Waking up to find your entire frozen inventory cooked is a nightmare scenario for any retailer. Yet, this became a shocking reality across Europe as hackers turned a mundane appliance—the supermarket freezer—into a weapon of mass disruption.
A Chilling Overnight Discovery
On the morning
of November 2, 2026, employees at supermarkets in at least seven European countries arrived to a costly and chaotic scene. From Sweden and Ireland to Belgium and the Netherlands, refrigeration and freezer units had been remotely manipulated overnight. Instead of preserving food, temperatures in many units had soared to as high as 50 degrees Celsius. At one ICA franchise store in Stockholm, an employee told reporters 'everything is destroyed' after an attack at 2 a.m. went unnoticed for hours. The coordinated incidents forced major chains like Carrefour, Coop, and SuperValu into crisis mode, immediately pulling compromised products from shelves to prevent food safety risks. The attack was a stark reminder of a similar, large-scale incident in France just three weeks prior, which caused losses estimated in the tens of millions of euros.
The Digital Weak Link
The attacks did not breach complex financial systems but instead targeted a more vulnerable, often overlooked part of retail operations: operational technology (OT). Specifically, the hackers exploited internet-connected controllers that manage refrigeration systems. Many of these Building Management Systems (BMS) are legacy products that no longer receive security updates, making them soft targets. In the French attacks, cybersecurity researchers found thousands of controllers from manufacturer Danfoss were exposed to the public internet, some with weak security like default passwords. The hackers gained remote access and executed simple but devastating commands, such as forcing the units into a prolonged defrost mode or directly raising temperature set-points, often disabling alarms to delay detection.
The Race Against Spoilage
The immediate response was a frantic scramble to regain control and mitigate losses. The first step for many was to physically disconnect the affected refrigeration systems from the internet to prevent further manipulation. For some, it was already too late. Staff were forced to discard entire inventories of meat, dairy, and frozen goods. One butcher in Belgium estimated €15,000 worth of meat was ruined. While the hackers have not made ransom demands, the incident functioned like a ransomware attack where the damage is the leverage itself. Retailers worked with cybersecurity contractors to diagnose the breach and patch vulnerabilities. Some, like the Belgian contractor Sabcobel, noted that the impact could have been worse had they not begun securing systems after the earlier French attack. In Ireland, SuperValu removed products from 13 stores purely as a precaution before confirming the systems were safe and beginning to restock.
A Wake-Up Call for Connected Systems
This wave of attacks has been described by the EU's agriculture commissioner as a 'deliberate attempt to disrupt our food supply chain'. It highlights a critical vulnerability that extends far beyond grocery stores. Any business that relies on internet-connected physical systems—from HVAC in hospitals to industrial controls in manufacturing—is a potential target. Experts have warned for years that the increasing convergence of IT and OT creates new entry points for hackers, a concern that has now been dramatically realised. The incidents serve as a powerful lesson for industries worldwide, including in India, that securing operational hardware is now just as critical as protecting corporate data. The focus is shifting from a reactive to a proactive security posture, isolating critical control systems and securing all remote access points before they can be exploited.
