Rahul Somvanshi
Cyberattacks targeting commercial refrigeration systems in supermarkets have been confirmed across multiple European countries, with operators in Belgium, Sweden, Estonia, and France all reporting incidents in which freezer temperatures were remotely manipulated and food safety was compromised.
The attack method is direct: intruders accessed refrigeration management systems from outside target networks and altered temperature setpoints, forcing freezer units into defrost mode. Once a freezer cycles through defrost, internal temperatures climb above safe storage thresholds. Food that remains above those thresholds for sufficient time must be disposed of, generating immediate financial losses for affected retailers. Depending on how quickly the tampering is detected, entire sections of frozen goods can become unsalvageable before staff notice anything is wrong.
In the United Kingdom, the National Cyber Security Centre confirmed that vulnerable refrigeration technology had been exploited in a small number of incidents. Ireland’s National Cyber Security Centre also acknowledged awareness of the activity. Neither agency provided details about the specific retailers affected or the full extent of losses involved, but both acknowledgements confirm that the campaign extended beyond continental Europe.
In at least one confirmed case in Estonia, attackers gained access to an older Danfoss refrigeration system by using default or weak credentials. No forced exploitation of a software vulnerability was required. The incident illustrates a well-documented pattern in industrial security: control systems installed before widespread network connectivity was standard often retain factory default settings, and locating them on the public internet requires only a basic search using device discovery tools.
The scale of the exposure across connected refrigeration infrastructure is considerable. Security researchers report that more than 6,000 refrigeration management panels from a single manufacturer are reachable from the public internet. How many of those panels are protected by strong, non-default credentials is not publicly known.
No attacker or group has been publicly identified in connection with the incidents. Authorities have not released specific indicators of compromise, and no public CVE had been issued relating to the attacks as of 3 November 2026. Whether the campaign was conducted for financial disruption, as a demonstration of capability, or for other purposes remains an open question.
The incidents have prompted calls from retailers and security specialists for the isolation of refrigeration control systems from the public internet, the enforcement of strong credential policies on operational technology devices, and regular audits of industrial equipment that may have been connected to networks without the scrutiny applied to conventional IT systems.
Food retailers across Europe operate on narrow margins. A campaign capable of forcing defrost cycles across multiple sites and countries simultaneously — at a time when energy and supply chain costs are already elevated — carries financial and food safety consequences well beyond the cost of any single batch of spoiled stock.
