It began silently, in the middle of the night. Across Europe, supermarket freezers designed to keep food safely frozen began to do the opposite: they started to heat up. This wasn't a malfunction; it was a coordinated cyberattack.
A Chilling Discovery
Store managers arriving
for their morning shifts in early November 2026 were met with a bizarre and costly scene. Instead of the familiar hum of refrigeration, they found failing freezers, melting products, and, in some cases, digital thermostats displaying temperatures as high as 50°C. Chilled and frozen goods, from meat and dairy to ice cream and vegetables, were ruined. In Sweden, one manager reported that their freezers were 'blowing out heat'. The attacks were widespread, hitting retailers like Carrefour, Coop, and SuperValu across at least seven countries, including Belgium, Ireland, and the Netherlands, in a wave that followed a similar, massive incident in France just weeks earlier.
The Weaponization of the Defrost Cycle
The hackers didn't target customer data or payment systems. Instead, they went after the stores' operational technology (OT)—the digital systems that control physical equipment. They gained access to internet-connected remote management controllers, some of which were running on outdated, unsupported software. The Danish manufacturer Danfoss confirmed its products were involved, noting that many affected units were legacy models for which security updates were no longer provided. Once inside, the attackers used a simple but devastating technique: they remotely triggered a prolonged defrost cycle or directly altered temperature set points. This action, designed to be subtle enough to avoid immediate alarms, effectively turned hundreds of freezers into low-power ovens overnight.
The Race to Contain the Damage
The response was a frantic, multi-front effort. The first priority was public safety. Retailers had to quickly assess and discard tons of spoiled food, a process guided by strict food safety regulations that determine when partially thawed goods can be refrozen. Simply restoring power wasn't enough; temperature records were needed to confirm what was safe. Simultaneously, IT and refrigeration experts scrambled to stop the bleeding. Technicians worked through the night to disconnect compromised units from the internet, a crucial step to prevent further manipulation. According to Stephan Moelans, the CEO of a refrigeration company managing systems for the Delhaize chain, his teams worked to physically disconnect affected stores from the network as an immediate containment measure.
Restoration and Reinforcement
Recovery was not a simple case of flicking a switch. For each affected store, technicians had to inspect, reboot, and often factory reset the controllers before carefully reconfiguring them. However, for endoflife devices, a reset alone wasn't a permanent solution, as they could easily be compromised again if left exposed online. The longterm fix involved a combination of software updates for supported devices and, in some cases, physical hardware modifications. The most critical step advised by cybersecurity agencies and manufacturers was to move the remote management systems behind secure networks, like a VPN, rather than leaving them exposed to the public internet. While effective, this process was slow and required coordination between individual stores, corporate IT, and thirdparty refrigeration contractors.
A Wake - Up Call for Critical Infrastructure
While the financial losses mounted into the tens of millions of euros, the true cost of the freezer attacks was the stark realization of a new vulnerability. The incidents demonstrated how easily digital threats can cross into the physical world, disrupting a critical part of the food supply chain. Experts note that the increasing connectivity of industrial equipment—from refrigeration to building controls—creates a vast and often poorly secured attack surface. These systems are frequently installed and managed outside the view of corporate IT security teams, running on legacy hardware that is difficult to patch. The European Union's food and agriculture commissioner called the events a 'deliberate attempt to disrupt our food supply chain', highlighting the broader strategic implications.
