Someone is hacking supermarket fridges: what we know about the attacks across Europe

France, overnight 11–12 October. The Paris prosecutor's office opened an investigation into an overnight cyberattack on refrigeration systems at hundreds of French supermarkets, per TIME. CNBC, citing Reuters, reports fridges and freezers reached as much as 50°C (122°F). Retailers named include Carrefour, Monoprix, Intermarché and Coopérative U. Les Mousquetaires (Intermarché) told TIME about 180 of its stores were hit; BFM-TV put the national figure nearer 300. Intermarché's chief executive told BFM-TV the day's losses were “tens of millions of euros nationwide”.

Europe, overnight 1–2 November. Reuters, via CNBC and Al Jazeera, reports temperature spikes in stores in Belgium, Luxembourg, Sweden, Ireland and Estonia. Ahold Delhaize and Colruyt reported an overnight IT incident hitting fridges and freezers in dozens of stores; Carrefour said 15 of its 700 Belgian stores were affected; Sweden's Coop said 7 of its 800 stores; Ireland's SuperValu said 13 stores; ICA, IKEA and Axfood also reported incidents. A Belgian butcher told Reuters about €15,000 of meat was ruined.

Supermarket refrigeration is run by a central controller that schedules compressors, alarms and the periodic defrost cycle that briefly warms an evaporator to clear ice. TIME, citing BFM-TV, reports the attackers remotely triggered forced defrosting across many stores, and citing Le Monde, that they extended the defrost on some freezers and cold rooms from one hour to eight to delay alarms. Sabcobel's chief executive told Al Jazeera the evaporators were “switched to defrost mode”. In other words the attackers did not break the cooling equipment; they used a legitimate function, turned up and left running.

Many of these controllers are reachable from the internet so maintenance firms can administer them remotely. France's CERT-FR said exposing a management interface to the internet is “contrary to best practices” and that remote administration should be limited to trusted IP addresses (per TIME). France's ANSSI named two Danfoss product series, AK-SC and AK-SM. Danfoss said the affected French units “were running outdated firmware” and that it had long advised customers to update and migrate legacy systems; that is the company's own account. TIME adds that Claroty researchers had published, in August, flaws in a Danfoss AK-SM 800A controller that could let an intruder bypass login, with fixes in later firmware, but TIME does not say that research is linked to the attacks. Investigators have not publicly said how access was gained.

No group or country has claimed either wave, and Reuters could not establish whether the November attacks were linked to France. Belgium's Centre for Cybersecurity said it “is not known who is behind this attack, and it may never be determined.” Al Jazeera notes European states have blamed Moscow for a growing number of infrastructure incidents and that Russia denies involvement in sabotage; no suspect is named for these attacks, and any link to Moscow is speculation in the reporting.

SentinelOne's Tom Hegel told Reuters that attacks like this are typically tied to extortion, political motives or nation-state operations, and that the absence of a financial demand here points toward sabotage. His line is worth keeping: “A teenager and an intelligence service would look much the same from the defender's side.” That is the real lesson of attribution in 2026: the tools are shared and cheap enough that the attacker's identity is often unknowable in the first weeks.

• It targets a physical consequence, not data. The aim appears to be spoilage and fire risk, not theft. TIME reports investigators said the attack “may have sparked fires”; Les Mousquetaires said stores saw smoke but no fires, so that point is disputed.
• Food is a dependency chain. Coopérative U's chief executive called attacking equipment essential to preserving fresh food “unprecedented”. The EU Agriculture Commissioner, Christophe Hansen, called the November incidents “a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it.” That is his characterisation; investigators have not confirmed intent.
• It is not the first sign. TIME notes at least six US military commissaries reported refrigeration outages in late August 2026 and that Army CID is investigating; it has not been established that they are cyberattacks or linked to Europe.
• AI shortens the distance between flaw and attack. The Belgian centre's spokesperson said: “All IT systems are potentially vulnerable, and AI can now be used to successfully exploit these weaknesses — especially by sophisticated actors.” That is an official's assessment, not a finding about how these attacks were done. See how AI is making cyberattacks faster and cheaper.

The wider point of this series is visible in miniature here: a technology built to make cold storage cheaper to maintain (remote access to a controller) is the same technology that lets a stranger on another continent turn a store's freezers into ovens. See why everything connected gets hacked.

• New cyberattack on supermarket fridges sweeps across Europe — CNBC (2 Nov 2026)
• Suspected cyberattacks trigger supermarket fridge failures across Europe — Al Jazeera (2 Nov 2026)
• ‘Unprecedented’ cyberattack targets French supermarket fridges — TIME (13 Oct 2026)
• French supermarket fridges get hacked, heating to 122°F — CNBC (13 Oct 2026)
• CERT-FR alert CERTFR-2026-ALE-012