France's cybersecurity agency reported numerous compromises of remote refrigeration controllers in October, followed by similar incidents across at least nine European countries in November
The attacks exposed vulnerabilities in connected operational technology that controls refrigeration, potentially causing food stocks to spoil when temperatures and defrost settings are manipulated
Although no healthcare refrigeration breaches have been confirmed, the incidents have raised wider concerns about the security of temperature-controlled medical and pharmaceutical storage
Cyberattacks on supermarket refrigeration systems have exposed a weakness in Europe's food supply infrastructure: equipment designed to keep perishable goods safe can itself become a point of entry for hackers.
France's national cybersecurity agency, confirmed on October 12 that remote refrigeration controllers at numerous retail outlets had been compromised. On Monday, further incidents were reported across Europe. The European Commission confirmed the wider pattern on Tuesday and convened coordination meetings involving national authorities, Europol and the European Union Agency for Cybersecurity (ENISA).
The incidents have raised questions about the security of temperature-controlled facilities beyond supermarkets, including hospitals and pharmaceutical storage centres. Although, there is no official confirmation that the current attack campaign has compromised healthcare refrigeration systems.
How Did Supermarket Refrigerators Become Targets?
In its October alert, France's national cybersecurity agency identified compromised controllers from four product families: Danfoss AK-SM and AK-SC, and Copeland and Dixell XWEB.
The affected equipment manages commercial refrigeration installations, allowing retailers and maintenance providers to monitor and adjust systems remotely. CERT-FR warned against exposing these management interfaces directly to the public internet and advised operators to inspect temperature settings, defrost schedules, passwords and firmware.
Hundreds of French supermarket outlets were affected, forcing retailers to remove refrigerated and frozen products from sale. However, CERT-FR's public alert did not provide a comprehensive count of affected stores or a national estimate of losses.
The problem resurfaced on Monday. Carrefour Belgium confirmed that refrigeration systems at 15 stores had been affected. Similar incidents were reported involving grocery retailers in Sweden, Ireland, Finland, Luxembourg, Estonia and the Netherlands.
The European Commission confirmed that several member states were affected. It held coordination meetings on Tuesday involving ENISA, Europol, EU CyCLONe and national authorities. The immediate priorities were information-sharing and coordinating responses.
How Can Hackers Manipulate A Freezer?
Modern refrigeration systems use operational technology (OT), comprising digital devices and software that monitor or control physical equipment.
A typical installation includes temperature sensors, controllers, compressors, defrost mechanisms and alarm systems. Remote monitoring allows technicians to inspect equipment and adjust settings without visiting each store.
If an unauthorised person gains access to a controller, they may be able to modify temperature settings, alter defrost schedules or change alarm configurations. Interrupting cooling can cause temperatures to rise, while manipulating alarms could delay the detection of abnormal conditions.
This is different from a conventional cyberattack targeting customer information or payment systems. Here, digital access can interfere with the physical process of keeping food cold.
CERT-FR and Ireland's National Cyber Security Centre have advised operators to inspect these settings. However, the precise method used to compromise the systems in the October and November incidents has not been publicly established.
Why Are These Systems Vulnerable?
One weakness is the long operational life of commercial refrigeration equipment. Controllers can remain in use for years, sometimes after manufacturers have stopped providing security updates.
CERT-FR warned that equipment that has reached end-of-life and no longer receives security patches faces a high risk of repeated compromise if it remains exposed to the internet. Resetting a controller may not resolve the problem if its underlying vulnerability remains.
Manufacturers have also disclosed security weaknesses in refrigeration-management products. Danfoss issued advisories in 2025 concerning vulnerabilities in its AK-SM series, while Copeland published a security bulletin for its XWEB PRO system in February 2026. These disclosures show that product vulnerabilities existed before the recent incidents, but do not establish that the identified flaws were exploited in the attacks.
Securing such equipment also presents an operational challenge. Refrigeration systems must continue working, while remote access is often necessary for maintenance. Taking equipment offline for extended periods is not always practical.
ANSSI's industrial cybersecurity guidance distinguishes OT systems from conventional business networks because they directly control physical processes. Security measures must protect these systems without disrupting their operation.
What Happens When The Cold Chain Breaks?
The cold chain is the temperature-controlled system that preserves perishable food during storage, transportation and distribution. A failure can affect food safety as well as retailers' finances.
France's Ministry of Agriculture sets different storage requirements depending on the product. Minced meat, for example, must be kept below 2°C, while the reference temperature for frozen food is -18°C. Other products have their own limits under national and European food-safety rules.
When refrigeration fails, retailers may have to remove products from sale if they cannot establish that required storage conditions were maintained. The European Union's food-hygiene regulations require food businesses to maintain the cold chain for products that cannot safely be stored at ambient temperatures.
The consequences can extend beyond individual stores. Supermarkets depend on cold-storage facilities and distribution networks to move perishable products. Disruption at these points can affect the availability and movement of food across a wider supply chain.
Could Hospitals And Blood Banks Be At Risk?
The current attacks have not been linked to breaches of hospital refrigerators, blood banks or pharmaceutical storage facilities. Their potential exposure nevertheless illustrates the wider importance of securing temperature-controlled infrastructure.
Healthcare facilities store medicines, vaccines and blood components under different conditions. Under French regulations, red blood cell concentrates are generally stored between +2°C and +6°C, platelets between +20°C and +24°C under continuous agitation, and frozen plasma at or below -25°C.
This distinction matters because not all blood components are refrigerated in the same way. A failure in temperature monitoring or control could compromise the integrity of these supplies.
European rules also require appropriate temperature controls for pharmaceutical storage and distribution. The European Commission's Good Distribution Practice guidelines cover temperature monitoring, calibrated equipment, alarms and maintenance of refrigeration systems.
Healthcare facilities are already facing wider cybersecurity threats. France's healthcare cybersecurity observatory recorded 764 incidents reported to CERT Santé in 2025, involving 606 healthcare and medico-social organisations. A separate October 2026 warning from CERT Santé highlighted vulnerabilities in network equipment and poorly segmented hospital networks.
These are separate incidents and do not establish that the supermarket attacks have reached hospitals. They do, however, show why connected equipment and outdated systems present a broader security challenge for healthcare infrastructure.
Can Europe Secure Its Cold Chain?
European cybersecurity rules cover both healthcare and food-related sectors. The NIS2 Directive includes healthcare and food production, processing and distribution among the sectors subject to cybersecurity risk-management requirements. Its obligations depend on an organisation's activities, size and classification; they do not automatically apply in the same way to every supermarket or hospital.
France's ANSSI says national transposition of NIS2 remains in progress and has encouraged organisations likely to fall within its scope to prepare.
The EU Cyber Resilience Act adds obligations for manufacturers, importers and distributors of products containing digital components. It addresses security by design, vulnerability management and product security throughout a device's lifecycle. Its requirements are being introduced in phases: vulnerability-reporting obligations began applying in September 2026, while the broader product-security requirements are scheduled for December 2027.
These measures will not immediately resolve weaknesses in older controllers already installed in supermarkets. For now, CERT-FR recommends removing direct public-internet exposure, securing remote access through protected networks, changing default passwords, updating supported firmware and checking system configurations.
Who Is Behind The Attacks?
The identity of the attackers and their motives remain unknown. The European Commission has declined to attribute the incidents to Russia or another state, saying national investigations are continuing. It has also not confirmed a technical connection between the October French compromises and the November incidents elsewhere in Europe.
The attacks demonstrate how connected equipment that appears peripheral to critical infrastructure can affect essential services when its controls are compromised. Supermarket refrigeration protects food supplies, while hospitals and pharmaceutical distributors depend on temperature-controlled systems for medicines and medical products.
The immediate challenge is to secure exposed controllers, address unsupported equipment and ensure that remote maintenance does not leave physical infrastructure vulnerable. Identifying those responsible remains important, but the incidents have already exposed a weakness in Europe's cold chain: its dependence on digital controls that have not always kept pace with cybersecurity requirements.
