# European Supermarket Fridge Cyberattacks Expose Operational Technology Risks

**Published on:** 2026-11-05T00:00:00.000Z

**Author:** null

Cyberattacks targeting commercial refrigeration systems have disrupted supermarkets across Europe, raising concerns about the security of internet-connected industrial equipment. In incidents reported in October and November 2026, attackers manipulated refrigeration controls, causing temperatures in some refrigerators and freezers to rise sharply. Retailers were forced to remove food from sale, dispose of potentially spoiled products, and investigate the security of systems used to maintain safe storage temperatures.

The incidents show how a cyberattack can cause physical and financial damage without stealing customer data, deploying ransomware, or shutting down an organization's traditional IT network. Commercial refrigeration systems, building management platforms, and industrial controllers are increasingly connected to remote monitoring services so technicians can manage equipment across multiple locations.

When these systems are exposed to the internet without adequate safeguards, attackers may be able to manipulate physical processes remotely. [The European Union Agency for Cybersecurity](https://www.enisa.europa.eu/) (ENISA) confirmed on November 4th that commercial refrigeration systems and similar devices had been affected by cybersecurity incidents in several EU member states since October 11. Authorities are investigating the incidents and coordinating their response.

## Supermarket Refrigeration Systems Targeted Across Europe

A new wave of suspected cyberattacks was reported on November 2nd, [affecting supermarkets and other businesses in several European countries](https://www.reuters.com/business/retail-consumer/temperature-soars-swedish-grocery-store-freezers-one-store-blames-hackers-2026-11-02/). In Belgium, affected organizations included Carrefour, Delhaize, Colruyt-operated Spar locations, and an IKEA store. Swedish supermarket chains ICA and Coop also reported refrigeration problems, while Ireland's Musgrave Group confirmed that 13 SuperValu stores had been affected.

Other reports identified incidents in countries including Estonia, Finland, Luxembourg, and the Netherlands. The precise number of affected locations varied as investigations continued.

The impact was immediate because refrigeration equipment is essential to preserving perishable food. At an ICA franchise store in Stockholm, freezers reportedly reached 50 degrees Celsius, forcing staff to discard frozen products. In Belgium, a butcher estimated that approximately €15,000 worth of meat was ruined after refrigeration temperatures rose. Carrefour reported that 15 of its 700 Belgian stores were affected, while Coop said seven of its approximately 800 Swedish stores experienced an incident involving its refrigeration systems. These figures illustrate how a relatively small number of affected sites can still generate substantial losses when critical equipment is manipulated.

The November incidents followed a similar attack in France on October 12, when refrigeration systems at hundreds of supermarkets were reportedly compromised. That incident caused food losses and, according to subsequent reporting, other physical disruptions. The recurrence of attacks has increased concern among European authorities about the security of connected industrial equipment used throughout the food supply chain. However, investigators have not established that every incident was carried out by the same attacker or group. No perpetrator had publicly claimed responsibility for the November attacks as of the latest reports reviewed.

The incidents also demonstrate the difference between a cyberattack's technical scope and its operational consequences. A compromised controller may affect only one store or a small group of refrigeration units, yet the consequences can include spoiled inventory, emergency maintenance, lost sales, [disrupted supply chains](https://www.packetlabs.net/posts/digital-supply-chain/), and potential food safety concerns. Retailers must respond to the digital intrusion while simultaneously determining whether products remain safe to sell and whether refrigeration can be restored reliably.

## How Hackers Can Manipulate Commercial Refrigeration Equipment

Commercial refrigeration systems often combine physical equipment with digital controllers and remote management software. Sensors measure temperatures and other operating conditions, while controllers regulate compressors, fans, valves, and defrost cycles. Remote monitoring systems allow maintenance providers or store operators to view equipment status, adjust settings, investigate faults, and manage refrigeration across multiple locations.

These capabilities improve operational efficiency, but they also create cybersecurity risks. If a controller or management interface is reachable over the public internet and lacks adequate access controls, an attacker may be able to interact with it without entering the store or compromising a conventional office computer. Researchers cited by Reuters identified internet exposure, unchanged manufacturer-default passwords, and outdated software as common weaknesses in industrial systems. Authorities have not publicly confirmed the precise entry point for every affected refrigeration incident, so these weaknesses should be understood as documented risks and potential attack paths rather than a verified explanation for every breach.

One reported mechanism involved changing refrigeration units' operating settings so that equipment entered or remained in defrost mode. Defrost cycles are a normal part of refrigeration maintenance: they help remove accumulated ice from evaporator coils and allow equipment to operate efficiently. If the cycle is triggered improperly or continues beyond its intended duration, however, temperatures inside refrigerated cases can rise and compromise stored products. An attacker who can modify controller settings may therefore cause disruption by abusing legitimate equipment functions rather than installing malware or exploiting a sophisticated software flaw.

The broader lesson is that connected equipment must be treated as part of the organization's [attack surface](https://www.packetlabs.net/services/attack-surface-penetration-testing/). Refrigeration controllers, heating systems, security cameras, building automation platforms, and industrial sensors can all influence physical operations. Their cybersecurity requirements should reflect the potential consequences of unauthorized control, not just the sensitivity of the data they process.

## Why Internet-Exposed Industrial Systems Are Vulnerable

Many organizations deploy connected equipment to reduce maintenance costs and make operations easier to manage across multiple locations. Refrigeration contractors may monitor hundreds of installations remotely, allowing technicians to identify faults and adjust settings without visiting each site. However, organizations may not always know which devices are accessible from the internet, who manages their configurations, or whether the equipment is still receiving security updates.

A common risk is direct exposure of administrative interfaces. If a controller can be accessed from the public internet, attackers can discover it through scanning and attempt to exploit weak authentication, default credentials, or known vulnerabilities. The device does not need to contain a high-value database to be an attractive target. Its ability to control a physical process may be sufficient to cause operational disruption.

Outdated software compounds the problem. Industrial equipment can remain in service for years, sometimes beyond the period during which its manufacturer provides security updates. Replacing a controller may require capital expenditure, equipment downtime, testing, and coordination with maintenance providers. These constraints can delay upgrades, particularly when the equipment appears to be functioning normally. However, leaving unsupported devices exposed creates a long-term security risk because newly discovered weaknesses may never be corrected through a software patch.

Third-party maintenance arrangements introduce another challenge. A retailer may own the refrigeration equipment but rely on an external contractor to configure and maintain it. The contractor may use remote access software or centralized management systems to service multiple clients. If responsibilities are not clearly defined, both parties may assume the other is managing updates, access controls, monitoring, and security testing.

Effective [OT security](https://www.packetlabs.net/services/ot-cybersecurity-assessment/) requires an accurate inventory of connected assets, clear ownership of each device, and documented procedures for maintaining secure configurations throughout the equipment's lifecycle. Organizations should know which devices are internet-accessible, which software and firmware versions they run, what remote access methods are enabled, and whether the manufacturer still supports them. This information provides the foundation for prioritizing remediation and assessing the potential impact of a compromise.

## The Business Impact Goes Beyond Spoiled Food

The direct financial impact of refrigeration attacks includes spoiled inventory, emergency repairs, equipment inspections, and interrupted store operations. Retailers may also incur costs associated with incident investigation, regulatory reporting, legal advice, and communication with suppliers or customers. Even when a business restores refrigeration quickly, it must establish that the equipment is operating safely before returning products to sale.

Food safety adds complexity to incident response. If temperature monitoring is disrupted or refrigeration settings are altered, businesses need to determine how long products were exposed to unsafe conditions and whether recorded measurements can be trusted. Decisions about whether to retain or discard inventory must follow applicable food safety requirements and established procedures. A successful cyberattack can therefore create a physical safety issue even when the attacker never enters the premises.

There may also be contractual and insurance implications. Retailers need to review whether their policies cover inventory spoilage caused by a cyber incident, equipment manipulation, or unauthorized access to connected control systems. Coverage depends on the wording of individual policies and the circumstances of the loss, so organizations should not assume that conventional property insurance or cyber insurance will automatically cover every expense.

The incidents also raise questions about operational resilience. If remote monitoring becomes unavailable, can store employees still check temperatures and control equipment safely? If a contractor's remote access platform is compromised, can access be disabled without preventing essential maintenance? If a controller must be isolated from the network, does the organization have a tested process for managing the equipment locally? These questions should be addressed before an incident occurs, when there is time to evaluate alternatives without putting inventory or customers at risk.

## How Organizations Can Secure Refrigeration and Other OT Systems

### 1\. Remove Unnecessary Internet Exposure

Organizations should identify all internet-facing industrial controllers, remote management interfaces, and connected building systems. Administrative interfaces should not be directly exposed to the public internet unless there is a clearly justified requirement and appropriate security protections. Remote access should instead use controlled pathways, such as a properly configured virtual private network or another secure access architecture, with access restricted to authorized users and approved devices.

Network access rules should limit which systems can communicate with controllers and management platforms. Where possible, organizations should place OT devices on segmented networks rather than allowing unrestricted communication with corporate IT systems. Segmentation reduces the opportunity for an attacker who compromises one device or network to reach unrelated systems.

### 2\. Replace Default Credentials and Strengthen Authentication

Default usernames and passwords should be changed during installation, and credentials should be unique to each device or environment where practical. Shared administrator accounts make it difficult to identify who performed a change and increase the consequences of credential exposure. Organizations should use individual accounts, strong authentication, and centralized access controls wherever supported by the equipment.

Remote access permissions should follow the principle of least privilege. A technician who needs to monitor temperatures may not require permission to change defrost schedules or modify controller configurations. Limiting privileges reduces the damage an account can cause if it is compromised. Organizations should also remove accounts when contractors or employees no longer need access and periodically review who can administer critical equipment.

### 3\. Patch Vulnerabilities and Replace Unsupported Equipment

Security teams and equipment operators should maintain an inventory of firmware versions, software dependencies, known vulnerabilities, and manufacturer support status. Updates should be evaluated and deployed according to risk, with particular urgency for weaknesses affecting internet-facing systems or allowing unauthorized control.

Industrial patching requires careful planning because updates can interrupt operations or affect equipment compatibility. Organizations should test changes where possible, coordinate with vendors, and establish maintenance windows that minimize operational disruption. If a device is no longer supported, the organization should assess whether it can be isolated with compensating controls or needs replacement. A factory reset alone does not permanently resolve an underlying vulnerability or eliminate the risk of renewed compromise.

### 4\. Monitor Commands and Configuration Changes

Monitoring should cover more than traditional malware alerts. Organizations should log remote logins, failed authentication attempts, configuration changes, administrative actions, and unusual commands sent to industrial controllers. Alerts should identify changes that fall outside normal operating patterns, such as unexpected temperature setpoints, abnormal defrost activity, or configuration changes made outside approved maintenance windows.

Where feasible, security monitoring should correlate controller activity with maintenance schedules and authorized technician sessions. This helps teams distinguish legitimate servicing from unauthorized changes. Logs should be retained long enough to support investigations, and monitoring systems should themselves be protected against tampering or unauthorized access.

### 5\. Test the Security of the Entire Environment

Vulnerability scanning and penetration testing can help identify exposed services, weak configurations, insecure authentication, and pathways between IT and OT environments. Testing should be designed for the equipment and operational constraints involved. Active testing against live industrial controllers can affect physical processes, so assessments must be authorized, carefully scoped, and coordinated with operations personnel. In some cases, passive monitoring, configuration reviews, lab testing, or controlled simulations are safer ways to evaluate risk.

A comprehensive assessment should examine the remote access architecture, network segmentation, management interfaces, user permissions, and the security of supporting systems. It should also determine whether an attacker who gains access to one device could alter settings on other equipment or reach systems used to manage multiple sites. Findings should be prioritized according to their potential operational impact, assigned to responsible owners, and retested after remediation.

### 6\. Prepare for Physical and Digital Incident Response

Incident response plans should account for attacks that alter physical processes rather than simply steal information. Retailers should establish who can disconnect a compromised controller, who can authorize manual operation, and how refrigeration will be monitored while an investigation is underway. Response procedures should coordinate cybersecurity staff, store managers, refrigeration technicians, food safety personnel, and external service providers.

Organizations should also preserve relevant logs and configuration records before making changes that could erase evidence, provided doing so does not delay necessary safety measures. If an attack may have affected food safety, the business should follow appropriate food handling and regulatory procedures rather than relying solely on the restoration of normal temperature readings. Tabletop exercises can help identify gaps in authority, communication, and operational continuity before a real incident forces teams to make decisions under pressure.

## The Role of Secure-by-Design Connected Equipment

The incidents have renewed attention on the responsibility of equipment manufacturers, software vendors, service providers, and operators to secure connected products. Security cannot depend entirely on customers discovering and correcting weaknesses after installation. Products should be designed to minimize unnecessary network exposure, use secure authentication by default, support timely updates, and provide clear information about vulnerabilities and end-of-life dates.

The European Union's Cyber Resilience Act establishes cybersecurity requirements for products with digital elements. ENISA notes that the Act's main cybersecurity requirements are scheduled to apply from December 11, 2027, while reporting obligations for severe incidents and actively exploited vulnerabilities began earlier in 2026. The rules are intended to strengthen product security and lifecycle support, although their application depends on the relevant product and legal requirements.

Manufacturers and service providers should make secure deployment practical. Clear guidance on remote access, configuration hardening, updates, and replacement timelines helps customers maintain equipment safely. Retailers, in turn, must verify that recommended safeguards are implemented and that external service providers follow appropriate access and maintenance procedures.

No single measure can eliminate the risk. Secure product design must be supported by proper deployment, ongoing monitoring, timely remediation, and tested response plans. These responsibilities are shared across the equipment lifecycle.

## Conclusion

The attacks on European supermarket refrigeration systems demonstrate how weaknesses in connected industrial equipment can cause immediate physical and financial consequences. By manipulating refrigeration settings, attackers can disrupt food storage, force businesses to discard inventory, and create operational uncertainty without relying on the methods commonly associated with data breaches or ransomware.

Organizations should treat refrigeration controllers and other connected operational technology as critical assets. Removing unnecessary internet exposure, replacing default credentials, maintaining supported software, monitoring configuration changes, segmenting networks, and testing security controls can reduce the risk of unauthorized access. Equally important, businesses need response plans that preserve safety and operations when a connected system can no longer be trusted.

The central lesson is that cybersecurity extends beyond corporate computers and customer databases. Any connected device capable of changing a physical process can become a target, and the consequences of compromise can reach far beyond the network.

## Frequently Asked Questions

### What happened in the European supermarket fridge cyberattacks?

In October and November 2026, commercial refrigeration systems at supermarkets and other businesses in several European countries were affected by suspected cyberattacks. Some refrigerator and freezer settings were changed, causing temperatures to rise and forcing businesses to remove or discard potentially spoiled food.

### Which countries were affected?

Reports from the November 2 wave identified incidents in several countries, including Belgium, Sweden, Ireland, Estonia, Finland, Luxembourg, and the Netherlands. Further reporting identified incidents in additional European countries. The affected locations and totals varied as investigations continued.

### How can hackers control a supermarket's refrigerators?

Commercial refrigeration systems often use connected controllers and remote management software. If an attacker gains unauthorized access to a controller or its management interface, the attacker may be able to change temperature settings or operating modes. Public reporting has identified internet exposure, weak passwords, and outdated software as potential vulnerabilities, but authorities have not confirmed the precise access method for every incident.

### Why would an attacker target refrigeration equipment?

Possible motives include sabotage, political disruption, or other malicious activity. However, investigators have not publicly identified the perpetrators or established a definitive motive for the European incidents. It would be premature to attribute the attacks to a particular country or group.

### What is operational technology (OT)?

Operational technology refers to hardware and software that monitor or control physical equipment and processes. Examples include refrigeration controllers, industrial sensors, building automation systems, and manufacturing control systems. A compromise can affect physical operations even when no sensitive data is stolen.

### How can businesses protect internet-connected refrigeration systems?

Businesses should remove unnecessary public internet exposure, use secure remote access, replace default credentials, restrict administrator permissions, patch supported software, and isolate OT networks from unrelated systems. They should also monitor configuration changes and maintain a clear inventory of connected equipment.

### Can penetration testing help prevent these attacks?

Yes. Authorized, carefully scoped security assessments can identify exposed management interfaces, weak authentication, insecure network configurations, and pathways between IT and OT environments. Testing must account for operational safety because intrusive activity against live industrial equipment can interrupt or alter physical processes.

### What should a business do if its refrigeration system is compromised?

The business should follow its incident response procedures, involve qualified refrigeration technicians and cybersecurity personnel, and isolate affected systems when it is safe to do so. It should verify that equipment is operating correctly, preserve relevant evidence, and follow applicable food safety requirements before deciding whether products can remain on sale. Restoration of the system alone does not establish that all products are safe.

### Are only supermarkets at risk?

No. The same principles apply to other organizations using connected heating, ventilation, air conditioning, access control, security, manufacturing, or building management systems. Any device that can be accessed remotely and used to control a physical process may create cybersecurity risk if its access controls and software are not properly maintained.