Somewhere in Europe, a grocery freezer was doing exactly what it was told. Unfortunately, the instructions may have come from a hacker.
On November 2, 2026, retailers across Europe found refrigeration equipment warming unexpectedly. In one Swedish supermarket, a manager told Reuters that its freezers had been remotely driven to 50°C (122°F). Some stores emptied chilled aisles, discarded food and called emergency technicians. It was the second major wave of apparent attacks on Europe’s supermarket cooling systems in less than a month.
What makes this story more disturbing than an ordinary data breach is the target. Hackers apparently did not need to steal shoppers’ payment details to cause real-world damage. By interfering with systems that control refrigeration and defrost cycles, they could threaten a business’s entire refrigerated inventory.
October’s attack in France was the warning. November brought another wave.
The first widely reported campaign struck France in October, affecting hundreds of supermarkets and smaller food retailers. French authorities issued a formal cybersecurity alert on October 12 after identifying multiple compromises of internet-accessible refrigeration controllers. Some reports described equipment stuck in defrost mode, spoilage and costly shutdowns.
Then, overnight from November 1 to November 2, similar failures were reported far beyond France. BleepingComputer counted more than 115 affected outlets in its early reporting across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Subsequent reports also identified incidents in Finland, Italy, Portugal and elsewhere. Euronews reported nine countries with suspected incidents on November 2. Totals vary by reporting time and by whether small shops are counted alongside supermarkets.
The named retailers are not all part of one corporate system. In Belgium, the disruptions touched Carrefour, Delhaize, Intermarché and Spar sites. Sweden’s ICA and Coop confirmed affected stores; Ireland’s Musgrave Group reported problems at 13 SuperValu outlets; Estonia’s Selver confirmed a location was affected. A Belgian Ikea store also reported refrigeration trouble.
Those details undercut a tempting but simplistic explanation: this was not merely one supermarket chain suffering a breach of its headquarters. In many cases, individual stores operated their own equipment or used cooling controls outside the chain’s centrally managed network.
What could send a freezer toward 50°C?
Commercial refrigeration increasingly relies on networked control equipment. A technician may use remote access to monitor temperatures, schedule defrost cycles, receive failure alerts and adjust operating settings. Those features can reduce wasted energy and spoiled stock—when the person issuing commands is authorized.
But a poorly secured management interface can give an attacker access to the same functions. The reported attacks included altered temperature settings, interrupted refrigeration and activation of defrost modes. The 50°C figure was reported in particular incidents; it does not mean that every affected freezer, or every item of food, physically reached that temperature. At other locations, smaller rises were enough to trigger costly precautionary disposal.
The most revealing document is not a viral clip. It is CERT-FR’s technical warning. France’s national cyber incident response team identified compromised controllers in the Danfoss AK-SM and AK-SC series and Copeland/Dixell xweb systems. Its advice specifically calls for checking defrost schedules, taking exposed controllers off the public internet and restoring access through protected networks.
This matters because a refrigeration appliance does not have to be a sophisticated computer to become part of a cyberattack. It only has to be controlled by one.
Who was hit—and what happened afterward?
The November 3 Reuters follow-up reported that 23 ICA stores in Sweden had been affected and that all had refrigeration equipment connected outside the grocer’s centrally managed network. Coop said its seven affected locations had resumed operation, with the affected controls disconnected from the internet during security work. Belgium’s Carrefour reported 15 of its roughly 700 locations affected; Delhaize described incidents at several dozen stores.
Some businesses lost large amounts of inventory. Others removed products out of caution, while rapid intervention prevented major loss at certain locations. The Associated Press reported that the cost of spoiled food across affected businesses reached millions of dollars or euros. A complete, independently audited loss figure for the separate attack waves is not yet available.
Belgian authorities opened an investigation. European cybersecurity authorities called for coordination and information-sharing, and retailers began checking older equipment, replacing communications hardware and reviewing remote access. This is a costly answer to a deceptively inexpensive attack.
Known vulnerabilities, old equipment—and a dangerous assumption
The technical warning from France is unusually direct: systems with management interfaces exposed to the public internet should be removed from that exposure. If a controller is compromised, a reboot or factory reset alone may not solve the problem if the underlying weakness remains.
France’s CERT recommends secure VPN or protected-network access, manufacturer security updates, strict security settings where available, changed default passwords and examination of defrost configurations. It warns that unsupported, end-of-life equipment exposed online can be compromised again. That guidance is not evidence that every affected store used the same weak password or the same exploit. The precise intrusion path for every November incident remains unconfirmed.
This is the forgotten edge of digital transformation. Businesses digitize the systems most likely to save money, but they may not fund security and software maintenance for the hardware that keeps those businesses physically running. We have discussed that tension in another context in our reporting on aging operating systems and the cost of staying supported.
Was it coordinated sabotage? Investigators have not proved that.
Two waves close together, several countries, similar methods and sizable economic losses invite obvious questions about coordination. But resemblance is not attribution. As of November 4, investigators had not publicly identified an attacker or established a definitive motive connecting all incidents. There has been no verified public evidence that artificial intelligence was necessary to carry out these intrusions. The weaknesses described by authorities are familiar ones: exposed remote-access interfaces, old software and insufficient hardening.
Nor does a dramatic temperature setting establish a deliberate effort to poison consumers. Stores recognized failures and withdrew products; the verified harm so far is primarily disruption and food loss, not documented mass illness. And while some speculation focuses on state-backed sabotage, publicly available evidence has not established that conclusion.
What retailers can do now—and the bigger question
The immediate defense is practical rather than futuristic: inventory every internet-connected refrigeration controller, find which are publicly reachable, restrict remote administration, patch supported hardware, replace obsolete equipment and confirm that temperature alerts still reach people who can act. The French CERT-FR alert provides a detailed starting point for operators and technicians.
The larger lesson has little to do with groceries alone. Buildings, hospitals, farms and factories are full of computerized controls that manage physical processes. A malicious instruction delivered over a network can have consequences beyond a stolen password.
Europe’s freezer attacks leave one uncomfortable question: how many everyday systems are still connected to the internet long after someone stopped maintaining their defenses?
Video and primary reporting
Video: Watch Euronews’ November 2 video report on the supermarket refrigeration incidents. This is journalistic coverage of the reported events, not an illustration of a specific hacking technique.
Document: CERT-FR security alert CERTFR-2026-ALE-012 (first issued October 12, updated October 16). Further reporting: Reuters, November 3; BleepingComputer, November 2; Associated Press, November 4.
Featured image: a real supermarket frozen-food department photographed by Raysonho @ Open Grid Scheduler (Wikimedia Commons, CC0). Contextual stock photo; not any of the affected stores.
Watch: Supermarket Freezer Two — source commentary
The following video is a third-party account of the reported freezer attacks, not authenticated footage of any affected store. The factual claims are checked against the reporting and advisories linked above.
