Supermarket fridges and freezers in several European countries were remotely switched into heating or defrost mode overnight on Monday, November 2, pushing some units as high as 50°C (122°F) and forcing stores to throw away spoiled food. The supermarket freezer cyberattack comes just three weeks after a similar wave hit around 700 stores in France, and it is turning a once-niche risk – hacked building and refrigeration controllers – into a food-security issue.
Key takeaways
- On November 2, chains in Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia reported fridges and freezers malfunctioning after apparent cyberattacks, with more countries reported later in the day.
- Attackers raised temperature settings or forced units into defrost mode overnight, when stores were closed. One Swedish store said its units were set to 50°C.
- Affected retailers include Delhaize, Colruyt, Carrefour Belgium, ICA, Coop Sweden and SuperValu owner Musgrave. Most say only a limited number of stores were hit.
- Danfoss, the Danish maker whose controllers were targeted in France, says 17 facilities using its systems were hit in the Netherlands.
- No group has claimed responsibility. Investigations are under way in several countries.
What happened
Staff arriving on Monday morning found refrigerated cases warm and stock ruined. In Sweden, an ICA store in Sjöbo posted that “overnight, our refrigerators and freezers were hacked, and the temperature was set to 50 degrees,” ABC News reported. ICA said the incident affected a small number of stores operating outside its central network. Coop Sweden said a handful of its more than 800 stores had problems and that the situation was contained.
In Belgium and Luxembourg, dozens of Delhaize and Colruyt stores were affected, according to CBS News and AFP. Sabcobel, a Belgian refrigeration firm that runs systems for Delhaize and other chains, said the attack switched evaporators into defrost mode. Its CEO said technicians were mobilised from 1 a.m., and the company is now disconnecting affected units from the network. Carrefour said 15 of its 700 Belgian stores were hit, mostly freezers, and all stayed open.
In Ireland, Musgrave told RTÉ that 13 SuperValu stores were affected by a suspected attack on one specific refrigeration model. In the Netherlands, Danfoss told broadcaster NOS that 17 facilities using its systems were hit, including frozen storage sites and butcher shops. Reports later in the day, summarised by Gizmodo, pointed to incidents in further countries, though store counts there have not been confirmed.
The French attack that came first
Monday’s wave closely mirrors an attack in France on October 12. French Finance Minister Roland Lescure told parliament that about 700 of the country’s 10,000 supermarkets were affected, calling it “a wake-up call for everyone,” the Associated Press reported. Intermarché, Netto, Coopérative U, Carrefour and Monoprix were among the chains hit, and the Paris prosecutor’s cybercrime unit opened an investigation that also covers reports of overheating equipment catching fire.
France’s cybersecurity agency said the targeted controllers were made by Danfoss, including the AK-SM800 and AK-SC355 models, Al Jazeera reported. Danfoss said most affected systems were older products that no longer receive software or security updates, and advised customers to update firmware and keep systems behind a firewall.
Why it matters
Commercial refrigeration is connected to the internet so technicians can monitor temperatures and fix faults remotely. That convenience creates an attack surface. If a controller is reachable online and running old firmware, a few remote commands can destroy a store’s chilled and frozen stock overnight – with no ransom note and no data theft required.
Security researchers say this was preventable. Patrick Lamplmair, CTO of Tributech, told Gizmodo there are known flaws in refrigeration controllers that already had fixes, and that thousands of these devices were still reachable from the internet after the French attack. “A freezer should never accept an instruction to heat to 50°C, no matter who sends it,” he said.
The pattern is also not limited to Europe. According to Reuters reporting cited by ABC News, several US military base commissaries were hit by similar refrigeration attacks in August, and the Pentagon is investigating. EU food commissioner Christophe Hansen responded to Monday’s incidents by saying “food security requires more attention at all levels.”
What it means for businesses and developers
This is a textbook operational technology (OT) problem, and the fixes are well known. Anyone running connected equipment – in retail, cold storage, hospitality or facilities – should check the basics now:
- Get controllers off the public internet. Put refrigeration and building management systems behind a firewall or VPN, and use an external scan to confirm nothing is exposed.
- Patch or replace legacy units. End-of-life controllers that no longer get firmware updates should be isolated or retired.
- Lock down remote access. Change default credentials, require strong authentication for service vendors, and log every remote session.
- Add safety limits. Wherever the hardware allows, enforce hard temperature limits and alerts that cannot be overridden remotely, so a hostile command triggers an alarm instead of a heat cycle.
- Watch overnight. Both waves struck while stores were closed. Out-of-hours temperature alerts that reach a real person can turn a total loss into a quick fix.
For developers building IoT and remote-management products, the lesson is to design for hostile input: validate commands against physical safety ranges on the device itself, not only in the cloud. As we covered in how AI is finding software bugs faster than humans can fix them, the gap between a known flaw and its exploitation is shrinking. Supply-chain hygiene matters too – see our recent report on the trojanized Claude Code extension.
What to watch next
- Attribution. No group has claimed either wave. Belgian cybersecurity officials have said the culprit may never be identified.
- The full count. Totals for affected stores and food losses across countries are still coming in.
- Regulatory response. Expect pressure on EU regulators to treat connected food-supply equipment as critical infrastructure.
- Vendor fixes. Watch for new advisories from Danfoss and other controller makers, and for retailers speeding up planned upgrades, as Coop Sweden says it was already doing.
The attacks have not threatened overall food supplies, officials say, but they show how easily an unpatched, internet-facing controller can turn a supermarket’s cold chain against it.