Attacks on the fridges and freezers of supermarkets in several European countries highlight the risks of industrial devices connected to the Internet, and how exposed operational technology (OT) has become to cyber threats.
What might sound unlikely has become a real problem for Europe’s food retail sector. In the early hours of 2 November 2026, supermarkets in several European countries were hit by cyberattacks on their refrigeration and freezer systems. The attackers gained remote access to the controllers that run this equipment and changed their settings. Some freezers reached temperatures of up to 50 °C, leaving large amounts of food unfit for sale.
Affected companies include chains such as Carrefour, Delhaize, ICA and Coop, as well as IKEA and SuperValu stores. Incidents were reported in countries including Belgium, Sweden, Ireland, Estonia, Luxembourg and the Netherlands, causing product losses and disrupting day-to-day operations in stores.
However, these attacks are not an isolated case. Just a few weeks earlier, on the night of 11 to 12 October, hundreds of French supermarkets suffered similar incidents. The fact that these attacks keep happening, and are spreading to more countries, points to a growing risk: cybercriminals can tamper with connected devices to disrupt the physical processes an organisation depends on.
To understand these attacks, it helps to know what OT (Operational Technology) is: the technology used to monitor and control physical processes.
IT (Information Technology) systems handle information, applications and communications. OT systems, by contrast, control equipment and processes in the physical world. They are found in factories, power plants, hospitals and logistics centres, and also in supermarket refrigeration systems.
| IT systems | OT systems |
| Manage information and data. |
Control physical processes. |
| Protect applications, servers and databases. | Protect machines, sensors and controllers. |
| An incident can lead to data theft or loss. | An incident can disrupt equipment and physical operations. |
In supermarkets, industrial controllers set the temperature of cold rooms, manage defrost cycles and raise alerts when something goes wrong. To make maintenance easier, many can be monitored and managed remotely. The problem arises when these interfaces are exposed to the Internet or lack proper security.
France’s national cybersecurity agency, CERT-FR, confirmed intrusions into refrigeration controllers from several manufacturers, including:
The main risk factors include:
| Weakness | Risk |
| Interfaces exposed to the Internet | Make devices easy to find and access. |
| Security flaws | Can allow unauthorised access or actions. |
| Outdated software | Leaves known vulnerabilities unfixed. |
| Poorly protected remote access | Increases the chances of devices being compromised. |
Once inside, attackers can change settings such as target temperatures or defrost cycles. This means they can disrupt a physical process without ever touching the supermarket’s tills or databases.
The first major episode took place in France in October 2026, when hundreds of supermarkets from different chains saw their refrigeration systems tampered with. The attackers manipulated the controllers to change temperatures and trigger defrost cycles, leading to product losses.
Given the scale of the incident, CERT-FR issued a security alert about the compromised devices and advised taking them off the public Internet. A few weeks later, on 2 November, a new wave of attacks was reported across several European countries.
Although the similarities between the incidents point to a security problem affecting connected refrigeration systems, it has not yet been confirmed that they are all linked or carried out by the same attacker.
Digital transformation has connected more and more physical devices to company networks and the Internet. This coming together of IT and OT has greatly increased the number of ways an organisation can be attacked.
Connected industrial systems bring clear benefits: they allow sites to be managed remotely, processes to be automated and maintenance costs to be cut. But when they are not properly protected, they also bring new risks.
What’s more, a vulnerability in one manufacturer’s product can affect many organisations that use the same technology. That is why OT security should not be seen as a purely technical issue. It also affects business continuity, product safety and the delivery of essential services.
Recent incidents show that protecting industrial systems requires specific measures that take into account both the technology in use and the physical processes it controls.
Here are six key measures:
Prevention cannot stop at protecting systems once they are installed. Organisations also need to know what is happening outside their own walls.
Cyber Threat Intelligence (CTI) is the practice of gathering, analysing and putting into context information about cybercriminal activity, in order to spot risks and anticipate possible attacks.
This is where threat intelligence platforms such as Vysion come in. They bring together and analyse information from many sources, including the Dark Web, specialist forums and messaging channels such as Telegram and Discord.
Being able to connect information about vulnerabilities, exploits, indicators of compromise, threat actors and campaigns makes it easier to see links between separate events, and helps security teams better understand the risks facing their organisation. The goal is not just to know which attacks have already happened, but to pick up the signals that point to the next ones.
The attacks on European supermarkets’ refrigeration systems show how a technology weakness can turn into an operational problem with real financial and material consequences. Remotely tampering with a few industrial controllers was enough to cause product losses, disrupt business and damage stores in several countries.
The main lesson goes beyond the food sector: any organisation that relies on connected devices to control physical processes should treat OT security as a core part of its protection strategy.
Cybersecurity is no longer just about protecting information. It is also about protecting the systems that keep the physical world running.