News · Breach Analysis · Breaking

Europe's Supermarket Cyberattacks: Why Were the Refrigeration Systems Connected?

Refrigeration failures at hundreds of French supermarkets have been followed by similar incidents in five more European countries. Mark Fermor asks why remote control of physical equipment stays permanently connected.

Mark FermorCTO, CMO and Founder, Firevault

Published 2 November 2026 · 12 min read

When Charles Dezon arrived at his Intermarché supermarket in Gradignan, near Bordeaux, on the morning of 12 October, he was confronted with an expensive and rather unusual problem. His cold room had reportedly reached 50°C, the storeroom was flooded, and thousands of euros worth of food would have to be thrown away. According to his account to Le Monde, the disruption had begun at around 11pm the previous evening, but it was only discovered five hours later when a delivery driver raised the alarm.

Dezon's store was one of hundreds of French supermarkets caught up in a cyberattack targeting commercial refrigeration systems. Intermarché, Netto, Carrefour, Coopérative U, Monoprix and E.Leclerc were among the affected retailers, with reports indicating that more than 700 stores were ultimately impacted. Some were forced to close temporarily, others discarded entire freezer inventories, and incidents of equipment damage and fires were reported. At Gradignan alone, Dezon put his stock losses at €21,000, while the wider financial impact across France was expected to run into millions of euros.

What made the attack unusual was that the equipment had not necessarily suffered a conventional mechanical failure. Attackers had gained access to refrigeration management systems and manipulated the settings that governed how the equipment operated. According to the French reporting, some controllers were instructed to extend defrost cycles from approximately one hour to eight hours, allowing temperatures to rise and delaying the warnings that might otherwise have prompted an earlier response.

The consequences were immediate and physical. Food was destroyed, stores lost revenue, and refrigeration engineers were dispatched to restore equipment that had been instructed to operate outside its intended parameters.

Three weeks later, the same type of disruption has appeared elsewhere in Europe, making the French incident look less like an isolated event and more like a warning about a much wider exposure.

From France to a New Wave of European Incidents

On Monday 2 November, Reuters reported that refrigeration systems at supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia had experienced suspected or confirmed cyber-related interference. Although investigators have not established that the incidents share a common attacker or exploitation method, the similarities are difficult to overlook.

In Sweden, ICA and Coop reported problems affecting refrigeration equipment at several stores. At ICA Baronen in Stockholm, sales manager Engla Ingwall described discovering that freezers had reached 50°C following an incident that began around 2am. By the time staff identified the problem, large quantities of frozen stock had been ruined. Another ICA store in Sjöbo reported that its refrigeration settings had been changed, forcing employees to empty freezers and dispose of affected products. Coop confirmed similar problems at six stores.

Across Belgium and Luxembourg, Ahold Delhaize reported refrigeration disruption at several dozen locations. Carrefour Belgium confirmed that 15 stores had been affected, while Colruyt reported problems at five Spar outlets. The impact extended beyond supermarket chains. In Hove, near Antwerp, butcher Luc De Laet was woken by an employee at approximately 3.30am and discovered refrigeration temperatures had risen to around 18°C. He subsequently reported losing approximately €15,000 worth of meat.

The Belgian incidents also provided an important insight into how the attacks were being carried out. Stephan Moelans, chief executive of refrigeration specialist Sabcobel, told the Belga news agency that attackers had switched refrigeration evaporators into defrost mode. His engineers spent much of the night and following morning disconnecting affected installations from their networks to prevent further interference.

That response is particularly revealing. Equipment installed to preserve food had become vulnerable through the communications systems used to manage it. Once those systems were compromised, engineers had to remove the network connection to regain control.

Ireland and Estonia reported similar incidents, although their outcomes were different. Musgrave confirmed that 13 SuperValu stores had been affected by a cyber incident involving a specific model of refrigeration equipment. Monitoring systems detected the problem, allowing staff to remove chilled and frozen products from sale as a precaution. The stores remained open, and the company said its investigation was continuing.

In Estonia, attackers accessed a computer controlling refrigeration equipment at a Selver supermarket and changed a temperature setting to 50°C. However, engineers from Kitman Coldtech intervened within approximately ten minutes, limiting the actual temperature increase to around two or three degrees. No product losses were reported.

The Estonian example demonstrates an important technical distinction. Changing the setpoint of a refrigeration controller does not mean the physical equipment or its contents immediately reach that temperature. The outcome depends on the equipment's design, how long the manipulation continues, whether independent safeguards remain effective and how quickly the problem is detected.

Across these incidents, the reported consequences range from attempted manipulation with limited impact to substantial stock destruction and operational disruption. What connects them is the ability of an external actor to interfere with equipment that performs an essential physical function.

The Vulnerabilities Were Known, but Who Was Responsible for Securing the Equipment?

The European attacks have renewed scrutiny of the security built into commercial refrigeration management systems. In August 2026, researchers at Claroty's Team82 published findings involving the Danfoss AK-SM 800A platform, which is used to manage refrigeration equipment in supermarkets, warehouses and other commercial facilities. The researchers identified weaknesses in its web management interface, including an authentication bypass and a vulnerability capable of enabling remote code execution under certain conditions.

Danfoss worked with the researchers and released updated firmware. However, software updates only provide protection when they are installed, and commercial refrigeration equipment can remain in service for many years. Some systems operate beyond their supported lifecycle, while others are maintained by specialist contractors with limited involvement from the retailer's internal cybersecurity team.

Following the French attacks, the country's national cybersecurity response team, CERT-FR, issued an official alert covering compromised Danfoss, Copeland and Dixell refrigeration controllers. Its recommendations included removing unnecessary direct internet exposure, reviewing equipment configurations, applying firmware updates and restricting remote access through protected connections. The advisory specifically highlighted the need to examine defrost settings, reflecting the operational manipulation reported during the attacks.

The published research does not prove that one particular vulnerability was responsible for every incident. It does, however, demonstrate that the risks associated with exposed refrigeration management interfaces were already understood before the disruption spread.

The situation is especially relevant to UK retailers. Research published by The Grocer on 13 October, drawing on findings from UK Cyber Defence, identified more than 800 refrigeration and building-management controller interfaces reachable from the public internet. The equipment included systems from several manufacturers, with many connections operating over ordinary broadband or machine-to-machine mobile networks rather than the retailers' main corporate infrastructure.

The discovery of an accessible management interface does not mean a system has been compromised. Nevertheless, it provides attackers with a potential entry point and raises questions about whether the equipment is appropriately protected, maintained and monitored.

This is where the industry's approach to operational technology deserves closer examination. A supermarket may have invested heavily in cybersecurity for its payment systems, customer records and corporate network, yet its refrigeration infrastructure could be connected through a separate service installed and maintained by a third-party contractor. The retailer owns the operational consequences, but responsibility for the underlying connection may be shared between the equipment manufacturer, maintenance provider, telecommunications supplier and internal IT team.

As a CTO, I find that division of responsibility particularly concerning. Businesses cannot properly assess the security of equipment if they do not know how it is connected, who can administer it or what authority those connections provide. A refrigeration controller that has operated reliably for ten years might be regarded as perfectly serviceable by an engineer, while its management interface has become an increasingly attractive target for attackers.

The challenge is not simply keeping firmware updated. It is ensuring that operational equipment is included in the organisation's wider technology governance, with clear responsibility for remote access, maintenance, security and incident response.

Why Remote Monitoring Should Not Mean Permanent Remote Control

There are legitimate reasons for connecting commercial refrigeration equipment. Remote monitoring allows engineers to detect faults before they become expensive, assess temperature performance, manage energy consumption and support stores without travelling to every location. For retailers operating hundreds of sites, those capabilities can deliver considerable operational and financial benefits.

The problem is that monitoring equipment and controlling equipment are two different requirements. A supermarket may need continuous temperature readings and alarms, but that does not automatically mean a remote service should have permanent authority to change defrost schedules, modify operating parameters or reconfigure refrigeration controllers.

An engineer may need remote access during maintenance or when investigating a fault. The question is whether the communication pathway that permits those changes needs to remain available when no authorised work is taking place.

This distinction sits at the centre of the UK's National Cyber Security Centre guidance on securing operational technology. Its connectivity principles recommend reducing unnecessary exposure and using just-in-time access where appropriate, enabling communication when required and disabling it afterwards. The NCSC also advises organisations to avoid exposing operational technology management interfaces directly to the internet and to establish tested isolation arrangements.

None of this suggests that refrigeration equipment should simply be disconnected from every network. Local controllers, sensors, safety functions and critical alarms must continue operating reliably. Some installations also depend on continuous supervisory communications, which need to be understood before any network architecture is changed.

However, a remote maintenance connection is not necessarily essential to the refrigeration process itself. Where the equipment can operate safely under local control, maintaining a permanently available external management pathway may introduce an avoidable risk.

At Firevault, we have been examining this distinction through our approach to physical connectivity control. Our Retail & Supermarkets Control Blueprint considers how retailers can protect operational infrastructure by identifying the communication paths that are essential, separating them from those used for occasional maintenance and controlling access independently.

The principle is to preserve the physical process while reducing unnecessary opportunities for remote interference. Where an installation's engineering and safety requirements permit it, selected external maintenance connections can be physically disconnected when not in use and deliberately enabled for authorised access. This introduces a boundary beyond conventional software authentication and network permissions.

It is not a substitute for secure configuration, firmware maintenance, monitoring or independent safety controls. Nor can disconnecting one network path guarantee protection where other routes remain available. The design must preserve local refrigeration, essential alarms and safe operating conditions, including during an incident.

But the events in Belgium illustrate why the distinction matters. Engineers were reportedly forced to disconnect affected refrigeration installations after discovering that remote access was being used to interfere with equipment. A properly designed and tested means of controlling those connections before an incident could provide a more deliberate response than attempting to isolate equipment during an unfolding operational emergency.

The Firevault Retail Control Blueprint is a reference design rather than a deployment at any of the affected supermarkets. Its relevance lies in the architectural question these incidents have brought into focus: which connections genuinely need to exist, and who should have the authority to activate them?

A Wider Warning for Connected Infrastructure

The attacks on European supermarkets demonstrate how a cybersecurity incident can quickly become an operational crisis without involving the theft of a single customer record. The affected businesses have faced damaged stock, lost trading opportunities, emergency maintenance and concerns about food safety. The disruption has also exposed how dependent physical infrastructure has become on software and remote management systems that are not always governed with the same rigour as corporate IT.

The implications extend beyond food retail. Pharmaceutical cold storage, commercial building management, manufacturing equipment, water treatment systems and other operational environments increasingly use connected controllers to monitor and influence physical processes. Their designs, risks and safety arrangements differ, but the common challenge is understanding how digital access can affect physical operations.

Investigators still need to establish who carried out the October and November attacks, whether the incidents were coordinated and precisely which weaknesses were exploited. Those findings will be important, particularly for manufacturers and operators of the affected equipment.

The wider lesson, however, is already relevant to boards, technology leaders and operational engineers. Organisations need to know which systems can be reached remotely, which external suppliers have access and what could happen if those connections were compromised. They also need confidence that essential equipment can continue operating safely when remote access is restricted or removed.

The technology industry has spent decades making equipment easier to connect, monitor and maintain from anywhere. Those benefits remain valuable, but connectivity should be based on operational need rather than convenience alone.

A supermarket freezer must operate continuously to protect the products inside it. Its remote maintenance connection does not necessarily need to remain available continuously.

The question is no longer simply whether connected equipment is secure. It is whether every connection into that equipment is necessary, independently controlled and safe to disable when it is not required.

For the European retailers now counting the cost, that distinction has become painfully clear.

Mark Fermor is CTO and co-founder of Firevault, where he leads technology architecture focused on Offline Secure Storage® and physical connectivity control. This Insight draws on independent reporting, manufacturer research and national cybersecurity guidance available as at 2 November 2026. Firevault has not independently investigated the reported incidents.

Sources: Reuters (2 November 2026); Le Monde (13 and 17 October 2026); The Irish Times (2 November 2026); ERR Estonia (2 November 2026); The Grocer (13 October and 2 November 2026); CERT-FR security alert CERTFR-2026-ALE-012; Claroty Team82 research (9 August 2026); UK National Cyber Security Centre, Secure Connectivity Principles for Operational Technology.