Cyberattacks on supermarket refrigeration: what they mean for your business
In brief
- In October and November 2026 attackers remotely switched the refrigeration in hundreds of European supermarkets into defrost mode. Food warmed up overnight and ended up in the bin.
- The attack did not trigger alarms and nobody was in the stores at night. Relying only on the alarm of the refrigeration controller itself is not enough.
- Protection has two parts: secure access to the refrigeration controls and run independent temperature monitoring with its own phone alarm.
In October and November 2026 something happened in Europe that a year ago would have sounded like a film plot. Attackers remotely took over the refrigeration controls in supermarkets and switched them so that fridges and freezers started to heat up. It happened at night, when nobody was in the stores. By morning large stocks of food were in the bin. For every business that stores chilled goods the lesson is simple: the system that controls the refrigeration should not be the only thing watching it.
The short answer
The attackers took over refrigeration controllers that were reachable from the internet and switched the cooling equipment into defrost mode. The attack did not trigger alarms. Protection has two parts. The first is securing access to the refrigeration controls. The second is independent temperature monitoring with its own phone alarm that does not depend on the refrigeration controls in any way.
What happened
On the night of 11 October 2026 attackers hit hundreds of supermarkets in France, among them Intermarché, Netto, Carrefour, Coopérative U and Monoprix stores. They switched the cooling equipment into defrost mode and in many stores the temperature climbed as high as 50 °C after six hours. The stores had to throw away large amounts of food.
A second wave followed on 2 November 2026. It hit stores in Belgium, the Netherlands, Luxembourg, Ireland, Sweden, Estonia, Finland and, according to some reports, other countries as well. Carrefour Belgium reported 15 affected stores out of 700, SuperValu in Ireland 13 stores and Coop in Sweden 7. In one Swedish store the attackers set the refrigeration to 50 °C. The Danish controls manufacturer Danfoss said 17 facilities using its equipment were affected. Nobody has claimed responsibility so far.
Why nobody noticed in time
According to the available reports the attack in France did not trigger any alarms and nobody was in the stores at night to step in. The problem is that the temperature alarm is often evaluated by the same controller that runs the refrigeration. Once an attacker controls it, its alarm cannot be relied on.
How did the attackers get in? The controllers were connected to the internet and some older models had been out of manufacturer support for years. According to security researchers some of them accepted the username "admin" with the current date as the password. The manufacturer fixed the flaw in August, but according to experts thousands of units never received the update.
Does this affect a small business too?
The attacks targeted large chains. But refrigeration controls with remote access for the service company are no longer just a chain-store thing. You will find them in smaller shops, butchers, food production sites and cold stores too. And even without an attacker, a refrigeration failure at night ends the same way: a warm cabinet in the morning and food for the bin. We described what such a night looks like in our article on refrigeration failures at night.
Five steps you can take right now
- Ask your refrigeration service company whether your refrigeration controls are reachable from the internet and who has remote access.
- Change default passwords and have updates installed. Old units that the manufacturer no longer supports should not be connected to the internet.
- Separate the refrigeration controls from the rest of your network, especially from guest Wi-Fi and the tills.
- Run independent temperature monitoring with its own probes and its own phone alarm.
- Agree who responds to an alarm at night and where the goods go if they have to be moved.
Why independent monitoring
Independent monitoring controls nothing. It has its own probes, its own gateway and its own alarms, and it only measures and reports. When the refrigeration stops cooling, whether because of an attack, a fault or a door left open, the alert reaches your phone and inbox as soon as the temperature crosses the limit. It will not stop an attack, but you find out at night instead of in the morning and still have time to save the goods.
The temperature record also serves as evidence. It shows exactly when the temperature started to rise and how long it stayed out of range. That helps when deciding which goods can still be sold, when dealing with the insurer and during inspections.
How TempeStorm handles it
TempeStorm is independent temperature monitoring for food service, shops, production and warehouses. Every measuring point gets a probe with a calibration certificate from an accredited laboratory, alarms go to your phone and by e-mail and HACCP records are created automatically. Installation does not touch your equipment and does not interfere with the refrigeration controls in any way. The gateway can run on your internet connection or completely independently with our SIM, outside your site network. You can work out what it would cost for your number of measuring points in the price configurator.
Sources: Wikipedia, ABC News (AP), CNBC, TA3. Status as of 5 November 2026.
Časté otázky
Let us do the measuring and record-keeping
Probes with accredited calibration certificates, a gateway, automatic HACCP records and phone alerts. Installed in a single day.