Supermarket Fridge Cyberattack Disrupts Refrigeration Systems Across Europe
A supermarket fridge cyberattack has disrupted refrigeration systems at grocery stores and food retailers across several European countries, raising concerns about the security of internet-connected equipment used in everyday business operations. During incidents reported on November 2, 2026, some refrigeration and freezer systems experienced abnormal temperature changes after unauthorized interference with their controls.
Several retailers reported that cooling systems had stopped working correctly, while some stores said temperatures had risen dramatically. In certain cases, chilled and frozen products had to be removed or discarded because their safety could no longer be assured. The incidents have drawn attention to a part of cybersecurity that consumers rarely consider: the technology controlling physical equipment such as refrigerators, freezers, heating systems and industrial machinery.
Although reports describe incidents in multiple countries, the full scope and relationship between them remain under investigation. No attacker or group has publicly established responsibility for the November incidents.
Which European Countries Reported Refrigeration Disruptions?
Reports published on November 2 described refrigeration problems or suspected cyber incidents in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden. The level of confirmation differed between countries and retailers. Some businesses explicitly described a cyber incident, while others said they were investigating unusual temperature changes or had not ruled out network interference.
- Belgium: Carrefour, Delhaize, Colruyt-related Spar outlets and Intermarché stores reported refrigeration problems. Carrefour said around 15 of its Belgian stores were affected. Ahold Delhaize also reported an IT incident affecting refrigeration systems in several dozen stores.
- Sweden: ICA and Coop reported problems at a limited number of locations. Coop confirmed unauthorized interference with cooling systems at seven stores, according to reports.
- Ireland: Musgrave said refrigeration systems at 13 SuperValu stores were affected. Chilled and frozen products were removed as a precaution while the incident was addressed.
- Estonia: A supermarket refrigeration control computer was reportedly accessed and its temperature settings changed. The incident was stopped quickly, limiting the reported impact.
- Luxembourg: Refrigeration problems were reported at several Delhaize locations.
- Finland: Some grocery stores reported abnormal refrigeration temperatures. Retailers were investigating whether network interference was involved.
- The Netherlands: Refrigeration problems were reported at smaller food businesses and shops, although the circumstances were not identical across all affected locations.
These reports should not be interpreted as proof that every affected store was compromised through the same method or by the same attacker. Some incidents were confirmed as cyber-related, while others remained under investigation when the reports were published.
How Were Supermarket Refrigerators and Freezers Manipulated?
Modern commercial refrigeration equipment is often connected to digital controllers that monitor temperatures, manage cooling cycles and allow technicians to maintain equipment remotely. A central management interface can help a retailer or refrigeration service provider monitor several units without visiting every store.
However, remote control creates a security risk when the management system is exposed to the internet without adequate protection. If an unauthorized person gains access to a controller or its management software, they may be able to change operating settings instead of physically interfering with the refrigerator.
Reports about the European incidents described temperature settings being changed, refrigeration units being disrupted and defrost functions being activated. In some locations, temperatures reportedly rose to around 50 degrees Celsius. Such conditions can make refrigerated food unsafe and force retailers to remove products from sale.
The exact initial access method behind the November incidents has not been publicly established. It would therefore be inaccurate to claim that all stores were compromised through one particular vulnerability, password or software flaw.
Why Are Internet-Connected Refrigeration Systems a Cybersecurity Risk?
Refrigeration controllers are examples of Operational Technology (OT). OT refers to hardware and software that monitor or control physical processes. It is used in manufacturing, energy, transportation, building management and commercial refrigeration.
Unlike a conventional website or office application, an OT system can directly affect the physical environment. A change to a cooling setting can affect food storage, equipment operation and business continuity. This means a cybersecurity incident involving an industrial controller can create consequences beyond stolen information or an unavailable website.
1. Remote management can create an entry point
Technicians may need remote access to diagnose faults, adjust settings or maintain equipment. If remote management interfaces are exposed directly to public networks, attackers may be able to discover and target them. Danfoss advises customers to protect network devices with firewalls and secure remote-access methods rather than exposing controllers directly to the internet.
2. Older equipment may lack security updates
Commercial refrigeration systems can remain in service for many years. Some older controllers may have reached the end of their support period or may not Receive the same security updates as newer products. France's national cybersecurity agency, CERT-FR, published an alert in October 2026 about compromises involving remote refrigeration controllers from several product families, including Danfoss AK-SC and AK-SM, Copeland XWEB and Dixell XWEB.
3. Weak or default credentials increase exposure
Devices that retain factory-default, shared or easily guessed passwords can be easier to compromise. A strong password policy is important, but it should not be treated as the only protection. Network restrictions, secure remote access, monitoring and timely updates are also necessary.
4. Poor network separation can increase the impact
If refrigeration controllers share a network with ordinary business computers, point-of-sale systems or other operational equipment, an incident may have a wider impact. Separating operational systems from business networks can help limit unauthorized movement and reduce the consequences of a compromise.
What Happened in France Before the November Incidents?
The November disruptions followed a similar incident reported in France on October 12, 2026. French retailers experienced refrigeration-system compromises that affected hundreds of supermarkets and other food businesses. Some cooling units were reportedly manipulated, resulting in food losses and operational disruption.
France's CERT-FR subsequently published a security alert describing compromises involving remote refrigeration controllers. Its affected-system list included Danfoss AK-SC and AK-SM series, Copeland XWEB and Dixell XWEB. The agency warned that exposing equipment management interfaces directly to the internet is contrary to security best practices.
The October and November incidents have similarities, but publicly available information has not established that the same people were responsible for both waves or that every affected business was breached through the same weakness. Investigations and technical assessments are needed before drawing that conclusion.
How Can Businesses Protect Industrial Refrigeration Systems?
Retailers, food distributors and businesses using connected refrigeration equipment should treat these systems as important operational assets. Basic cybersecurity controls can reduce the risk of unauthorized access and help limit disruption.
Keep management interfaces off the public internet
Refrigeration controllers should not be directly accessible from the public internet. Where remote maintenance is necessary, organizations should use a secure gateway or VPN with strong authentication and tightly controlled permissions.
Replace default passwords and secure user accounts
Every device and management account should use unique credentials. Default passwords should be changed before equipment is connected to a network. Organizations should remove unused accounts and limit administrative access to authorized personnel.
Apply firmware and software updates
Businesses should identify the exact controller models and software versions in use, check vendor security notices and install supported updates. Equipment that has reached end of life should be assessed for replacement or additional protective controls.
Separate operational technology from office networks
Refrigeration controllers should be placed in appropriately segmented network zones. Access between business IT systems and operational technology should be limited to what is genuinely required. Firewalls and access-control rules can help restrict unnecessary communication.
Monitor systems and prepare a recovery plan
Organizations should monitor unusual login attempts, unexpected configuration changes and abnormal temperature readings. They should also maintain tested backups, incident-response procedures and a safe manual operating process where the equipment supports it.
These recommendations are consistent with guidance from CISA, NIST and Danfoss on securing operational technology and remote access.
Could This Type of Cyberattack Affect Other Connected Devices?
Yes. The underlying security issue is not limited to supermarket refrigerators. Many organizations rely on connected systems that control physical equipment, including building automation, heating and ventilation, access control, industrial machinery and energy-management systems.
These technologies are useful because they allow remote monitoring and automation. However, internet connectivity can increase the attack surface if devices are poorly configured, outdated or protected by weak access controls. A compromised controller may affect physical operations even when the organization's main website and office computers remain available.
The supermarket incidents demonstrate why organizations should include operational equipment in their cybersecurity inventories rather than focusing only on laptops, servers and cloud applications.
What the European Supermarket Attacks Reveal About OT Security
The European refrigeration incidents show that cybersecurity risks can extend into ordinary business infrastructure. A refrigerator may appear to be a simple appliance, but commercial systems can depend on networked controllers, remote maintenance software and centralized monitoring platforms.
For retailers, the consequences can include spoiled products, lost revenue, store disruption and additional recovery costs. For customers, the incidents underline the importance of safe food handling and reliable supply chains.
The key lesson is not that connected refrigeration systems should be abandoned. It is that equipment controlling physical processes must be protected with the same seriousness as other important digital infrastructure. Limiting internet exposure, securing remote access, replacing default credentials, maintaining supported software and separating operational networks are practical steps that can reduce risk.
Frequently Asked Questions
What happened in the European supermarket fridge cyberattack?
On November 2, 2026, supermarkets and food businesses in several European countries reported refrigeration disruptions. Some retailers confirmed cyber incidents involving unauthorized interference with cooling systems, while other cases remained under investigation.
Which countries reported supermarket refrigeration problems?
Reports described incidents or suspected interference in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden. The level of confirmation varied by country and retailer, and the reported scope may change as investigations continue.
How can hackers affect supermarket refrigerators remotely?
Commercial refrigeration systems can use network-connected controllers for monitoring and remote maintenance. If an attacker gains unauthorized access to a controller or its management interface, they may be able to change settings or disrupt operations. The exact access method in the November incidents has not been publicly confirmed.
Were Danfoss refrigeration controllers involved?
France's CERT-FR identified Danfoss AK-SC and AK-SM controller families among the systems involved in compromises reported in October 2026. That alert also listed Copeland XWEB and Dixell XWEB. This does not establish that every November incident involved the same controller models.
How can businesses secure connected refrigeration equipment?
Businesses should avoid exposing controller interfaces directly to the internet, use secure remote access such as VPNs, replace default passwords, apply supported updates, segment operational networks and monitor for unusual activity.
Sources and Further Reading
- CERT-FR: Security incident targeting remote refrigeration installation controllers
- Danfoss: Cybersecurity best practices for electronic controllers
- CISA: Primary mitigations to reduce cyber threats to operational technology
- NIST: Guide to Operational Technology Security
- Reuters: Investigators hunt French supermarket fridge hackers
- Reuters: Cyberattack on fridges hits supermarkets across Europe, November 2, 2026
- AFP: Fridge cyberattack hits supermarkets across Europe
