Cyberattack heats freezers in European stores

Cyberattacks targeted the control systems of European supermarkets and other facilities using refrigeration in autumn 2026. According to The Guardian, the target temperature of some freezers was remotely changed to as high as 50°C, meaning the digital intrusion directly altered the operation of physical equipment.

The incident is particularly notable because it was not about a temporary website outage or solely about obtaining data. The attackers gained access to operational technology whose deliberate reconfiguration could endanger stock and the cold chain, as well as disrupt the food supply.

Two waves of attacks emerged

According to an analysis by Palo Alto Networks Unit 42, two major waves of attacks were identified. The first, on 11–12 October 2026, primarily affected France, while the second, on 1–2 November, extended to several European countries.

Public reports differ on the number of countries affected. The Guardian reported seven countries, while Unit 42 indicated that more than ten countries were involved. Given this discrepancy, it would not be appropriate to describe the geographical scope of the attacks with a single definitive figure.

According to Unit 42, the attackers activated defrost mode on some devices. This function is part of the normal operation of refrigeration systems, but if activated without authorisation or at the wrong time, it can cause the storage area to warm up.

OT systems control machinery, not just data

OT stands for Operational Technology. It includes the controllers, sensors and monitoring systems that manage physical processes, such as regulating temperature, switching machinery on and off, or handling alarms.

An IT attack can result in data leaks, service outages or direct financial losses. By contrast, breaching an OT system can interfere with the operation of machinery or other physical infrastructure. The two areas are becoming increasingly interconnected because many operational devices are given network access for remote maintenance and monitoring.

Refrigeration is a particularly sensitive area. Sustained changes in temperature can affect both the quality and safety of goods, while inspecting, withdrawing, removing and replacing stock can create further operational difficulties.

Physical disruption, not ransomware, took centre stage

According to a technical analysis by Shieldworkz, no ransomware was detected in the incidents and no ransom demand was made. The report therefore highlights the direct sabotage of physical operations as the objective of the attacks.

This is an important distinction from typical ransomware attacks. According to the reports, the perpetrators did not attempt to extort payment by encrypting files, but instead interfered with equipment settings. The effects of the attack therefore appeared not only in the digital environment, but also in refrigerated spaces and the goods stored there.

However, the perpetrators’ identities and motives have not been officially established. The absence of ransomware and a ransom demand does not in itself prove exactly what considerations drove the attackers.

Publicly accessible controllers increase the risk

According to a joint security advisory published on 5 November 2026 by the US Cybersecurity and Infrastructure Security Agency, attackers are targeting commercial refrigeration controllers that are directly accessible from the internet or have not been updated. CISA issued the warning with the involvement of the FBI and several US federal departments.

Remote connectivity offers clear operational benefits. Maintenance staff can quickly inspect the system, respond to an alarm or adjust settings when necessary. However, that same connection can become an attack surface if the controller is directly accessible from the public internet, uses outdated software or lacks adequate access protection.

The precise method of intrusion has not been publicly disclosed for every affected site. It therefore cannot be stated with certainty that all cases can be traced to the same vulnerability or access method.

The threat is not limited to supermarkets

According to a warning issued on 6 November 2026 by Singapore’s Cyber Security Agency, refrigeration systems belonging to France’s national blood transfusion service were also attacked through an external equipment supplier, in addition to French supermarkets. This suggests that the risk is not limited to food retail.

Refrigeration technology plays an essential role in several sectors, including healthcare, pharmaceuticals, warehousing and logistics. If similar controllers are widely used, a vulnerability involving a supplier or remote access point can affect the security of several organisations at once.

This also brings the cybersecurity dimension of the supply chain to the fore. It is not enough to examine only the store or warehouse’s own network: the permissions granted to maintenance providers, technology suppliers and external service providers are also part of the security framework.

Digital interference directly disrupted physical operations

According to Unit 42’s analysis, the unauthorised activation of defrost mode caused warming, while The Guardian reported that the target temperature of some freezers had been set to 50°C. The reports therefore indicate that the attackers not only accessed the refrigeration controllers, but also changed how they operated.

According to The Guardian, EU Commissioner Christophe Hansen described the incident as a deliberate attempt to disrupt the food supply chain. However, this political assessment is not the same as an official determination of the perpetrators’ identities or motives.

The incident clearly illustrates the difference between an attack on data and the manipulation of a physical process. It was not merely a digital service that could have become unavailable: real equipment received instructions that may also have affected stock stored in shops and other facilities.

How can the exposure of operational systems be reduced?

A principle shared by the recommendations of CISA and Singapore’s CSA is that controllers should not be made directly accessible from the internet without good reason. Necessary remote access should be provided through a controlled, segregated and properly authenticated connection.

However, security does not depend on a single setting. Operators need to know exactly which devices are running on their networks, who can access them, what software they use and which configuration changes should be considered abnormal.

• Asset inventory: network-connected controllers, their software versions, functions and responsible owners should be recorded.
• Network segmentation: operational controls should not be connected unnecessarily to the office network or the public internet.
• Access protection: unique authentication and permissions tailored to specific tasks are needed instead of factory-set or shared login credentials.
• Updates and monitoring: supported patches should be installed according to a plan, while configuration changes should be logged and monitored.
• Emergency plan: organisations should determine in advance how operations can be restored or maintained safely in the event of a network incident.

The specific implementation of these measures depends on the equipment and operating environment. For critical or healthcare refrigeration systems, following the manufacturer’s instructions and involving a qualified OT security specialist is therefore appropriate; general information is not a substitute for an on-site risk assessment.

Cybersecurity now includes protecting stock

The attack on freezers is a particularly clear example of how cybersecurity no longer means protecting only computers and data. If a network-connected controller manages a physical process, the consequences of unauthorised access can extend beyond screens and become apparent in shops, warehouses and even healthcare facilities.

The lesson is not that all remote monitoring should be abolished. These systems enable faster maintenance and more efficient operation, but only when access is protected in a way that reflects the device’s actual role and level of risk.

At first glance, a refrigeration controller may seem like a simple technical device, but in reality it is an important operational component of a supply chain. If it is not treated as a critical operational risk, a digital intrusion can quickly lead to physical losses and wider disruption.