A supermarket freezer might seem like an unlikely target for hackers. However, recent cyberattacks across Europe have demonstrated how criminals can manipulate internet-connected refrigeration systems and turn ordinary cooling equipment into a source of serious physical and financial damage.
In October 2026, attackers remotely manipulated refrigeration controllers at approximately 700 sites in France. Instead of maintaining safe cooling temperatures, affected equipment was switched to high-temperature defrost settings. Food was spoiled, businesses suffered losses, and French authorities later reported that at least 15 fires had occurred during the incident.
A second wave of attacks affected more than 100 establishments across Europe in early November. The incidents prompted warnings from US cybersecurity and infrastructure agencies about the risks facing commercial refrigeration and cold-storage systems.
Artificial intelligence has added another dimension to this threat. Security researchers demonstrated that an AI coding assistant could help reproduce previously disclosed vulnerabilities in a refrigeration controller in approximately 28 minutes for around $6 in AI usage. This was a controlled research experiment, not proof that AI was used to carry out the supermarket attacks.
Here is how supermarket freezer cyberattacks work, why industrial refrigeration systems are vulnerable, how AI can lower the barrier to vulnerability research, and what businesses should do to protect their cooling infrastructure.
What Happened in the Supermarket Freezer Cyberattacks?
The first major wave occurred overnight between October 11 and 12, 2026, when attackers compromised refrigeration controllers at approximately 700 commercial sites in France. According to French authorities, the attackers changed the defrost settings of refrigeration equipment to unusually high temperatures.
Instead of keeping chilled and frozen products at safe temperatures, affected systems heated them. Supermarkets and food businesses were forced to discard spoiled stock. French authorities later reported at least 15 fires associated with the incident, while Intermarché estimated losses of tens of millions of euros in a single day.
The affected sites included major supermarket operators as well as smaller food businesses, butcher shops, slaughterhouses, and food-processing facilities.
A second wave was reported overnight between November 1 and 2. Businesses in countries including Belgium, the Netherlands, Sweden, Ireland, Luxembourg, Estonia, and Finland reported refrigeration problems associated with cyberattacks. Reuters reported that more than 100 establishments across Europe were affected.
On November 5, the FBI, CISA, and US departments responsible for health, agriculture, and transportation issued a joint warning about ongoing cyber threats to industrial refrigeration and cold-chain monitoring systems.
The warning made clear that the risk extends beyond supermarkets. Organisations using commercial refrigeration for food storage, healthcare, agriculture, transportation, and other critical services also need to assess their exposure.
How Can Hackers Control Supermarket Refrigeration Systems?
Commercial refrigeration systems are more sophisticated than ordinary household refrigerators. A large supermarket may use multiple cooling units connected to central controllers that monitor temperatures, manage defrost cycles, and coordinate equipment operation.
These controllers are part of a category of technology known as Operational Technology (OT). OT refers to hardware and software that monitor or control physical equipment and industrial processes.
To make maintenance easier, refrigeration controllers may offer remote-management interfaces. Technicians can use these interfaces to monitor equipment, investigate faults, and change settings without travelling to the store.
Remote access becomes a security risk when management interfaces are exposed directly to the public internet, protected by weak or default passwords, or running outdated software.
If an attacker gains unauthorized access to a controller, they may be able to misuse legitimate management functions. In the reported supermarket incidents, refrigeration settings were changed so that cooling equipment entered high-temperature defrost modes.
Why internet exposure matters
Internet-connected controllers can become visible to anyone scanning public network infrastructure. Security researchers use tools such as Censys and Shodan to identify exposed devices, and attackers can use similar discovery methods to find potential targets.
An exposed device is not Automatically vulnerable or compromised. However, an internet-facing management interface gives attackers a possible route to investigate authentication weaknesses, outdated firmware, and insecure configurations.
Claroty's research identified refrigeration controllers and related management systems with security weaknesses. Its October 2026 analysis also noted that the precise access path used in the original French supermarket attacks had not been confirmed at that time.
Why Are Commercial Refrigeration Controllers Vulnerable?
Several security weaknesses can increase the risk of an industrial refrigeration system being compromised.
1. Default or weak passwords
Some controllers may retain manufacturer-provided credentials or use passwords that are easy to guess. If remote management is accessible from the internet, weak authentication can make unauthorized access easier.
Following the second wave of attacks, Claroty reported that a Danfoss spokesperson had told Dutch media that some affected refrigeration systems were not on secure networks and were protected with a default password.
2. Outdated firmware
Industrial controllers can remain in service for years. If software updates are delayed, known vulnerabilities may remain available to attackers. This can be particularly challenging when equipment is installed and maintained by external contractors.
Claroty previously disclosed vulnerabilities affecting Danfoss AK-SM 800A refrigeration controllers and said the vendor had provided updated firmware addressing the reported issues in August 2025.
3. Insecure remote access
Remote maintenance can improve operational efficiency, but management interfaces should not be exposed without appropriate protection. Businesses need to know which devices are remotely accessible and who is authorized to manage them.
4. Poor network segmentation
If refrigeration controllers share a network with ordinary office computers, servers, or other business systems, a compromise may create opportunities for attackers to move between environments.
Network segmentation helps limit this risk by separating operational equipment from corporate networks and restricting communication to approved systems.
5. Limited visibility into connected equipment
Businesses may not have a complete inventory of their connected refrigeration controllers, especially when installation and maintenance are outsourced. A device can remain internet-accessible even when the organisation responsible for the store is unaware of its exposure.
How Is AI Making Refrigeration System Vulnerabilities Easier to Research?
One of the most interesting developments in this story is the role of AI-assisted vulnerability research.
On October 13, 2026, Claroty's Team82 published an experiment examining how quickly an AI coding assistant could reproduce previously disclosed vulnerabilities in a Danfoss AK-SM 800A refrigeration controller.
The researchers used Anthropic's Claude Sonnet 4.6 through the Cursor AI coding editor. Starting with publicly available vulnerability information, firmware, and analysis tools, they reproduced known vulnerabilities and combined two of them to demonstrate root-level command execution on a laboratory device.
Claroty reported that the experiment took approximately 28 minutes and used around $6 in AI services.
However, there are important limitations to this finding:
- The researchers started with publicly disclosed vulnerabilities rather than discovering an entirely unknown flaw from scratch.
- The experiment used publicly available firmware and analysis tools.
- The AI agent initially failed to correctly reproduce one of the vulnerabilities.
- Human researchers provided additional guidance and validation.
- The demonstration took place in a controlled laboratory environment.
Most importantly, Claroty said the precise attack path used in the October French supermarket incident remained unconfirmed. The experiment does not prove that attackers used Claude, Cursor, or the demonstrated exploit during the real-world attacks.
The broader security concern is that AI coding tools can reduce the time and technical effort needed to investigate known vulnerabilities. This may make it easier for both legitimate security researchers and malicious actors to reproduce weaknesses in exposed industrial devices.
France's Attribution: Who Was Behind the October Attack?
On November 9, French authorities publicly attributed the October 11–12 refrigeration attacks to Shahid Kaveh, a cyber-offensive unit affiliated with Iran's Islamic Revolutionary Guard Corps Electronic and Cyber Center.
France's Cyber Crisis Coordination Center said its assessment was based on several indicators, including infrastructure associated with other reconnaissance activity, the use of scanning tools, similarities with previously observed operations, and traces of the Persian language in the attack infrastructure.
French authorities reported that approximately 700 commercial sites had been targeted and that at least 15 fires occurred. The investigation also covered victims beyond supermarkets, including businesses in the food-processing sector.
This is the French government's official attribution and should be described as such. It is not appropriate to present the attribution as an independently established conclusion accepted by every government or investigator.
Reuters reported that Iran's mission to the United Nations had not immediately responded to Requests for comment. The incident remains part of a wider investigation into attacks against industrial infrastructure.
Why the Threat Extends Beyond Supermarkets
Refrigeration is essential to many services that people rarely associate with cybersecurity. A failure in a connected cooling system can affect food safety, medicine storage, transportation, and industrial operations.
Consider some examples:
- Food retailers: Supermarkets, grocery stores, and butcher shops depend on refrigeration to preserve fresh and frozen products.
- Cold-storage warehouses: Distribution facilities use temperature-controlled environments to protect large quantities of food and other goods.
- Healthcare facilities: Some medicines, vaccines, blood products, and laboratory materials require carefully controlled storage temperatures.
- Food processing: Industrial refrigeration supports production, processing, and storage operations.
- Transportation: Refrigerated logistics systems help maintain temperature conditions during the movement of sensitive goods.
A cyberattack against a controller does not automatically mean every connected facility is at risk. The actual impact depends on the equipment, its network configuration, the attacker's access, and the safety mechanisms in place.
Could Similar Cyberattacks Affect Businesses in India?
The reported attacks took place in Europe, and the Australian Cyber Security Centre said on October 14 that it had not observed active targeting in Australia at that time. These statements should not be interpreted as evidence that Indian businesses have been attacked in the same campaign.
However, the underlying security weaknesses are not limited to one country. Internet-connected refrigeration controllers, remote-maintenance interfaces, outdated firmware, and weak access controls can create risks wherever commercial cooling infrastructure is deployed.
India's food supply chain, pharmaceutical storage facilities, logistics providers, supermarkets, and cold-chain operators all depend on reliable temperature-controlled equipment. Organisations in these sectors should review their connected operational technology as part of their broader cybersecurity programme.
The practical lesson is simple: refrigeration equipment should be treated as part of the organisation's technology and security environment, not merely as ordinary machinery.
How Businesses Can Protect Supermarket Refrigeration Systems
Security agencies and industrial cybersecurity researchers have recommended several measures to reduce the risk of attacks against refrigeration controllers and other operational technology.
1. Remove direct public internet exposure
Do not expose refrigeration controllers or their management interfaces directly to the public internet. Use a properly secured remote-access solution, such as a VPN or an industrial remote-access gateway, with strict authentication and access restrictions.
2. Change default passwords
Replace manufacturer-provided or default passwords before equipment is placed into service. Use unique credentials for each device or system where supported, and store them securely.
3. Install firmware and security updates
Maintain an inventory of refrigeration controllers and check for vendor security advisories. Apply firmware updates and security patches promptly after assessing compatibility and operational requirements.
4. Separate OT and corporate networks
Place refrigeration systems on dedicated network segments. Restrict communication between operational equipment and ordinary office networks, and allow only the connections required for monitoring and maintenance.
5. Use strong authentication and access controls
Give technicians and contractors only the permissions required for their responsibilities. Use multi-factor authentication for remote access wherever supported, and remove accounts that are no longer needed.
6. Monitor unusual system activity
Monitor temperature changes, defrost schedules, controller logins, configuration updates, and remote-management activity. Unexpected changes outside normal maintenance windows should trigger investigation.
7. Maintain manual safety and recovery procedures
Businesses should have documented procedures for responding to unusual temperature changes, controller failures, and suspected cyber incidents. Staff should know how to isolate affected systems safely, preserve food or medical inventory, and contact equipment specialists.
Cybersecurity controls should never be changed in a way that compromises refrigeration safety or essential operations. Incident-response plans should be developed with qualified OT engineers and equipment providers.
8. Review third-party maintenance access
Ask refrigeration installers and maintenance contractors how they access equipment remotely, what credentials they use, and how those credentials are protected. Remove unnecessary remote access and ensure maintenance activity is logged and approved.
Official Security Warnings and Guidance
Several government and cybersecurity organisations have issued guidance following the recent refrigeration attacks.
- United States: The FBI, CISA, and other federal departments issued a joint warning on November 5, 2026, urging organisations to remove industrial refrigeration controllers from direct public internet exposure, isolate them from corporate networks, and apply software updates.
- Australia: The Australian Signals Directorate's Australian Cyber Security Centre published a high-priority alert on October 14, 2026. It advised organisations operating refrigeration and cooling technology to review exposure, patch vulnerabilities, use strong authentication, segment networks, and monitor unusual activity.
- France: French cybersecurity authorities published an official attribution report on November 9, 2026, describing the October attack and the evidence behind their assessment.
These warnings demonstrate that industrial refrigeration security is now a wider operational-technology concern, not simply a problem for supermarket IT departments.
Frequently Asked Questions
Can hackers really control supermarket refrigerators?
Yes. Commercial refrigeration systems use connected controllers to manage temperatures and defrost cycles. If attackers gain unauthorized access to these controllers, they may be able to manipulate settings and disrupt cooling operations.
How many supermarkets were affected by the French freezer cyberattack?
French authorities reported that approximately 700 commercial sites were targeted during the October 11–12, 2026 attack. The affected sites included supermarkets and other food-sector businesses.
Did hackers use AI to attack supermarket freezers?
There is no confirmed public evidence that AI was used to carry out the real-world supermarket attacks. Claroty demonstrated that an AI coding assistant could reproduce previously disclosed refrigeration-controller vulnerabilities in a controlled laboratory experiment.
How did AI reproduce refrigeration controller vulnerabilities so quickly?
Claroty used Claude Sonnet 4.6 through Cursor with publicly available vulnerability information, firmware, and analysis tools. The experiment took approximately 28 minutes and cost around $6 in AI usage, with human researchers providing important guidance and validation.
What is operational technology security?
Operational Technology security focuses on protecting hardware and software that monitor or control physical equipment and industrial processes. Examples include refrigeration controllers, manufacturing systems, building controls, and industrial automation equipment.
Why are internet-connected refrigeration systems vulnerable?
Potential weaknesses include exposed management interfaces, default passwords, outdated firmware, insecure remote access, and poor network segmentation. These weaknesses can give attackers opportunities to access or manipulate connected equipment.
Can a supermarket prevent a refrigeration cyberattack?
No single measure guarantees protection. Businesses can reduce risk by removing direct internet exposure, changing default passwords, applying updates, segmenting networks, restricting remote access, and monitoring unusual controller activity.
Are Indian supermarkets affected by these attacks?
The reported campaign described in this article affected sites in Europe. There is no confirmed evidence in the cited reporting that Indian supermarkets were affected by the same attacks. However, Indian businesses using connected refrigeration systems should review their security controls.
Official Sources and Further Reading
- CISA: US Government Partners Urge Hardening Industrial Refrigeration and Cold-Chain Monitoring Systems joint US government warning and recommended security measures, November 5, 2026.
- Australian Cyber Security Centre: Protecting Operational Technology and Edge Devices high-priority guidance covering refrigeration, cooling technology, network segmentation, and edge-device security.
- Claroty Team82: European Supermarket Hacks Expose Risks of Internet-Facing Refrigeration Systems incident analysis, exposed controllers, vulnerabilities, and remediation recommendations.
- Claroty Team82: Firmware to Root in 30 Minutes the controlled AI-assisted vulnerability reproduction experiment.
- Palo Alto Networks Unit 42: Turning Up the Heat – Inside the Attacks on Europe's Refrigeration Systems technical analysis of the attack waves and exposed refrigeration devices.
- France's Cyber Crisis Coordination Center: November 9, 2026 Attribution Report official French assessment of the October refrigeration-controller attacks.
- Reuters: US Warns of Ongoing Cyber Threat to Industrial Refrigeration Systems reporting on the US government warning and incidents affecting commercial refrigeration.
Final Thoughts
The supermarket freezer attacks show how a cybersecurity weakness can move beyond computers and affect physical equipment, food supplies, and business operations. Internet-connected refrigeration controllers are essential for modern stores and cold-chain facilities, but they must be protected with the same care as other critical technology.
AI-assisted research adds another reason for businesses to take known vulnerabilities seriously. Tools that help researchers reproduce security flaws more quickly may also reduce the effort required by malicious actors. However, the laboratory demonstration described by Claroty should not be confused with proof that AI was used in the actual supermarket attacks.
For businesses operating refrigeration and cold-storage infrastructure, the priorities are clear: remove unnecessary internet exposure, replace default credentials, keep firmware updated, restrict remote access, segment operational networks, and monitor unexpected changes. Protecting connected equipment is now an essential part of protecting the physical services that people depend on every day.
