 |
| Photo: Wilfredor / Wikimedia Commons |
At around 3 a.m. on Monday, November 2, 2026, alarms started blaring at a supermarket in Overijse, Belgium.
The store manager rushed in and found something bizarre. The refrigerators and freezers had switched themselves into defrost mode. Instead of keeping food cold, they were pumping warm air into the storage compartments.
Within hours, the same nightmare was waking up supermarkets across Europe. Freezers that should sit well below freezing were heating up, food was spoiling, and staff were scrambling to throw it away before anyone ate it.
Here is what happened, how the attack worked, who it hit, and what is still unknown.
What happened on Monday
Supermarkets in at least 10 European countries reported refrigeration problems on Monday, November 2: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany and Sweden.
In several places, temperatures in refrigeration units reportedly reached 50°C — hotter than a summer heatwave, and far beyond anything chilled or frozen food can survive. At that temperature, a freezer stops being a freezer. It becomes, in one report's memorable phrase, a low-powered steam oven — and a place where bacteria multiply quickly if food sits there too long.
Retailers had no choice but to discard the affected food. In Belgium, dozens of stores reported refrigeration failures, and federal prosecutors opened an investigation. In Ireland, the Musgrave Group said 13 SuperValu stores were affected by what it described as a cyber incident, with chilled and frozen products removed from sale.
In Portugal, the Mosqueteiros group linked incidents at seven Intermarché stores to a cyberattack that appeared to target an external service provider managing refrigeration systems. In Germany, refrigeration at a Rewe Büsken supermarket was disrupted after an attack on system provider Danfoss, and was back in operation by Monday afternoon.
In Sweden, retailers ICA and Coop reported refrigeration problems. Reuters reported that one Swedish store said attackers had set its refrigerators and freezers to 50°C. In Estonia, a refrigeration contractor reported that hackers accessed a customer's control system and raised temperatures to 50°C.
The European Union is treating the wave as a deliberate attempt to disrupt the food supply chain. The EU's Commissioner for Agriculture and Food, Christophe Hansen, said the bloc is taking the incidents very seriously and warned of further disruption. A European Commission spokesman said the attacks showed how cyber incidents can disrupt essential services and affect people's daily lives.
This was not the first wave
The Monday wave was alarming on its own. What makes it more serious is that it followed an earlier, larger one.
About three weeks earlier, a cyberattack disrupted as many as 700 of France's 10,000 supermarkets. France's Finance Minister, Roland Lescure, told Parliament on October 13 that around 700 stores were affected, with food losses estimated at tens of millions of euros.
France's computer emergency response team, CERT-FR, tied those compromises to remote control modules made by Danfoss and Copeland. It has warned that the campaigns are probably still ongoing.
That warning now looks prescient. Italy's government was set to hold a cybersecurity meeting on Tuesday, November 3, as the new wave spread. Belgium has recognised its incident at national level. And the United Kingdom is not untouched either.
How do you hack a fridge?
The short answer is that a modern supermarket fridge is not just a cold box. It is a computer.
Supermarket refrigeration systems are managed by remote controllers that let operators monitor temperatures, adjust settings and run maintenance cycles from elsewhere. That remote access is the weak point.
Freezers periodically need to remove ice that builds up on their cooling components. To do that, they briefly run a defrost cycle, activating heating elements for a short time. Attackers forced those systems into a continuous defrost cycle — heat on, and on, and on — until the compartments warmed to dangerous temperatures. In some stores, the forced defrost also sparked fires.
According to CERT-FR, the attackers exploited remote control modules made by Danfoss and Copeland. Researchers at Claroty published flaws in Danfoss AK-SM 800A controllers in August 2026, including an authentication bypass — a flaw that can let an attacker in without proper credentials. Claroty found 2,765 of those devices exposed online. Danfoss fixed the flaws in firmware version R4.3.1.
CERT-FR's warning is blunt: leaving an end-of-life device without security patches, exposed to the internet, carries a very high risk of compromise.
That is the pattern investigators see across the affected countries: not a break-in at each individual store, but attacks on the companies and control systems that manage refrigeration remotely. Hit the provider, and you can hit many stores at once.
Who is behind it? Nobody knows yet
No group has claimed responsibility for the attacks, and officials have not publicly attributed them to any country or criminal gang.
That has not stopped speculation. Because the attacks hit food infrastructure across many countries at once, and because they followed the French wave, EU officials have raised fears of government-backed "hybrid" operations — attacks that disrupt daily life without a shot being fired.
But speculation is not evidence. At the time of writing, the honest position is the official one: the attackers are unknown, the method is becoming clear, and the investigation is ongoing.
Readers should be wary of any post claiming to name the culprits with certainty. No credible authority has done so yet.
What about the UK?
The UK was not on the main list of countries reporting store disruptions on Monday, but its cyber chief has confirmed the problem reached British shores in a smaller way.
Dr Richard Horne, head of the UK's National Cyber Security Centre (NCSC), said hackers had already exploited vulnerable technology at a small number of sites in the food supply chain. The centre alerted a handful of organisations whose exposed technology appeared vulnerable.
Horne's advice to retailers was practical: update the software controlling fridge temperatures, and do not leave old, unpatched controllers exposed to the internet.
For shoppers, the practical point is reassuring. Affected stores removed the compromised food from sale rather than selling it. If a shop's chilled section looks emptier than usual, or a product feels warm, that is a sign to skip it and tell staff — not a reason to panic about everything in the store.
Why this attack matters beyond spoiled food
Food losses in the millions of euros are bad enough. The deeper worry is what this wave proves.
First, it proves that everyday infrastructure is hackable at scale. Refrigeration is not a military system or a bank vault. It is the machinery that keeps milk, meat and medicine safe — and it runs on internet-connected controllers that, in many cases, were never designed with modern attackers in mind.
Second, it proves that one weak component can cascade. A flaw in one manufacturer's controller, left unpatched, became a continent-wide incident because so many stores rely on the same equipment and the same remote-management providers.
Third, it shows how disruption works in 2026. Nobody needed to block a road or close a port. Forcing freezers into defrost mode for a night wasted food, closed chilled sections, triggered investigations in multiple countries and forced a government-level meeting — all from a keyboard.
That is why the EU is treating this as a food-supply issue, not just a technical glitch. If refrigeration can be attacked this easily once, it can be attacked again — and next time the target could be a warehouse, a pharmacy cold chain or a hospital store.
What happens next
Three things will decide how this story develops.
First, patching. The immediate fix is unglamorous but effective: update Danfoss and Copeland controllers to the fixed firmware, take end-of-life devices offline, and stop exposing control systems directly to the internet. How fast retailers do that will decide whether there is a third wave.
Second, attribution. Investigators in Belgium, France and elsewhere are tracing how the attackers got in. A credible attribution — or a claim of responsibility — would change the story from a technical incident into a diplomatic one.
Third, regulation. The EU has already warned of further disruption. Expect pressure for mandatory security standards on remotely managed food and medical equipment, and for faster disclosure when providers are compromised.
Until then, the most useful question for any shopper is a simple one: is this food actually cold? In this strange week, that turned out to be a question worth asking.
Frequently asked questions
Which countries were hit by the supermarket freezer attacks? At least 10 on Monday, November 2, 2026: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany and Sweden. France was hit in a separate, earlier wave affecting around 700 stores.
How hot did the freezers get? Reports from Estonia and Sweden put temperatures at up to 50°C in affected units — far above safe storage temperatures for chilled or frozen food.
How did hackers take over the freezers? They exploited remote refrigeration controllers, reportedly Danfoss and Copeland modules, and forced the systems into a continuous defrost cycle that heats instead of cools. Researchers had published flaws in Danfoss AK-SM 800A controllers, including an authentication bypass, in August 2026.
Who carried out the attacks? No group has claimed responsibility and no government has publicly attributed the attacks. Any claim naming a culprit is, for now, speculation.
Is food in UK shops safe? The UK's NCSC said a small number of food-supply sites had vulnerable technology exploited, and it alerted the organisations involved. Affected stores removed compromised products from sale. Shoppers should avoid chilled or frozen food that feels warm or looks thawed.
Read next: How the $6.3 Billion Binance Hack Happened, Step by Step — another case where one weak link cascaded into a massive loss.
Sources
Decrypt, "Epidemic of Hacked Freezers Spreads Across Europe," November 3, 2026; BBC reporting on the 10-country wave, November 4, 2026, via Europe Says and Global News Pakistan; UK National Cyber Security Centre comments by Dr Richard Horne, November 4, 2026; France CERT-FR assessments and Claroty research on Danfoss AK-SM 800A controllers, as reported by Decrypt, November 3, 2026; Zemescience, "Someone Is Making Europe's Supermarket Freezers Melt Their Own Food," November 2026; Izvestia, "Massive cyber attacks on refrigerators are underway in EU countries," November 4, 2026.
No comments:
Post a Comment