Imagine walking into your local grocery store to find the freezer aisles empty. This became a reality for shoppers across Europe as a new wave of cyberattacks targeted not data, but something far more tangible: supermarket refrigeration systems.
What Exactly Happened?
Overnight
on November 2, 2026, employees at supermarkets in at least seven European countries, including Ireland, Belgium, Sweden, and the Netherlands, arrived to a bizarre and costly scene. Refrigeration and freezer units, which are supposed to maintain sub-zero temperatures, had been remotely manipulated. In some cases, hackers triggered a prolonged 'defrost mode,' while in others they simply cranked the temperature setting as high as 50°C (122°F). The attacks hit a wide range of retailers, including major chains like Carrefour, SuperValu, and ICA, forcing them to take immediate action as chilled and frozen goods began to thaw. This followed a similar, large-scale attack in France just weeks earlier, which affected hundreds of stores and caused millions of euros in damages.
The Race to Save the Stock
The immediate priority for retailers was to prevent a massive food safety crisis and contain financial losses. The first step was a rapid clear-out. As a precaution, staff at affected stores, like 13 SuperValu branches in Ireland, removed all chilled and frozen products from the compromised units. This was a race against time, as food that thaws to unsafe temperatures cannot simply be refrozen and sold. The US Food and Drug Administration has strict guidelines on the matter, and retailers had to make quick, difficult decisions about what could be salvaged versus what had to be discarded, with some stores losing their entire frozen inventory. Simultaneously, the technical battle began. IT teams and cybersecurity specialists were called in to diagnose the problem. Stephan Moelans, the CEO of a refrigeration contractor for the Delhaize chain in Belgium, said his teams worked through the night to disconnect affected units from the network to stop the attack's spread. Restoring refrigeration wasn't as simple as flipping a switch; it involved isolating the compromised control systems, resetting them, and ensuring the vulnerability that allowed the breach was patched before bringing them back online.
How Did Hackers Get In?
This wasn't a sophisticated breach of a corporate server, but an attack on what is known as operational technology (OT) or the 'Internet of Things' (IoT). Many modern supermarket refrigeration systems are connected to the internet. This allows third-party contractors to monitor performance, diagnose faults, and manage energy usage remotely without having to send a technician to the store. The attackers exploited vulnerabilities in these internet-facing controllers. Reports point to systems from manufacturers like Danfoss, with many of the compromised units being older, 'end-of-life' models that no longer received critical security updates or were running on outdated firmware. In some cases from the earlier French attacks, the vulnerability was as simple as a default password that was easy to guess. The hackers didn't need to break into the supermarket's main IT network; they just needed to find these exposed, insecure controllers online.
The Aftermath and Broader Implications
For the affected stores, operations were quickly restored in many cases, with Musgrave, SuperValu's parent company, confirming its incident was resolved and restocking was underway within a day. But the event has sent a shockwave through the retail and cybersecurity industries. It demonstrates a shift in cybercrime tactics, moving from data theft and ransomware to direct, physical disruption. The goal here wasn't necessarily to steal customer data or demand a huge ransom—though the motive remains unconfirmed—but to cause chaos and tangible economic damage. The EU's food and agriculture commissioner called the attacks 'a deliberate attempt to disrupt our food supply chain'. The incident serves as a stark wake-up call that in an increasingly connected world, everything from our food supply to critical infrastructure can be vulnerable. Experts warn that any internet-connected device, whether in a factory, hospital, or home, can become a target if not properly secured, highlighting an urgent need for better security practices for all IoT devices.
