Hackers hit supermarket freezers across seven European countries, raising temperatures to 50°C

On Monday, November 2, unknown attackers hijacked the refrigeration systems of supermarkets across Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland — in some stores reportedly pushing freezer temperatures to 50°C (122°F), spoiling food and forcing retailers to pull products from shelves. It was the second such wave in weeks, following a mid-October attack that disrupted an estimated 700 French supermarkets, caused fires in some stores, and inflicted damages in the tens of millions of euros.

IKEA confirmed that refrigeration systems at its store in Mons, Belgium were compromised, with staff removing food products from sale as a precaution. Swedish chains ICA and Coop were also affected. The refrigeration system used by ICA was supplied by Danfoss, the Danish manufacturer whose controllers were linked to the earlier attack in France. Coop said some of its fridges were connected via a 4G mobile network, which made them more exposed, according to The Guardian.

The EU condemned what it called "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it." Britain's National Cyber Security Centre (NCSC) said it had observed similar incidents affecting the UK food supply chain, though the UK has not been among the hardest-hit countries.

A couple of instances where vulnerable technology had been exploited in the UK.— Dr. Richard Horne, Chief Executive, NCSC

The mechanics of the attacks are straightforward — and that is part of what makes them so alarming. Modern commercial refrigeration systems include internet-connected controllers that allow technicians to remotely adjust temperatures, trigger defrost cycles and manage other functions. Attackers exploited the same legitimate remote-access features, cranking up temperatures until food spoiled and, in France, until electrical systems caught fire. No sophisticated malware was required.

Controller models tied to the French attack — built by Denmark's Danfoss and by Dixell and its US parent company Copeland — harboured critical security flaws that let attackers gain administrator-level remote access, according to Ars Technica. Danfoss controllers, for instance, had until recently used a daily-rotating credential generated by publicly available firmware: any attacker who analysed the code could reproduce the password for any unpatched device. Copeland acknowledged a vulnerability "identified in a discontinued, end-of-life generation of controllers."

Two things would have changed the outcome. Cyber hygiene would have prevented the access: take the controller off the public internet, put remote access behind a VPN and an IP allowlist, bring third-party kit onto the network in a controlled, owned and documented way rather than leaving it on a contractor's own connection, change known and default credentials, and patch to a current release.— Pen Test Partners researchers

In the days before the November attacks, researchers at Forescout's Vedere Labs counted 12,976 observations of internet-exposed refrigeration services spanning 99 countries and territories, with Italy and Greece showing notable levels of exposure. The firm had previously cautioned that "internet-exposed refrigeration systems are popular in several European countries beyond France, which could become the next targets of similar attacks" — a prediction borne out within days.

Forescout's research also showed that attacks against refrigeration equipment had been occurring throughout 2026, well before the French incidents. From January onward, researchers documented more than 20 attacks on refrigeration systems — hitting supermarkets, wineries, fruit storage facilities and food processing businesses in Spain, Italy and elsewhere in Europe — that hacktivist groups claimed credit for. Among the most prolific were two pro-Russian groups, Z-Pentest Alliance and NoName057(16); Z-Pentest alone claimed ten separate attacks on April 26. Forescout stopped short of linking either group to the French incidents or the broader November wave.

Attribution remains unresolved. No hacktivist group has claimed the November attacks, and no ransomware gang has issued demands — a complication, since the damage is largely done by the time a ransom could be extracted. The Guardian reported two leading theories among security analysts: a state actor using the attacks to signal capability, or a lone-wolf hacker acting for personal reasons.

The two most plausible attribution scenarios for me are some kind of state-based signalling and demonstration of capability or some kind of lone-wolf hacker that is conducting these attacks for their own personal reasons.— Rafe Pilling, Senior Director for Threat Intelligence, Sophos

The absence of malware complicates attribution further. As Pilling put it, it is like 'wearing rubber gloves and messing with the switches' — no weapon is left at the scene. Western intelligence agencies have said Russia is waging a hybrid warfare campaign against European targets, and state-linked hackers from Russia and China are considered possible actors by analysts, though no evidence directly linking either to these specific attacks has been made public.

Security researchers warn the risk extends well beyond supermarkets. Claroty CTO Amir Preminger said refrigeration controllers are also used in hospitals, pharmaceutical storage, water utilities and data centres, adding that "essentially, any organisation that handles temperature-sensitive goods is at risk." On the role of AI in lowering the barrier for attackers, Preminger pointed to Claroty research showing that someone could potentially use AI tools to replicate refrigeration controller vulnerabilities and reach root-level command execution on a lab device in roughly 28 minutes, at an AI-usage cost of just $6.

Heightened geopolitical tensions have driven a surge in activity targeting critical infrastructure, while AI technologies enable attackers to rapidly scan networks for vulnerabilities and weaknesses in access controls.— Amir Preminger, CTO, Claroty

The patch that could have limited Monday's damage was available. According to The Guardian, Belgian refrigerator group Sabcobel said the impact of the November attack could have been far worse had it not begun patching systems after the October attack in France. Bitdefender director of cyber-operations Nick Jackson said one factor behind delayed patching is that applying updates can force systems offline — a particular problem for food retailers — though he suggested a more straightforward reason may also be at play: the people running the fridges "don't think about that and it's not top of their agenda."

In the UK, retailers are working with the NCSC to secure refrigeration systems, according to Graham Wynn, assistant director of regulatory affairs at the British Retail Consortium. Forescout vice president of research Daniel dos Santos pointed out that the UK does not rank among the top ten countries for internet-exposed supermarket refrigeration systems; while the risk "is not negligible," he said, "I wouldn't say it's super-high right now for the UK specifically." Dr. Horne warned separately that businesses had failed to invest sufficiently in the technology underpinning essential services, and that AI could make existing vulnerabilities easier for attackers to discover and exploit.

Why it matters — Two waves of attacks have shown that basic, long-available security measures — patching software, removing controllers from the open internet, changing default passwords — are still not being applied to the systems that keep food cold for hundreds of millions of people, and researchers say thousands more remain exposed right now.

Reported by techspot.com, reuters.com, arstechnica.com, theguardian.com, machine.news