Overview
Attacks on refrigeration systems at European supermarkets show how a security problem in one product can cascade across an industry and disrupt supply chains at scale. A Dark Reading analysis examined why the incidents spread so widely. The site was not retrievable for this write-up, so the details below come from other public reporting (ABC News, Euronews, Al Jazeera, The Hacker News and Scientific American).
What Happened
- Wave 1, October 2026: Attackers targeted refrigeration systems at hundreds of grocery stores in France. One Normandy supermarket reported some refrigerators reaching 80 °C.
- Wave 2, November 2, 2026: Refrigeration control settings were changed remotely overnight, warming fridges and freezers. Stores in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden reported problems, and outlets list the countries differently. Chains named include Delhaize, Carrefour, ICA, Coop and Selver, plus an Ikea outlet. One Estonian freezer was reportedly set to 50 °C.
No chain reported more than several dozen affected stores, and some had to discard or pull chilled and frozen food. Nobody has been publicly identified as responsible.
Why It Spread
Danfoss, the Danish maker of refrigeration controls, said its products were involved in both waves. The attacks abused the internet connection that lets operators monitor and change temperatures remotely. Because many retailers use the same controllers and remote-management approach, one weakness gave attackers a repeatable path into stores in many countries. The targets appear to have been smaller stores, at the last stage of the supply chain rather than warehouse networks.
The EU warned of a deliberate attempt to disrupt the bloc's food supply chain, and France's Prime Minister instructed ANSSI to investigate and coordinate with other European countries. Some reporting notes that the attacks followed freezer failures at U.S. military bases in August that the Pentagon now suspects were hacker-caused.
Recommendations
- Remove direct internet exposure from refrigeration and building controllers; require VPN or a managed gateway.
- Change default credentials and enforce MFA on remote-management portals.
- Set hard temperature limits and alarms independent of the networked controller.
- Ask vendors for advisories, patches and an inventory of affected firmware.
- Plan for food-safety incidents with manual monitoring and rapid stock-isolation procedures.