Hackers remotely turned supermarket freezers into ovens across Europe this week, forcing shops in at least seven countries to throw away food after refrigeration units were pushed to temperatures as high as 50°C (122°F). On Thursday 5 November, five US federal agencies warned that the threat to industrial refrigeration and cold-chain systems is ongoing — and global.
Overnight into Monday 2 November, stores in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland reported fridges and freezers warming up instead of holding food cold. The attackers reached the systems through internet-connected refrigeration controllers and switched evaporators into defrost mode, or simply raised the temperature settings. No government or investigator has named who is behind the attacks.
The joint US warning, issued by the Cybersecurity and Infrastructure Security Agency (CISA), the FBI and the departments of health, transport and agriculture, said malicious actors are targeting "unpatched or internet-accessible electronic temperature controllers" and could force units into continuous heating and defrost cycles, causing inventory loss, equipment damage and even fire hazards.
"Every organization that depends on refrigeration and monitoring systems should assume it could be a target."
— Chris Butera, CISA's acting executive assistant director for cybersecurity
What happened on Monday
The heaviest impact was in Belgium and Luxembourg, where around 40 Delhaize supermarkets reported problems, according to the BBC. Carrefour said 15 of its Belgian stores were affected but stayed open, and Colruyt Group told Reuters that five franchised Spar shops were hit. In Sweden, ICA confirmed a small number of stores were affected and Coop said seven of its 800 stores were hit. In Ireland, 13 SuperValu supermarkets were affected; the owner, Musgrave Group, called it a cyber incident limited to one refrigerator model.
Danfoss, the Danish manufacturer whose controllers run many of the affected systems, told Dutch broadcaster NOS that at least 17 companies in the Netherlands were attacked, mostly butchers and small neighbourhood shops. In Estonia, a Selver supermarket's freezer was raised to +50°C on Monday, with no stock lost. In Finland, the Kesko chain said some of its stores had refrigerator malfunctions and it was investigating the cause.
Staff arrived on Monday morning to find cabinets warming up. At one ICA branch in Sjöbo, southern Sweden, managers wrote on social media that freezers had been set to 50°C; the store closed and has since reopened. A Delhaize branch in Hoeilaart, Belgium, put its loss at €100,000 worth of food, before counting the cost of closing, the BBC reported.
Belgian refrigeration firm Sabcobel, which operates systems for Delhaize, said the units' evaporators were switched to defrost mode. Its chief executive, Stephan Moelans, told the Belga news agency the incident was a cyber-attack, and said teams spent the night disconnecting affected units from the network.
A second wave — and a wider map
The November attacks are the second wave in about three weeks. On the night of 11–12 October, hackers seized control of cooling units at up to 700 supermarkets in France, including Carrefour, Monoprix, Intermarché, Netto and Coopérative U stores. Temperatures in some units rose from as low as –27°C to well over 50°C, causing fires in some stores and food losses estimated in the millions of euros. The Paris prosecutor's office opened an investigation, and France's national cyber agency, CERT-FR, issued an alert covering Danfoss and Copeland/Dixell controllers.
Since Monday, the map has kept growing. An AFP tally now lists 12 countries with reported cases: Belgium, Britain, Estonia, Finland, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Romania and Sweden. In Germany, police in Regensburg said a butcher's cold rooms were set to heat to as much as 150°C overnight, causing five-figure damage. In Italy, at least a dozen stores were reported hit, including five Conad stores and three supermarkets in the Rome area. In Romania, the national cyber security directorate said six stores of one unnamed chain were hit around 1:30 a.m. on Monday.
Britain's National Cyber Security Centre said it knows of "a couple of instances" of the vulnerable technology being exploited there, and that it is "too early to say" who is behind the attacks. Its head, Richard Horne, said the attacks were not AI-enabled and used long-known vulnerabilities.
| Date | Event |
|---|---|
| 11–12 Oct 2026 | First wave: up to 700 supermarkets in France hit; units pushed above 50°C; fires and millions of euros in food losses |
| 13 Oct 2026 | Danfoss advises customers to disconnect refrigeration systems from the public internet |
| 2 Nov 2026 | Second wave: supermarkets in at least seven European countries report freezers warming overnight |
| 3–4 Nov 2026 | AFP tally grows to 12 countries; EU Commission holds crisis meetings and activates its cyber crisis network |
| 5 Nov 2026 | France's blood service says three plasma storage sites were targeted; CISA, FBI and three US agencies issue a joint warning |
Blood banks targeted too
The attacks have moved beyond supermarkets. France's national blood service, the Établissement Français du Sang, said three of its plasma storage sites were affected on Monday. Alarms caught the temperature rise quickly and, according to the service, "no blood products were lost". The health ministry said neither the transfusion chain nor any patient was affected.
Separately, the French weekly Le Canard enchaîné reported that Coolworld, the firm that maintains the blood service's storage containers, was hacked on 1 November, and that cold rooms normally kept at –30°C were programmed to reach 110°C. The reports do not say the rooms actually reached that temperature. The health ministry said no formal link with the supermarket attacks has been established.
In Germany, the federal cyber agency BSI said a pharmaceutical wholesaler's medicine cooling systems were also attacked, and described the attacks as "untargeted and opportunistic".
How the attacks work
The weak point is remote-management software that lets retailers monitor and adjust refrigeration units over the internet. The affected systems are chiefly made by Danish firm Danfoss, and also include equipment from Copeland and Dixell. Investigators say the attackers exploited controllers that were reachable over the open internet, in some cases still using default passwords or unpatched firmware.
Danfoss had already warned customers on 13 October to disconnect their systems from the public internet and reconnect only through a secure network. The company says most stores acted on that advice — "but a small number did not". Data published by Censys on 5 November showed a 53% reduction in internet-exposed refrigeration controllers across the affected product lines since the October and November attacks.
The US advisory lists the same entry points: authentication bypass flaws, code injection, and weak configurations in unpatched or internet-accessible controllers. It urges operators to take control panels off the public internet, isolate operational equipment from business networks, change default passwords, use strong authentication, patch firmware and retire unsupported devices.
Who is behind it? Nobody knows yet
No government or investigator has publicly attributed the attacks. Two pro-Russian hacktivist groups, NoName057(16) and Z-Pentest Alliance, claimed shared responsibility in Telegram posts that have since been deleted — but the claims cannot be verified, and researchers are sceptical.
Attribution is unresolved and contested. The BBC reported that experts are not ruling out Russian groups, but say Iranian hacktivists or state hackers — or even teenagers — could also be responsible. Researchers told The Guardian that attacks on dummy Danfoss controls resembled recent operations linked to Russia, but that is their assessment, not an official attribution. Romania's cyber security chief, Dan Cîmpean, called the attacks "semi-amateurish" and said he does not suspect a state actor. The Kremlin dismissed speculation that Russia was behind the attacks, and TechCrunch reported that researchers have broadly pointed to Iran while US officials reportedly suspect it — neither is an official attribution.
The European Commission has condemned the incidents. EU agriculture and food commissioner Christophe Hansen called them "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it". The Commission held two crisis meetings on Tuesday, with the EU cyber agency ENISA and Europol at the first, and activated the EU's cyber crisis network, EU-CyCLONe. Belgium's federal prosecutors have opened an investigation.
Frequently asked questions
Was food safety at risk?
Retailers removed affected chilled and frozen food from sale, and authorities say food that was affected has been taken off sale. Italy's government said no risk to health has emerged. France's blood service said no blood products were lost and no patient was affected.
Is this the same attack as the one in France in October?
Not confirmed. The method is the same — internet-exposed refrigeration controllers forced into defrost mode — and several agencies see similarities, but no authority has confirmed the two waves are linked or exploited the same vulnerabilities.
Why would anyone hack a supermarket fridge?
That is the open question. No ransom was demanded, which has puzzled investigators. The EU agriculture commissioner described it as a deliberate attempt to disrupt the food supply chain. Others, including Germany's BSI, call the attacks untargeted and opportunistic.
What should operators do?
According to the joint CISA–FBI advisory: take refrigeration controllers off the public internet, isolate them from corporate networks, change default passwords, apply firmware updates promptly, and replace devices that are no longer supported.
Key takeaways
- Hackers remotely overheated supermarket freezers in at least seven European countries overnight into 2 November, with some units reaching 50°C.
- It is the second wave in three weeks, after up to 700 French supermarkets were hit in October — and the tally has since grown to 12 countries.
- France's blood service and a German pharmaceutical wholesaler were also targeted, showing the risk extends beyond grocery shelves.
- On 5 November, CISA, the FBI and three US agencies warned the threat to refrigeration and cold-chain systems is ongoing and global.
- Nobody has been officially blamed. Claims by two hacktivist groups are unverified, and experts disagree on whether a state actor is involved.
The attacks exposed how much of the food chain depends on small, internet-connected controllers that were never designed to face the open web. Retailers spent Tuesday hardening their systems — Sweden's Coop said its affected stores are running again with refrigeration cut off from the internet — but with tens of thousands of vulnerable devices still exposed, investigators expect the count of affected stores to keep rising. What to watch next: the Belgian federal investigation, the EU's coordinated response, and whether US operators heed the joint warning before a similar incident lands on their own shelves.
