Hackers Heat Europe Supermarkets: The Security Risks of Connected Refrigeration

BBC News reports on a October 2026 wave of cyberattacks that remotely heated supermarket freezers by compromising refrigeration controllers connected to the internet. The incidents began in France, with temperatures reaching 50°C and millions in food losses, and later spread to Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden. UK food suppliers were also targeted. While officials blamed Iran for the France attacks, cybersecurity experts have noted prior suspicions of Russian involvement. Source: BBC News.

• Attackers exploited remote access to refrigeration controllers, delaying alarms and causing large-scale spoilage.
• More than 3,100 refrigeration controllers remained visible online in early November, illustrating the scale of shared risk across sectors.
• Experts stress that securing connected devices requires independent safeguards and secure connectivity throughout a product’s lifespan, not just password protection.
• Liability and cost-shifting emerge as critical issues when vulnerabilities involve multiple suppliers and service providers.

Overview

In mid-October 2026 a cyberattack campaign compromised refrigeration controllers in hundreds of European supermarkets, leading to temperatures reaching as high as 50°C and spoiling food worth millions of euros. The incident began in France and, by early November, similar episodes affected Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden. UK food distributors also reported incidents, with one London wholesaler narrowly preserving stock by disconnecting affected equipment from the internet.

How the Attacks Occurred

The focus was on modern cooling systems that use internet-connected controllers to monitor temperatures, receive alerts, and adjust settings remotely. Hackers manipulated these controllers to extend defrost cycles from around an hour to eight hours, delaying alarms and allowing temperatures to rise while the equipment remained mechanically functional. This reveals a dangerous dynamic: devices can continue to operate while cybersecurity protections become ineffective, turning routine maintenance into a vector for physical damage.

Scope and Spread

France attributed the attacks to Iran on November 9, while cybersecurity experts have noted prior suspicions of Russian involvement. Regardless of attribution, the incidents underscore how cyber operations can disrupt the physical world and the everyday systems on which people rely. The reach extended beyond supermarkets to other sectors relying on refrigeration and climate-control systems, including hospitals, pharmacies and warehouses, as well as building management systems for heating, ventilation and air conditioning.

Security Gaps and Shared Responsibility

Experts emphasize that the same internet connectivity that makes remote monitoring convenient also creates opportunities for attackers. Tens of thousands of devices are publicly accessible, with more than 3,100 refrigeration controllers visible online on November 5, 2026. International guidance from January 2026 encourages manufacturers and buyers to ensure security across a product’s lifespan—a concept described as “secure by demand.” Yet when attacks succeed, responsibility for preventing and managing cyber incidents can become fragmented across suppliers, service providers and insurers, complicating liability and cost-sharing decisions.

Implications for the Public and Industry

The episode reveals a broader risk: a growing number of connected devices in homes and workplaces rely on cloud services and software updates, which can discontinue or become insecure over time. It calls for independent safeguards and local control options so personnel can maintain operations even if external connections are compromised. It also highlights the need for coordination among manufacturers, maintenance providers and insurers to clarify who bears the financial burden when vulnerabilities involve third-party components.

What Should Be Done?

Recommendations include securing connectivity, implementing safeguards that prevent dangerous remote changes to critical parameters, and maintaining local control options for essential functions. Policymakers and industry should push for security-by-design principles and lifecycle commitments from manufacturers, with clear accountability and insurance terms that reflect shared risk. For everyday consumers, the episode illustrates why questions about updates, cloud dependencies, and support lifespans matter when purchasing connected devices for homes and businesses.

Conclusion

As more devices connect to the internet, protecting the physical world from cyber threats becomes a shared, ongoing responsibility. The supermarket fridge attacks emphasize the imperative to secure not only digital access but also the people and processes that keep connected systems safe over time.