Cold Chain Under Attack: What Europe's Two Supermarket Fridge Hacks Teach Anyone Who Runs Connected Equipment

Here is the short version, before the detail: in recent days, a second wave of cyberattacks drove refrigeration gear in supermarket stores across Europe up to around 50 degrees Celsius and spoiled stock in aisles of fresh and frozen food. What makes this worth your attention even if you do not sell milk is the motive gap — nothing was stolen, nothing was encrypted, and no ransom note was published. Someone simply reached into a connected machine and told it to stop cooling. That is a different class of incident from the ransomware headlines most readers already know, and it is the reason this article is framed as a comparison and a decision guide rather than a news recap. We place the two waves side by side, explain the mechanism in plain terms, weigh the realistic defence options against one another, and close with a checklist you can run in half an hour.

Two waves, one playbook: how the incidents line up

Read separately, each incident looks like an unlucky hardware fault. Read together, they look like the same door being pushed a second time after the first push worked.

Comparison point	First wave	Second wave
Timing	Weeks earlier, overnight, in France	In recent days, around midnight on Sunday in Belgium, spreading overnight
Geography	France	Belgium, the Netherlands, Sweden, Luxembourg, Estonia, Finland and Ireland
Reported scale	French chain Intermarché described about 150 of its own stores affected, with units held hot for more than six hours, per reporting by DW	A local refrigeration-services estimate puts the Belgian toll at at least 20 refrigeration systems compromised
How stores found out	Staff noticed thawed stock and smoke in a minority of cases	Many stores noticed only several hours later, when staff opened the doors
Physical outcome	Large-scale spoilage, some units catching fire	Spoilage and emergency stock disposal; fires not widely reported
Attribution	No claim of responsibility, no ransom demand reported	Still no organisation publicly claiming the attack

Two differences are analytically important. First, the second wave arrived with the industry already warned: France's national computer-emergency team CERT-FR published an alert on 12 October naming remote controllers for refrigeration installations, and Belgium's national cybersecurity centre issued its own advisory telling operators to patch immediately (cert.cyber.gouv.fr; ccb.belgium.be). Second, the geographic spread moved from a single national estate to a multinational one, which suggests the weakness sits in equipment common to many retail groups rather than in one chain's IT.

What actually breaks: the defrost cycle as a weapon

Modern supermarket refrigeration is managed by a small computer per store. It runs compressors, valves and fans, and it schedules the defrost cycle — a short heating pulse that melts ice off the evaporator so the system keeps working efficiently. The cycle is normally brief and self-limiting.

According to the investigation detail available, attackers abused remote management functions in that controller, started defrost and stopped it ever switching back off. Temperature control is bypassed from the inside, so the store's own dashboard can keep reporting a system that is technically "running". In some cases cabinets were pushed above 50 degrees Celsius, and meat, dairy and fresh produce lost their saleable and edible status within a few hours. Swedish staff at ICA and Coop stores were left clearing and dumping stock overnight to avoid a food-safety incident on top of a cyber one.

The vendor angle that most coverage skipped

Public reporting adds a specificity the master timeline rarely states: the French wave ran through refrigeration control software supplied by the Danish manufacturer Danfoss, with the national cybersecurity agency ANSSI said to have identified a vulnerability in it, and France's alert later also covering Copeland and Dixell xWeb controllers (reuters.com; cert.cyber.gouv.fr). Danfoss described much of the affected equipment as legacy product that no longer receives software or security updates (facilitiesdive.com). Security researchers at Claroty's Team82 have published the complementary fix guidance for administrators: upgrade affected controllers to firmware R4.3.1 or later and keep management interfaces off the open internet, reachable only from a trusted administrative network or a protected VPN (claroty.com). That is a small but telling point: the hard part is not knowing the fix, it is that the fix does not exist for half the installed base.

Who was hit, and how each company answered

The affected estate spans both retail models. In Belgium, chains named in the disclosures include Delhaize, Carrefour and Spar; the Dutch retail group Ahold Delhaize is listed among operators whose stores were affected, while Sweden's ICA and Coop cooperatives took the visible hit in the Nordic stores.

Responses split along a line that is useful for anyone comparing suppliers. Delhaize confirmed an IT incident affecting some of its refrigeration systems and moved quickly to keep trading; Carrefour's Belgian arm said the impact was limited but confirmed a cyberattack on refrigeration installations. On the service side, Sabcobel chief executive Stefan Morans said the technique used was identical to the attack France had suffered weeks earlier, and added that the company had spent over the past few weeks deploying protections for customers' equipment — with some fixes only achievable through on-site hardware modification rather than a remote update. Belgium's national cybersecurity centre said it had learned of attacks on supermarket refrigeration systems and was monitoring developments.

Four defences compared: cost, speed and leftover risk

Every retailer and every facility manager now faces the same trade-off question. The table below is the comparison this article exists for: it is not a ranking, it is a set of different risks you choose to keep.

Option	What you do	Speed / cost	Residual risk	Best fit
1. Lock the door: close remote access, allow-list admins	Remove internet-exposed management interfaces, restrict vendor access to a protected VPN, rotate credentials, factory-reset suspected units	Fast, near-zero capital cost; needs an asset inventory first	Does nothing about zero-days in supported firmware; vendor maintenance contracts get harder	Chains with central IT and a real device register
2. Build a wall: segment OT from the corporate network	Puts controllers in their own zone so a breached till or office laptop cannot reach them	Weeks to months, moderate cost, needs design work	Still vulnerable if the controller itself is reached by a legitimate path	Multi-site operators already doing network upgrades
3. Fit a dumb switch: independent temperature alarms and a manual override	Standalone logger per cabinet, wired alarm, staff trained to cut power to the controller locally	Cheap hardware, ongoing manual labour	Detects and limits damage but does not prevent intrusion; human response time is the weak link	Smaller stores, fridges in restaurants, clinics and pharmacies
4. Buy the problem away: replace end-of-life controllers, contract managed detection	Migrate unsupported equipment to a current generation, pay for monitoring	Slowest and most expensive; often blocked by capital budgets	Only as good as the supplier's patch discipline	Large groups where a spoilage week costs more than the hardware

Two external pressures tilt this table. Regulation is catching up unevenly: under the EU Cyber Resilience Act, manufacturers have been obliged since 11 September 2026 to report actively exploited vulnerabilities and severe incidents, while the broader security requirements bite from 11 December 2027 (digital-strategy.ec.europa.eu). Reporting duties are not the same as fixing duties, and support windows are set by the manufacturer — which is precisely where the exposed controllers sat. Meanwhile ENISA's threat-landscape work keeps making the structural point that cyber dependencies widen the attack surface (enisa.europa.eu). The fridge is downstream of someone else's software release.

What this means at home, and the rule you can actually use

Households are not immune: smart fridges, heat pumps, air conditioners, cameras and alarm panels are increasingly managed from the cloud, and the same logic that let an attacker defrost a cabinet can let one disable your heating or watch your driveway. Official food-safety guidance gives a clean decision rule that works whether the cause is a hack, a storm or a compressor failure: discard perishable food such as meat, poultry, fish, dairy, eggs, soft cheese, leftovers and deli items that has been above 40 degrees Fahrenheit (roughly 4 degrees Celsius) for two hours or more, and never taste-test to check safety (foodsafety.gov).

• Keep a thermometer in the fridge and freezer; a hacked or failing unit looks identical from the outside.
• A full freezer holds a safe temperature for about two days, a half-full one for about one day — keep the door shut while you assess.
• If you buy connected appliances, ask one question before checkout: how long will this device get security updates?
• For a small business, treat the appliance controller as a server, not as furniture: put it on its own network segment.

Common misconceptions worth retiring

• "No data was taken, so nothing happened." The payload here is physical: spoiled food, insurance disputes, and in the French case fires.
• "Only a state-level attacker could do this." Public analysis points to internet-exposed controllers running known-flawed or end-of-life firmware — a low-sophistication opportunity, not an exotic weapon.
• "Our IT team already covers this." Refrigeration controllers usually sit outside IT inventories and are serviced by contractors with remote access they assume is fine.
• "Moving the equipment to a safer network fixed it." Stores did migrate controllers after the first wave, yet the second wave still landed, which is the strongest evidence that the flaw is distributed.
• "This is only a supermarket problem." Any cold chain — pharmacies, vaccine storage, food delivery hubs, restaurant cabinets — uses the same class of remote-managed hardware.

Action list: the thirty-day version

1. Inventory every connected building and retail system you own or manage: refrigeration, HVAC, cameras, access control, energy meters.
2. For each item, ask two questions in public: is it reachable from the internet, and is it still supported by its maker?
3. Close remote management paths you do not need this month; route the ones you do need through a VPN or vendor portal with individual accounts and logging.
4. Add an independent temperature or status alarm for anything whose failure costs you inventory, not just comfort.
5. Write a five-line response card: who checks the cabinets, who authorises disposal, who contacts the installer, who talks to customers, who reports the incident.
6. Get the support period for every controller in writing before the next capital purchase, and budget the replacement of end-of-life gear you cannot patch.

FAQ

How can a cyberattack make a freezer hot?

Because the freezer is not really a freezer; it is a refrigeration controller with a schedule. Attackers who reach that controller remotely can force the defrost stage to run continuously, which bypasses normal temperature control and lets cabinets climb toward around 50 degrees Celsius and beyond.

Was food safety at risk for shoppers?

That is why staff dumped stock rather than re-chilling it. Once perishables have sat warm for hours, reheating does not restore them; the public guidance is discard, not taste.

Who is responsible — the retailer or the equipment maker?

Both halves of the chain failed somewhere: retailers left management interfaces exposed and kept unsupported devices, while makers set short or informal support periods. Regulation pushes the balance toward makers, but not until the Cyber Resilience Act's wider duties apply from 11 December 2027.

What is the realistic damage for a single store?

Public figures are sparse, but the Belgian refrigeration-services estimate of at least 20 refrigeration systems compromised shows this is a per-site loss: stock, disposal cost, lost trading hours, and reputational repair, all triggered by a settings change.

Should consumers stop buying smart appliances?

No — but buy them on a support contract, not on novelty. The difference between a device with three more years of firmware and one with none is the whole incident.

The verdict

Scored as a case study rather than a scandal, the two waves deliver the same lesson twice. Efficiency and remote manageability were sold to retailers as a way to cut service visits and energy bills, and the price of that convenience turned out to be a physical switch that someone else can reach. Belgium, the Netherlands, Sweden, Luxembourg, France, Estonia, Finland and Ireland have now all touched the same wire, and the technical bar was reportedly no higher than an old device on the public internet. If your own exposure runs through any connected building system, the decision is not whether to disconnect everything; it is which risk you prefer to keep — a closed but awkward remote-access path, a segmented network you have to maintain, a cheap manual alarm you have to trust staff to hear, or a capital plan to retire equipment that will never be patched again. Most operators will need a blend. The only clearly wrong answer is to assume a machine that only cools things has no security requirements, because twice now, weeks apart, European stores found out otherwise.