of businesses.
Maintenance contractors may operate across several retail chains.
A vulnerability affecting a commonly deployed product can therefore create exposure in multiple countries.
That does not mean the manufacturer necessarily caused the attack.
A product may be deployed insecurely by a customer, operated with outdated software or connected to the internet in ways contrary to security guidance.
Responsibility must be assessed according to the actual technical and contractual circumstances.
Nevertheless, widespread dependence on common suppliers can amplify the consequences of security failures.
In February 2026, the European Commission announced an EU ICT Supply Chain Security Toolbox.
The initiative provides a common approach to identifying, assessing and mitigating cybersecurity risks in technology supply chains.
It includes recommendations concerning critical suppliers, supplier diversification and dependencies that could create systemic risks.
The supermarket incidents make this discussion more concrete.
A cybersecurity weakness in equipment used for ordinary commercial refrigeration can produce disruption across borders.
Supply chain security is therefore not limited to software companies, telecommunications networks or defense contractors.
It also concerns the suppliers of equipment on which everyday economic activity depends.
13. The cost of cyberattacks is not always measured in stolen data
Cybersecurity incidents are often evaluated according to the number of records stolen or the financial value of a ransom demand.
The refrigeration attacks require a different assessment.
Their consequences included spoiled food, interrupted business operations, emergency maintenance and the need to inspect or isolate affected equipment.
Some losses may be covered by insurance, while others may fall on retailers, franchise operators or suppliers.
The final financial impact has not been established across all affected countries.
It would therefore be premature to present a definitive Europe-wide loss figure.
However, the economic mechanisms are clear.
A refrigeration failure can destroy inventory.
It can interrupt sales.
It may require urgent technical intervention.
And it can create uncertainty about whether affected products remain safe for consumers.
The financial damage may be disproportionate to the complexity of the attack.
That is one reason operational technology security deserves greater attention.
The value of a connected device is not determined solely by its purchase price.
It also depends on the physical process it controls.
14. What businesses should change
The attacks provide several practical lessons for operators of connected equipment.
Operational Technology Security
A practical framework for retailers, healthcare providers, industrial operators and facilities teams.
Inventory Connected Equipment
Identify controllers, sensors, gateways and remote maintenance connections, including devices managed by external contractors.
Remove Unnecessary Internet Exposure
Use secure, controlled remote access rather than leaving equipment directly accessible from public networks.
Strengthen Authentication
Replace default credentials, restrict privileged access and use multifactor authentication where supported.
Maintain Security Updates
Track product support status, apply appropriate patches and establish plans for unsupported equipment.
Separate Critical Systems
Use appropriate network segmentation to limit the consequences of unauthorized access.
Monitor Abnormal Behavior
Detect unexpected configuration changes, remote sessions and unusual operating conditions.
Prepare for Physical Disruption
Maintain safe fallback procedures, incident response plans and coordination between cybersecurity and facilities teams.
General defensive guidance informed by the reported incidents and EU cybersecurity recommendations. Changes to safety-critical industrial systems should be coordinated with qualified personnel and equipment
manufacturers.
The most important organizational lesson concerns responsibility.
Cybersecurity teams and facilities managers need a shared understanding of connected equipment.
A business cannot adequately protect a device it does not know exists.
Nor can it manage vulnerabilities effectively if no one has responsibility for applying updates or reviewing remote access.
15. What European institutions must address
The European Parliament’s November 11 debate places the incidents within a broader policy discussion.
The EU faces several interconnected challenges.
One is the uneven security of older connected equipment already deployed across the economy.
Another is the difficulty of ensuring that smaller businesses can implement effective protections without excessive technical or financial burdens.
A third concerns the cross-border nature of cybersecurity threats.
An attack exploiting a common device can affect organizations in several member states.
National authorities therefore need mechanisms for sharing technical information quickly.
Manufacturers and service providers also need clear channels for distributing security guidance to customers.
ENISA has emphasized the importance of European cooperation and rapid information sharing following the supermarket attacks.
The political question is not simply whether Europe needs more legislation.
It is whether existing rules, technical standards and national capabilities can be translated into effective security for equipment already operating in supermarkets, hospitals, factories and utilities.
That requires implementation, oversight, investment and practical coordination.
16. The next challenge: resilience, not just prevention
No cybersecurity system can guarantee that every attack will be stopped.
That makes resilience essential.
For a supermarket, resilience may involve safe manual procedures, independent temperature monitoring and the ability to isolate remote access without losing essential local control.
For a hospital, it may require contingency plans for preserving medicines and maintaining critical services.
For a utility, it may involve redundant systems, tested recovery procedures and the ability to maintain safe operations during a network disruption.
The appropriate safeguards differ across sectors.
But the underlying principle is the same.
Essential physical processes should not depend entirely on the continued security of a single internet-connected device.
Cybersecurity must therefore address not only how to prevent unauthorized access but also how to limit damage when prevention fails.
That is the difference between protecting an individual computer and protecting an essential service.
Conclusion | Europe’s invisible infrastructure is now a cybersecurity priority
The cyberattacks against European supermarket refrigeration systems have exposed a vulnerability hidden in plain sight.
Equipment designed to preserve food became a means of disrupting businesses across national borders.
The incidents demonstrate how ordinary connected controllers can create physical consequences when access is inadequately protected.
They also reveal weaknesses in the division of responsibility between manufacturers, maintenance contractors, facilities managers and cybersecurity teams.
The attacks do not establish that every connected device is unsafe.
Nor do they prove that all European critical infrastructure faces the same level of exposure.
But they provide a documented example of what can happen when operational technology is accessible to unauthorized users.
The European Union has already developed an extensive cybersecurity regulatory framework.
The challenge now is ensuring that its requirements translate into practical protection across organizations of different sizes and technical capabilities.
The immediate priority is understanding how the attacks occurred, identifying affected equipment and preventing further disruption.
The longer-term task is more demanding.
Europe must protect not only the information stored in its networks but also the physical systems increasingly controlled through them.
Because in a connected economy, a cyberattack does not have to steal a single file to cause serious damage.
Sometimes, all it needs to do is change the temperature.
Open Chronicle will continue to follow the investigation into the European refrigeration attacks, the findings of national cybersecurity authorities and the implementation of EU rules governing connected equipment and critical infrastructure.
Sources and Further Reading
Official European cybersecurity publications, independent investigations and reporting on the October and November 2026 attacks against connected refrigeration equipment.
European Supermarkets Rush to Patch Vulnerabilities After Region-Wide Fridge Hack
November 3, 2026. Reporting by Louise Rasmussen, Helen Reid and Marcus Mathiesen documenting the second wave of attacks, affected supermarket chains, manufacturer responses and cybersecurity measures adopted by retailers.
Hackers Probed Europe’s Fridge Systems Weeks Before Cyberattacks
November 7, 2026. Investigation examining reconnaissance activity identified by Lupovis, exposed refrigeration controllers, authentication weaknesses and the risks facing other connected operational technology systems.
If Hackers Can Take Over a Supermarket Fridge, What Else Is at Risk?
November 11, 2026. Examination of the refrigeration attacks, potential vulnerabilities in connected equipment, attribution claims and the security of essential services.
ENISA Threat Landscape 2025
European Union Agency for Cybersecurity. Analysis of nearly 4,900 selected incidents from July 2024 to June 2025, including intrusion methods, ransomware, public administration and supply chain threats.
Threat Landscape Report 2025: A Year in Review
April 8, 2026. Assessment of threats against EU institutions and their ecosystem, including 174 identified threat actors, internet-facing vulnerabilities, service provider compromises and cyberespionage.
EU Launches New Toolbox to Strengthen ICT Supply Chain Security
February 13, 2026. Official explanation of the EU’s common approach to identifying and mitigating cybersecurity risks involving technology suppliers and critical dependencies.
Guidance on Cyber Resilience Act Implementation
Official guidance concerning the security of products with digital elements, including vulnerability management, support periods and reporting obligations. Main requirements apply from December 11, 2027.
European Parliament Debates Recent Cyberattacks Against EU Countries
November 11, 2026. Reporting on the European Parliament’s debate, the attacks affecting several member states including Portugal, and competing attribution claims
concerning Iran and pro-Russian groups.
This report distinguishes documented cybersecurity incidents, findings attributed to security researchers and allegations concerning state involvement. Attribution claims are not treated as independent proof of responsibility. Historical ENISA and CERT-EU statistics are identified by their respective reporting periods. Information reflects sources available November 11, 2026.