A cyberattack does not always begin with a stolen password or a locked computer screen. Sometimes, its impact can be seen in a supermarket freezer, where food that should remain frozen suddenly begins to warm.
On 2 November 2026, supermarkets and food retailers across several European countries reported problems with their refrigeration systems following suspected cyberattacks. In some locations, refrigerators and freezers were reportedly set to temperatures as high as 50°C, forcing stores to remove spoiled products and investigate their systems.
The incidents have raised concerns about a less visible part of cybersecurity: the digital systems that control physical equipment. From supermarket refrigerators to factory machines and building systems, connected devices can become targets when their security is not properly maintained.
What Happened to Supermarkets Across Europe?
The latest incidents affected retailers and refrigeration systems in countries including Belgium, Sweden, Luxembourg and Estonia. Reports also described problems in other European markets.
In Belgium, supermarket operator Delhaize reported an IT incident affecting refrigeration systems in several dozen stores. Carrefour Belgium said 15 stores were affected, while other retailers also reported problems. In Sweden, supermarket chains ICA and Coop experienced refrigeration disruptions. An incident in Estonia involved an attacker accessing a computer that controlled a supermarket’s cooling equipment and changing a freezer setting to 50°C.
Some businesses had to remove food from affected refrigerators and freezers. Other stores responded quickly enough to limit damage. The scale of the impact therefore varied between locations.
The incidents followed a similar attack in France in October, when hundreds of supermarkets experienced disruptions to their refrigeration systems. French authorities said the earlier incident caused significant food losses and affected stores belonging to several major retail chains.
Although the incidents share similarities, investigators have not publicly established that every reported case was carried out by the same attackers. No group has publicly claimed responsibility for the latest wave.
How Can Hackers Control a Supermarket Freezer?
Modern supermarkets use digital refrigeration management systems to monitor and control the temperature of refrigerators, freezers and cooling units.
These systems help staff manage large stores more efficiently. They can monitor temperature levels, send alerts when equipment stops working and allow technicians to check or maintain systems remotely.
However, remote access also creates a potential entry point for attackers.
In the latest European incidents, refrigeration specialists described equipment being switched into a defrost mode. This mode is normally used as part of the refrigeration process to remove ice that builds up on cooling components. If it is activated or maintained for too long, the system may stop cooling properly and temperatures can rise.
An attacker who gains access to the control system may be able to change settings without physically entering the supermarket.
This is an example of an operational technology attack. Operational technology, commonly called OT, refers to the hardware and software used to monitor or control physical equipment and industrial processes.
Unlike a typical attack against an office computer, an OT attack can directly affect machinery, temperature controls, production lines and other physical operations.
Why Are Connected Refrigeration Systems Vulnerable?
Supermarket refrigeration systems are often connected to networks so that store operators and maintenance providers can monitor equipment remotely. This makes everyday maintenance easier, but it also means that poorly protected systems may be accessible to unauthorised users.
Several security weaknesses can increase the risk:
Outdated software and controllers: Older refrigeration controllers may no longer receive security updates. Known weaknesses can remain exposed if equipment is not replaced or properly protected.
Insecure remote access: Remote maintenance services can create opportunities for attackers if they are exposed directly to the internet or protected by weak security.
Poor network separation: If refrigeration equipment shares network access with other business systems, an attacker who compromises one part of the environment may have more opportunities to reach another.
Weak passwords and access controls: Default, reused or easily guessed passwords can make connected equipment easier to access.
Limited monitoring: Businesses may monitor whether equipment is operating correctly without having enough security monitoring to identify suspicious changes to settings or remote connections.
The October incidents in France also raised concerns about older refrigeration management equipment and controllers that were no longer receiving security updates. Security agencies advised affected businesses to use protected network connections, update firmware where possible and change passwords.
Why This Is More Than a Supermarket Problem
The incidents show how cybersecurity failures can affect physical services that people depend on every day.
Supermarkets rely on refrigeration to preserve meat, dairy products, frozen food and other perishable goods. If cooling systems stop working, businesses may face financial losses, supply disruptions and food waste.
The impact can extend beyond the affected store. Retailers depend on distribution centres, suppliers, maintenance companies and digital systems to keep products moving. A disruption to one part of this network can create additional pressure on the wider supply chain.
The same security challenge exists in other industries. Factories use connected systems to control production equipment. Hospitals rely on digital systems to manage building operations and specialised devices. Warehouses use automated equipment to store and move goods. Water and energy facilities also depend on operational technology.
These systems were designed primarily to keep physical processes running efficiently. As more of them become connected to business networks and the internet, cybersecurity becomes an essential part of their protection.
How Businesses Can Protect Operational Technology
Businesses do not need to disconnect every device from the internet to improve security. They do, however, need to control how equipment is connected and who can access it.
Important measures include:
- Secure remote access: Use a protected connection, such as a properly configured VPN, and avoid exposing control systems directly to the public internet.
- Update software and firmware: Apply security updates from equipment manufacturers and plan to replace products that have reached the end of their supported life.
- Change default passwords: Use strong, unique credentials and enable multi-factor authentication where supported.
- Separate operational networks: Keep refrigeration and other industrial equipment separate from ordinary office networks, limiting unnecessary communication between them.
- Monitor unusual activity: Watch for unexpected login attempts, configuration changes, temperature adjustments and remote connections.
- Prepare a response plan: Establish procedures for isolating affected equipment, switching to safe operating methods and contacting technical support.
Businesses should also work with refrigeration providers and equipment manufacturers to understand which systems are exposed, which updates are available and how remote maintenance is secured.
The Future of Cybersecurity Includes Physical Equipment
The European supermarket incidents are a reminder that cybersecurity is no longer limited to websites, smartphones and office computers. Digital controls now operate many of the physical systems that support everyday life.
A vulnerable computer connected to a refrigeration unit may appear less important than a bank server or a major corporate network. However, if an attacker can change its settings, the consequences can quickly become visible in the real world.
Investigations into the latest incidents are continuing, and the identity of the attackers remains unknown. What is already clear is that businesses need to treat connected equipment as part of their cybersecurity responsibilities.
As supermarkets, factories, hospitals and other essential services become more connected, protecting the technology behind their physical operations will be just as important as protecting the data stored on their computers.
