The unwelcome sight of empty, corded-off freezer aisles became a reality for shoppers across Europe. This wasn't a supply issue, but a far more modern threat: cyberattacks specifically targeting supermarket refrigeration systems.
A Coordinated Thaw
In a series of alarming
incidents in late 2026, dozens of supermarkets across at least seven European countries were hit by coordinated cyberattacks. Retailers in France, Belgium, Sweden, Ireland, Italy, and others reported that their refrigeration and freezer units were remotely manipulated overnight. Attackers forced the systems into defrost cycles or simply turned them off, causing temperatures inside to soar to as high as 50°C (122°F). By morning, staff arrived to find tonnes of frozen and chilled products—from meat and dairy to prepared meals—completely spoiled. The financial losses from discarded stock alone were estimated to be in the tens of millions of euros.
The Digital Weak Link
The attacks exploited a convenience that has become a critical vulnerability: internet-connected operational technology (OT). Modern supermarkets use building management systems (BMS) to remotely monitor and control essentials like HVAC and refrigeration. These systems save energy and allow for efficient maintenance across hundreds of stores. However, investigations revealed the hackers targeted specific, often older, controller models from manufacturers like Danfoss and Copeland. Many of these targeted units were running on outdated firmware that no longer received security updates or were still using easy-to-guess default passwords. The attackers didn't need sophisticated malware; they simply logged into these exposed systems from the internet and used the built-in controls to cause chaos.
More Than Just Melted Ice Cream
While the immediate impact was spoiled food and financial loss, the incidents highlight a much broader and more concerning trend. The food and agriculture sector is increasingly a target for cybercriminals. These attacks demonstrate a shift from data theft to direct physical disruption. By crippling the cold chain, attackers can disrupt a system society relies on daily, creating not just economic damage but also significant food waste and potential public health risks. For ransomware groups, the logic is simple: businesses with perishable goods cannot afford significant downtime and are therefore more likely to pay a ransom quickly. For other malicious actors, the goal may simply be disruption itself.
A Wake-Up Call for the Supply Chain
Cybersecurity experts and government agencies, including Italy's National Cybersecurity Agency and the US's CISA, have issued urgent warnings in response. They emphasize that this is not an isolated problem but a systemic risk affecting any industry that relies on connected operational technology, from food production to healthcare and manufacturing. The supermarket attacks serve as a potent case study in 'technical debt'—the deferred cost of not maintaining or upgrading critical systems. The convenience of remote access was not matched with adequate security measures, leaving a door wide open for attackers.
Securing the Cold Chain
In the aftermath, retailers and their technology partners are scrambling to secure their infrastructure. The immediate advice from security agencies is to take any internet-facing control systems offline, or at a minimum, secure them behind a VPN. Longererterm solutions involve conducting thorough audits of all connected devices, enforcing strong password policies, and ensuring that firmware is regularly updated. A critical step is network segmentation: separating the operational technology network that runs the building from the corporate IT network. This prevents an attacker who gains access through a phishing email from 'moving laterally' to shut down the freezers. The events have proven that in the 21st century, food safety is now inextricably linked to cybersecurity.
