A Second Wave of Cyberattacks Hits Supermarket Refrigerators Across Europe, Spoilig Tons of Food and Exposing Critical Infrastructure Vulnerabilities
A sophisticated and coordinated second wave of cyberattacks has targeted supermarket refrigeration and freezing systems across multiple European nations, forcing retailers to discard massive amounts of inventory. The widespread incidents, which unfolded overnight, impacted dozens of grocery stores in Belgium, Ireland, Luxembourg, and Sweden, with retail giants Ahold Delhaize and Colruyt among the hardest hit.
The malicious activity, characterized by unauthorized remote alterations to cooling unit settings, marks a significant escalation in threats directed at operational technology (OT) and the broader food supply chain. Security analysts and industry stakeholders warn that these attacks highlight systemic vulnerabilities in internet-connected commercial appliances, posing severe risks to food safety, economic stability, and public infrastructure.
The Anatomy of the European Supermarket Attacks
According to confirmations from major European retailers and logistical operators, unauthorized actors gained remote access to refrigeration management systems, deliberately switching the units from cooling modes to defrost cycles. In Belgium, a regional operator managing systems for Delhaize confirmed that settings had been manipulated remotely to induce a rapid internal temperature rise.
The sudden and uncontrolled thawing of perishables—including meats, dairy, frozen produce, and ready-to-eat meals—rendered substantial inventories unsafe for human consumption. Consequently, supermarket staff across the affected regions faced the grim task of clearing shelves and disposing of tons of spoiled goods. Beyond the immediate economic losses and operational disruptions, the incidents have caused supply chain bottlenecks as stores scramble to restock aisles and sanitize refrigeration units.
Retailers have been forced to implement emergency protocols, temporarily disconnecting automated refrigeration management systems from the internet and shifting to manual temperature monitoring. While supply chain networks have largely avoided total collapse due to the localized nature of the closures, the incidents have exposed glaring vulnerabilities in the digital management architecture of modern retail environments.
Chronology and Escalation: From France to the Broader Continent
The November incidents do not represent an isolated phenomenon; rather, they form the latest chapter in an escalating campaign against commercial refrigeration infrastructure. The crisis first manifested publicly in October, when a localized wave of cyberattacks struck hundreds of supermarkets across France. In that initial wave, threat actors executed similar remote temperature manipulations, triggering extensive food spoilage and heavy financial losses for French grocers.
Security researchers investigating the French and subsequent European incidents quickly identified a common denominator: internet-connected refrigeration controllers manufactured by Danfoss, a prominent Danish industrial engineering and manufacturing firm. Investigations revealed that many of the targeted units were running on legacy firmware and were no longer receiving essential security patches or updates from the manufacturer.
Months prior to the attacks, in August, cybersecurity firm Claroty published a comprehensive research advisory detailing critical vulnerabilities within Danfoss refrigeration controllers. The research warned that these connected units possessed architectural flaws that could allow malicious actors to execute remote code, bypass authentication mechanisms, and manipulate temperature controls. Despite these public warnings, thousands of commercial refrigeration units deployed across Europe remained exposed, connected to the internet without adequate network segmentation, multi-factor authentication, or endpoint protection.
Industry and Official Responses
As the scale of the cross-border cyberattacks became clear, affected retail conglomerates issued statements confirming the security breaches while launching internal investigations in coordination with national cybersecurity agencies.
Ahold Delhaize, one of the world’s largest supermarket groups operating globally and extensively across Europe, emphasized that customer data and corporate financial systems remained secure, noting that the breach was strictly confined to physical operational technology systems. Representatives for Colruyt echoed similar sentiments, stressing that immediate containment measures had been enacted to isolate compromised units from central networks.
Manufacturers and technology providers have also come under intense scrutiny. While Danfoss has faced mounting pressure regarding the security lifecycle of its legacy hardware, cybersecurity advocates emphasize that system integrators, third-party facility management vendors, and supermarket IT departments share responsibility for failing to secure operational technology networks. Many commercial refrigerators are installed with default credentials, connected directly to public-facing networks, or left unmonitored by security operations centers that typically focus solely on enterprise IT rather than physical OT.
National computer emergency response teams (CERTs) in Belgium, Ireland, Luxembourg, and Sweden have initiated joint intelligence-sharing efforts to trace the origin of the intrusions. Initial assessments suggest that the attackers leveraged automated scanning tools to discover exposed refrigeration controllers connected to the global internet, utilizing credential-stuffing techniques or exploiting known unpatched vulnerabilities to gain administrative privileges.
Broader Implications for Critical Infrastructure and Food Supply Chains
The weaponization of commercial refrigerators underscores a sobering reality in modern cybersecurity: the convergence of information technology (IT) and operational technology (OT) has vastly expanded the attack surface for critical infrastructure. While historical cyber threat paradigms focused primarily on data exfiltration, ransomware encryption of corporate servers, or financial theft, malicious actors are increasingly demonstrating an ability to manipulate the physical world with tangible, destructive consequences.
The food supply chain represents a particularly sensitive and vulnerable vector. Because groceries rely on precise temperature control across a continuous "cold chain" from distribution centers to retail display cases, any systemic disruption to refrigeration can result in catastrophic waste.
This vulnerability is not unprecedented. In June 2025, a high-profile cyberattack targeted United Natural Foods Inc. (UNFI), a major U.S. grocery distributor. The incident severely disrupted logistics and inventory tracking, leading to widespread food shortages, empty shelves, and delivery delays at prominent supermarkets and natural food chains, including Whole Foods, across the United States.
Furthermore, the threat landscape extends beyond the commercial retail sector into government and military installations. In October, U.S. Department of Defense officials launched an investigation into a series of suspected cyberattacks targeting refrigeration units on various military bases. Investigators have reportedly been examining potential links to state-sponsored actors, specifically pointing toward Iran-backed hacking groups. These same threat actor groups were previously implicated in a series of disruptive cyberattacks targeting U.S. municipal water and wastewater treatment facilities earlier in the year.
Path Forward: Securing the Cold Chain
The cascading refrigeration hacks in Europe serve as a critical wake-up call for the retail and agricultural sectors. Cybersecurity experts argue that preventing future incidents will require a fundamental shift in how physical appliances are managed and secured throughout their operational lifecycles.
Key recommendations from security frameworks include:
- Network Segmentation: Ensuring that operational technology, such as refrigeration and HVAC systems, is strictly isolated from corporate IT networks and the public internet behind robust firewalls.
- Mandatory Firmware Lifecycles: Holding manufacturers accountable for providing long-term security support and automated patching mechanisms for industrial IoT (IIoT) and OT devices.
- Enhanced Access Controls: Eliminating default passwords, enforcing multi-factor authentication (MFA) for all administrative interfaces, and implementing zero-trust network access (ZTNA) principles.
- Continuous Monitoring: Deploying specialized OT security monitoring tools capable of detecting anomalous commands—such as sudden temperature spikes—before physical damage occurs.
As European authorities continue their forensic analysis into the November cyberattacks, retailers and security professionals face an urgent imperative to harden their infrastructure. Without comprehensive regulatory standards and proactive security investments across the entire supply chain, the threat of physical sabotage targeting everyday necessities will remain a persistent and escalating danger.
