A second wave of suspected cyberattacks targeting supermarket fridges and freezers has spread across Europe, raising concerns about the security of connected refrigeration systems and the potential for cybercriminals to cause physical disruption without sophisticated malware.
The latest incidents, reported on 2 November, affected refrigeration equipment in seven European countries, including Belgium, Sweden, Luxembourg, Finland and Ireland. Supermarket chains reportedly affected include Carrefour, Intermarché, Coop, ICA and Delhaize, with some refrigeration temperatures manipulated to reach as high as 50°C.
The incidents follow attacks on French supermarkets in October, when compromised refrigeration controls reportedly caused widespread food spoilage. Although the perpetrators and their motives remain unconfirmed, the attacks have demonstrated how vulnerable internet-connected operational technology can become a target for disruption.
Nearly 13,000 Exposed Refrigeration Services Worldwide
Recent research from Forescout Research – Vedere Labs highlights the scale of the potential problem.
The researchers identified 12,976 internet-exposed refrigeration service observations across 99 countries and territories, associated with 6,017 distinct public IP addresses.
The findings included thousands of exposed services associated with Copeland/Dixell XWEB and Danfoss StoreView refrigeration management systems. Many of the identified systems were running older software versions, increasing concerns about the potential for attackers to exploit known weaknesses.
These systems are used to monitor and manage refrigeration equipment remotely, helping operators maintain temperatures across supermarkets, food storage facilities and other temperature-sensitive environments.
However, when management interfaces are accessible from the public internet, attackers may be able to interfere with normal operations, potentially changing temperatures or triggering defrost functions.
The implications extend beyond supermarkets to food processing, logistics, pharmaceuticals and other industries that depend on reliable cold-chain infrastructure.
Experts Warn of Physical and Financial Damage
Dray Agha, Senior Manager, Tactical Response at Huntress, warned that the latest incidents expose weaknesses in connected retail infrastructure.
“This latest wave of attacks on supermarket refrigeration systems across Europe exposes a glaring vulnerability in connected retail infrastructure. Attackers are exploiting unsecured remote access capabilities to switch cooling units into defrost mode and destroy stock.”
He urged retailers to prioritise firmware updates and remove unnecessary internet access to operational systems.
“We will continue to see these destructive attacks until the sector treats its heating and cooling networks as critical security targets.”
The attacks also highlight the difficulties organisations face when securing older Internet of Things (IoT) equipment that must remain operational.
Nathan Davies-Webb, Principal Consultant at Acumen Cyber, said AI could be making it easier for attackers to identify weaknesses in connected devices, while maintenance requirements can leave vulnerabilities unresolved.
Many IoT systems prioritise availability, making it difficult to schedule firmware updates or take equipment offline. Older devices may also lack the processing capability needed to support modern security controls.
Davies-Webb explained that replacing unsupported equipment can be difficult to justify financially when it continues to perform its intended function. However, organisations retaining such devices need additional safeguards, particularly isolation from the internet and other connected systems.
He also highlighted the importance of business continuity planning.
In the case of refrigeration attacks, restoring the system may only be the beginning of recovery. Spoiled stock must be removed, equipment must return to the correct temperature and replacement products must be sourced before normal trading can resume.
“IoT devices are becoming an increasingly popular target for a variety of threat actors and as this example shows how they can be lucrative just for the purposes of causing financial disruption and chaos,” he said.
What Else Could Attackers Target?
Findlay Whitelaw, Field CISO at Exabeam, questioned how many other essential business services rely on remotely accessible equipment that receives limited cybersecurity scrutiny.
“France a few weeks ago, now refrigeration systems across several more European countries. The motive remains unconfirmed, but the consequences are clear: spoiled food, financial losses and disrupted trading.”
He warned that heating, ventilation and building management systems could present similar risks.
“The wider question is how many other essential services depend on remotely accessible equipment that sits outside routine security monitoring.”
Whitelaw said organisations need to understand who can access these systems, recognise when legitimate functions are being misused and establish procedures for safely intervening.
He also acknowledged that patching operational technology can be complicated, particularly where physical modifications or scheduled downtime are required.
“A business may have to live with a vulnerability temporarily, but it still needs a plan to detect and contain its exploitation.”
Legacy Technology Creates a Growing Security Challenge
Iain Davidson, Head of Product Marketing at Wireless Logic, said the attacks demonstrate the consequences of relying on ageing operational technology connected through cellular, wired and Wi-Fi networks.
“A major vulnerability for many businesses is their reliance on ageing operational technology. Many refrigeration units and industrial controllers run outdated firmware that no longer receives regular security updates, yet they are often linked to remote management platforms over cellular, wired or Wi-Fi networks.”
He warned that compromised refrigeration equipment can create problems throughout the supply chain, affecting food safety, product availability and business continuity.
Davidson also argued that network-level monitoring is particularly important where older equipment cannot easily be upgraded.
Security tools capable of identifying unusual communications and blocking connections to malicious infrastructure could help organisations contain attacks without requiring modifications to individual devices.
The challenge is particularly significant for businesses operating large, geographically dispersed fleets of connected equipment.
Retailers Confident Despite Growing Cyber Risks
The latest incidents also raise questions about whether retailers are fully accounting for the financial impact of cyberattacks affecting physical operations.
Figures supplied from Beazley’s Risk & Resilience research suggest that retail businesses remain confident in their ability to withstand cyber incidents, despite growing exposure to technology-related disruption.
According to the research, 87% of retail businesses feel prepared for cyber risk, while 82% believe they could recover financially from an attack.
Yet only 23% identify technology disruption as a leading risk, and just 20% cite technology obsolescence. Meanwhile, 34% plan to increase investment in cybersecurity and resilience.
Beazley’s wider 2026 research also highlights the potential for cyber incidents to disrupt operations long after the initial technical problem has been resolved.
For supermarkets, the cost of an incident can extend beyond replacing damaged equipment or restoring systems. Spoiled inventory, interrupted trading, additional labour, food safety requirements and supply chain disruption can all contribute to the financial impact.
Protecting the Systems That Keep Businesses Running
The second wave of refrigeration incidents has put renewed attention on a category of connected technology that can easily fall between IT security and facilities management.
Unlike conventional cyberattacks involving stolen data or ransomware, interference with refrigeration controls can have immediate physical consequences.
Forescout’s findings suggest that the underlying exposure is international, with thousands of refrigeration management services potentially accessible online.
Security specialists are urging businesses to identify exposed equipment, restrict remote access, apply available firmware updates, monitor unusual activity and ensure that operational technology is included in incident response and business continuity planning.
With further attacks possible, retailers and other organisations dependent on connected infrastructure face growing pressure to understand the security of equipment that has traditionally received less attention than conventional IT systems.
