Supermarket and grocery refrigeration controls across Europe hit by second wave of cyber attacks

Unidentified attackers defrosted supermarket and grocery refrigeration controls across Europe early Monday, Nov. 2, in a second wave that followed an earlier French incident and reached three British meat suppliers and a British fruit and vegetable wholesaler.

Langridge Organic managing director Alex Pearce said attackers adjusted settings, pushing units above 150C for more than four hours. He said his team took physical steps that stopped any stock from spoiling. He said the attackers had altered a surprising number of parameters after accessing the controllers.

Other British suppliers faced similar failures: one meat supplier saw cold units climb to as high as 100C, and two more suppliers reported that their units started to defrost while empty. No British grocery chain has been directly affected so far, though several companies have confirmed they were hacked. Trade body AIMS said over 300 members were affected as collateral because they used identical software, and Tony Goodger said no meat was lost by any of the affected members.

Britain’s National Cyber Security Centre said on Tuesday it was aware of the refrigeration attacks and was helping affected organizations. The agency issued alerts and spent Monday night contacting organizations with exposed, vulnerable technology. Overnight, NCSC staff contacted companies that had vulnerable systems exposed to the internet.

Paul Chichester, the NCSC director of operations, said the national impact remained minimal so far. He said the attacks were unsophisticated and depended on old vulnerabilities. Richard Horne, the NCSC chief executive, said the damage to an affected business and its employees is enormous.

Alex Pearce said Langridge uses the same Copeland fridge control system connected to the French supermarket incidents. Researchers from Claroty disclosed nearly two dozen flaws in Copeland’s XWEB Pro controllers in August. A security note sent to AIMS members said Copeland XWEB firmware 1.12.1 and earlier contained severe authentication bypass flaws that let hackers take control without a password.

British suppliers were reportedly using vulnerable temperature controllers even though a firmware update had been available since August. French investigators pointed to outdated remote-control modules from Danfoss, a Danish firm, and Copeland, a U.S. firm. Danfoss said most of the affected systems were older products that lack software or security updates. Copeland said it discovered a flaw in discontinued controllers and is recommending software fixes to affected customers.

Refrigeration problems were reported on Monday by stores in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden, with some units reaching 50C (122F). Hackers set fridges and freezers at a Swedish supermarket to 50C (122F), according to the store.

A butcher shop owner in Athens told Greek Skai TV that a refrigeration unit was heated to 150 degrees Celsius (302 Fahrenheit). George Boubas said staff who arrived at 4 a.m. at the Kifisia shop noticed the problem, and a technician needed two hours to get control back. No meat products were affected at that shop, and Boubas said a nearby supermarket and fast-food restaurant experienced the same issue.

Earlier, refrigeration in hundreds of supermarkets and independent stores across France, Belgium and the Netherlands was hit in a previous wave. ANSSI said it has been investigating refrigeration breaches since mid-October and has coordinated protection with all potentially affected sectors. The agency said it knew of compromised controllers in Danfoss’s AK-SM and AK-SC ranges, as well as Copeland and Dixell xweb systems. ANSSI pointed to a security alert first published on Oct. 12 that has received regular updates.

No hacking group has taken responsibility for the attacks, and British authorities also have not linked the incidents to any group. Belgium’s cybersecurity agency said it may never be possible to identify those responsible. Cybersecurity experts said attacks on decoy fridge controls looked like malicious operations tied to Russia. Lupovis chief executive Xavier Bellekens said he recorded 256 attack attempts from 91 sources between Oct. 20 and Oct. 30 against honeypots designed to look like real Danfoss fridge controllers.

A spokesperson for Belgium’s cybersecurity agency said, “it may never be possible to identify” those responsible. Xavier Bellekens, chief executive of Lupovis, said, “While we are not able to pinpoint a group yet.” Nicole Carignan, senior vice president of security and AI strategy at Darktrace, said, “Nobody broke into these refrigeration systems with a zero-day.”

AIMS said the government should give food a stronger position in Britain’s critical national infrastructure designation. Under current law, no individual food sector assets carry a critical designation. The forthcoming Cyber Security and Resilience Bill does not include the food sector. Operators of essential services under the bill must keep security measures up to date or face fines of up to £17 million ($22 million) or 4% of global turnover for serious failures, while NIS2, the European Union’s legislation, covers food production and distribution.

Richard Horne said French refrigerators were connected directly to the internet with default passwords. UK cyber minister Liz Lloyd said the French supermarket attack used known vulnerabilities and that weak passwords continue to endanger organizations. Experts said there is no evidence that AI was used, and the techniques did not require it. Stores in several European countries said fridges and freezers warmed up after a remote takeover, spoiling tons of food worth millions.

Ollie Whitehouse, the NCSC chief technology officer, said he was surprised that such items stayed connected to the internet in 2026 despite years of warnings. The NCSC’s annual report warned that basic cyber protections are missing. Horne said the freezer attacks were just the foothills of the threat described in the agency’s report. He said many vulnerabilities exist and are essentially waiting to be exploited.