A new and alarming wave of cyberattacks is hitting European supermarkets where it hurts most: their freezers. Hackers are remotely turning up the heat, causing millions of euros in food spoilage and raising serious questions about supply chain security.
What Exactly Happened?
In early November 2026, dozens of supermarkets across at least nine European countries, including Belgium, Sweden, Ireland, and the Netherlands, reported a widespread and coordinated disruption. Staff arrived to find that refrigeration and freezer units had been remotely tampered with overnight. In many cases, temperatures were raised to as high as 50 degrees Celsius (122 degrees Fahrenheit), ruining vast quantities of meat, dairy, and frozen goods. This incident mirrored a similar, large-scale attack in France just weeks earlier, which affected hundreds of stores. Major chains like Delhaize, Carrefour, ICA, and Coop were among those impacted, forcing them to discard spoiled products and post notices on empty shelves.
How Did Hackers Control the Freezers?
The attacks targeted a vulnerability in the so-called 'Internet of Things' (IoT). Modern supermarkets use internet-connected control systems to remotely monitor and manage their refrigeration units for efficiency and maintenance. Attackers exploited weaknesses in these systems, which are often supplied by third-party manufacturers like the Danish company Danfoss. Once inside, hackers could manipulate the controls, in some cases forcing the units into a continuous 'defrost' mode, which caused them to heat up instead of cool down. Many of these operational technology (OT) systems run on older software that may not have received recent security updates, or they are connected to less secure 4G networks, making them easier targets.
A New Frontier in Cybercrime
Unlike typical cyberattacks that focus on stealing data or demanding a ransom, these incidents are aimed at causing direct, physical-world disruption. So far, no group has claimed responsibility, and no ransom demands have been reported, which makes the motive unclear. Cybersecurity experts suggest two main possibilities: it could be a state-backed actor demonstrating its ability to disrupt critical infrastructure, or it could be an independent hacker proving a point. EU officials have called the events a 'deliberate attempt to disrupt our food supply chain'. This shift from data theft to physical sabotage represents a frightening escalation, showing how digital vulnerabilities can lead to tangible consequences like food waste and potential shortages.
The Underlying Security Gaps
The core issue is the insecure convergence of IT and OT. While retailers have focused on securing payment systems and customer data, the operational hardware controlling the store itself has often been overlooked. These refrigeration controllers, sometimes installed and managed by external contractors, can be directly exposed to the public internet without proper security. Cybersecurity firms had previously warned of critical flaws in some of these systems, but patching them can be difficult as it may require taking refrigeration offline—a major problem for a 24/7 business. This incident serves as a major wake-up call that every connected device, no matter how mundane, is a potential entry point for attackers.
What Are the Broader Implications?
The financial cost is significant, with individual butchers reporting losses of thousands of euros and larger chains facing millions in spoiled inventory. But the greater impact is on the integrity of the food supply chain. These attacks highlight how interconnected and fragile modern logistics are. The threat is not limited to Europe; similar vulnerabilities exist globally, including reports of hacks on US military base commissaries. For businesses in India and elsewhere, this serves as a critical lesson. As more operational equipment becomes 'smart' and connected to the internet, companies must broaden their cybersecurity focus beyond traditional IT to include all physical infrastructure, from air conditioning to industrial controls.
