Europe's supermarket freezer cyberattack: why it happened and what to do

By Sridhar Thewar, Founder & CEO · 7 min read · Published
Short version: Since October 2026, attackers have remotely forced supermarket freezers in France and across Europe to heat up, some reportedly to 50°C, spoiling food in hundreds of stores. No ransom was demanded and nobody has claimed it. The weak point was old refrigeration controllers left reachable from the internet, in some cases with default passwords. If your business depends on cold storage, check today whether your controllers can be reached from the internet.

A freezer may not look like a cybersecurity problem. This one shows what happens when equipment nobody thinks of as a computer is left on the internet. This post reflects what was published up to 6 November 2026, and the investigations are still open.

What happened

First wave, France. On the night of Sunday 11 October, refrigeration controllers in French supermarkets were remotely put into defrost mode. SecurityWeek puts the total at about 700 stores. Stores lost stock overnight, and losses across Europe have been reported in the tens of millions.

Second wave, Europe. Overnight from 1 to 2 November, it happened again. SecurityWeek counts more than 100 stores. Companies reported these figures themselves, so the true total is unknown:

CountryReported impact
BelgiumDelhaize, several dozen stores with Luxembourg; Carrefour, 15 of more than 700; five Spar shops; one IKEA
IrelandSuperValu pulled chilled and frozen products from 13 stores
NetherlandsAt least 17 businesses, mainly butchers and small grocers, according to Danfoss
SwedenICA, a limited number of stores; Coop, a handful
ElsewhereSeven Intermarché stores in Portugal, a few smaller stores in Finland, stores in Sicily, and one in Estonia

It may not be limited to supermarkets. The Pentagon is investigating freezer failures at US military sites in August as suspected hacks, and a French blood bank was targeted, with the attack stopped before blood stocks were harmed. On 5 November, CISA, the FBI and three other US departments warned of attacks on refrigeration and cold-chain monitoring systems worldwide. CISA's Chris Butera said: "Every organization that depends on refrigeration and monitoring systems should assume it could be a target."

How can a hacker heat a freezer?

Commercial freezers have heaters built in, to melt ice off the cooling coils during a defrost cycle. A small controller runs that cycle, and many controllers can be managed remotely through a web page. Reporting says the attackers forced that defrost mode on and kept it there, so a normal feature did the damage. Heat spoils food quickly, and CISA also warns of fire hazards and shorter equipment life.

Why this happened

The full entry route has not been published. But officials and the vendors have said enough to show the main causes:

The technique was not sophisticated. The NCSC's Paul Chichester said "this wasn't an AI attack", and that it used long-standing weaknesses.

What is still unknown

Could this happen in India?

We have not seen a public report of this campaign hitting India as of 6 November 2026. But the weakness has nothing to do with Europe. Any remotely managed cooling system left on the internet with a default password has the same problem, and that includes pharma and vaccine storage, dairy and frozen food, seafood exports, quick-commerce dark stores and data-centre cooling.

For a pharma or food business, the loss may not end with spoiled stock, because a temperature excursion can also mean a batch you can no longer release or sell. And the same thinking applies well beyond freezers, to CCTV, access control, UPS units and building management systems.

What you can do

This week

  1. List every connected cooling system: controllers, temperature monitors and any contractor gateway or remote access link. Ask your refrigeration contractor, because they may know about connections you do not.
  2. Check them from outside your network. Our guide to finding your internet exposure shows how.
  3. Take them off the public internet. CERT-FR advises checking your insurance terms before you cut a contractor's data feed, so involve them.
  4. Change every default password, and turn on MFA where the equipment supports it.
  5. Review the settings, especially defrost schedules. CERT-FR warns that end-of-life devices left on the internet are very likely compromised.

This quarter

  1. Restore remote access only through a secure route. CERT-FR recommends a VPN or protected network, and treats filtering by contractor IP as a short-term measure. See VPN or ZTNA.
  2. Separate the equipment from your business network with a dedicated VLAN. See network segmentation.
  3. Replace end-of-life controllers. CERT-FR warns that resetting them does not stop a repeat attack. Where replacement takes time, keep them offline.
  4. Update firmware on supported models. One Belgian contractor says some sites also need physical changes, so ask yours.
  5. Set safe limits and alerts. CISA advises reasonable setpoint limits, alerts on any change, logging, and tested offline backups of the configuration.
  6. Add an independent temperature alarm. It should work even if the controller is compromised, because CISA warns attackers can also take away your view of the real temperature. Give a named person responsibility for responding at night.

If you think you have been hit

Disconnect the device from the internet, protect the stock, and move it if you can. Keep records of what changed, and call your refrigeration contractor. CERT-FR's guidance for Danfoss units is to restart or factory-reset the device, then reconfigure it before it goes back into service. Do not reconnect it the same way. Under CERT-In's 2022 directions, reportable incidents must be reported within six hours, and attacks on IoT systems are on that list, so check your obligations straight away. Our incident response plan guide can help you prepare.

Questions to ask your refrigeration contractor

The bigger lesson

Hackers did not need anything clever here. They found equipment that had quietly become a computer on the internet, and nobody was looking after it. The fix is mostly unglamorous: know what you own, keep it off the internet, and change the passwords. Our posts on isolating IoT devices and network documentation are good next steps.

Sources

Frequently asked questions

What happened in the European supermarket freezer attacks?

Attackers remotely took over internet-connected refrigeration controllers and forced fridges and freezers into heating and defrost cycles. Hundreds of French supermarkets were hit in October 2026, and more than 100 stores across Europe were reported hit in a second wave on the night of 1 to 2 November.

Who was behind the freezer attacks?

Nobody knows publicly. No group has claimed the attacks and no government has formally named a culprit. It is also not established that the same people carried out both waves.

Was it ransomware?

It does not look like it. No ransom has been demanded. The reported effect is sabotage: settings were changed, and food was spoiled.

Has this happened in India?

We have not seen a public report of this campaign hitting India as of 6 November 2026. CISA describes the targeting as worldwide, though, and the weakness is not specific to Europe, so Indian businesses with connected cold storage should check their own systems now.

Is unplugging the controller from the internet enough?

It is the most important first step, but not the whole fix. Check your contract and insurance terms first, as a contractor's monitoring feed may be required. Then review the settings, change default passwords, restore remote access only through a secure VPN, and replace equipment that no longer gets updates.

Is your cold storage connected to your network?

We check what your business network exposes to the internet, keep connected equipment separate from it, and set up secure remote access for your contractors. We work on the IT network. The refrigeration equipment itself stays with your contractor or vendor.

Book a free consultation