A wave of disruptive cyberattacks has swept across European supermarkets, but the target was not customer data. Instead, hackers went after the freezers, raising temperatures and forcing stores to discard huge quantities of spoiled food.
The Cold Chain Under Attack
In early November
2026, supermarkets in at least seven countries, including Sweden, Belgium, Ireland, and the Netherlands, reported that their refrigeration systems had been remotely compromised. Hackers accessed the digital controls for commercial freezers and refrigerators, in some cases pushing temperatures as high as 50°C. This followed a similar, large-scale attack in October that affected hundreds of stores in France, resulting in millions of euros in losses from spoiled goods. Retailers like Delhaize, Carrefour, Coop, and ICA were among those impacted, with dozens of stores forced to pull fresh and frozen products from their shelves. One butcher shop in Belgium lost an estimated €15,000 worth of meat after its fridges were turned up to 18°C. The incidents represent one of the first times a cyberattack has had a direct, widespread impact on a nation's food supply chain.
How Hackers Turn Up the Heat
The attacks exploit vulnerabilities in what is known as operational technology (OT) or industrial control systems (ICS). These are the digital systems that manage physical equipment, from factory machinery to, in this case, commercial refrigeration units. Many modern cooling systems are connected to the internet to allow for remote monitoring and maintenance by technicians, a feature that increases efficiency but also creates a potential entry point for malicious actors. In many of the recent attacks, hackers gained access and triggered a 'defrost mode' on the cooling units, causing them to heat up instead of cool down. The vulnerability often lies not in a sophisticated flaw, but in basic security oversights. These can include outdated software, the use of default passwords, or systems being directly exposed to the internet without adequate protection like a VPN or multi-factor authentication.
The Invisible Risk of Connected Devices
For years, cybersecurity has been primarily associated with protecting data and IT networks. These attacks demonstrate a crucial shift: the growing threat to the cyber-physical systems that underpin our daily lives. The retail sector, in particular, operates vast numbers of connected devices—from refrigeration controllers to building management systems—that were often installed by contractors without deep security expertise. Unlike a traditional IT network, these OT environments often contain legacy equipment that is difficult or impossible to patch, leaving them permanently vulnerable. An EU commissioner called the repeated attacks a 'deliberate attempt to disrupt our food supply chain,' highlighting the serious implications for food safety and consumer confidence.
Strengthening the Defenses
Security experts stress that preventing these attacks requires a fundamental change in how businesses view their operational technology. It's no longer enough to protect the front office; the systems controlling the physical world need just as much attention. Recommended security measures include segmenting OT networks from corporate IT networks to prevent attackers from moving laterally. Furthermore, all remote access should be strictly controlled and monitored, using dedicated industrial solutions instead of general-purpose tools. It is also critical for companies to change all default credentials on their devices and implement robust patch management policies. For retailers, this means working closely with their HVACR and facilities contractors to ensure that security is a priority from the moment a new piece of connected equipment is installed.
