Suspected cyber attacks flipped supermarket freezers to defrost across Europe

Suspected cyber attacks flipped digitally connected supermarket freezers from freeze to defrost across a swath of Europe running from Finland to Ireland on Monday, driving many units to 50 degrees Celsius and spoiling the food inside.

Latin Times and Deseret News reported that one of several ICA stores hit was a Kvantum in Sjobo, and that refrigerator and freezer temperatures there were set to 122 degrees Fahrenheit, or 50 degrees Celsius. Coop said six of its roughly 800 stores had to discard food, while other reporting counted seven of 800 Coop stores affected by tampering with refrigeration controls; both counts trace to Coop through different outlets. Coop named Danfoss among its suppliers. Ahold Delhaize and Colruyt called the spike in refrigerator temperatures across dozens of stores an IT incident.

Musgrave said 13 of its 223 SuperValu stores were affected, and it removed chilled and frozen products from shelves. Deseret News reported similar occurrences in Ireland, Finland and Estonia. Danfoss said refrigeration systems at least 17 businesses in the Netherlands were hit, mainly butcher shops and small independent grocery stores, while major Dutch supermarket chains reported no impact.

Estimates put overall losses at tens of millions of euros, and millions of euros worth of food was discarded. Individual store losses in France ran from tens of thousands of euros to more than 130,000 euros.

A confirmed attack on French supermarkets swept approximately 700 locations overnight between Oct. 11 and Oct. 12, 2026, hitting Intermarché, Coopérative U, E.Leclerc and Monoprix, while Carrefour said 15 of more than 700 of its stores were affected and called the impact limited. Several French stores caught fire, food losses reached industrial scale, and damages reached tens of millions of euros in a single night.

The perpetrators of the attacks are not known for certain, and the Monday incidents remain classified as suspected rather than confirmed cyber attacks. The Guardian reported that Russian hacktivists claimed credit for some supermarket sabotage and listed Iran, Iranian proxies, North Korea and unaffiliated bedroom hackers as possible, unconfirmed perpetrators. Deseret News reporting says that no group or individual has claimed responsibility. Belgium’s Centre for Cybersecurity said it may never be possible to identify those responsible.

Gerome Billois of Wavestone said the most likely scenario was a destabilization attack intended to make populations feel unsafe and instill fear. Saboteurs aim to disrupt, to spread fear and to destabilize target societies psychologically.

A military commissary refrigeration incident is under investigation by the Pentagon as a possible cyber attack, and the Pentagon is leading a joint probe alongside French investigators, with the Defense Criminal Investigative Service taking the lead. The Pentagon said a Cyber Command unit is coordinating closely with interagency and law enforcement partners. Freezer failures hit more than a half-dozen subsidized grocery outlets on U.S. military bases in late August, spoiling food and briefly preventing sales, and Fort Huachuca in Arizona reported no power outage although its freezers went into defrost mode. If the connection is confirmed, the American bases may have been an early target instead of a copycat case.

Hackers disabled alarm systems before taking control of refrigerator thermostats, according to initial French investigations, and stores only discovered the issue the next morning, when staff arrived for work. Attackers accessed refrigeration controllers remotely and forced evaporators — the part of the unit that absorbs heat — into a sustained defrost cycle that first thawed and then cooked the food. Sabcobel CEO Stephan Moelans confirmed that attackers deliberately put evaporators into forced defrost mode. Kitman Coldtech told ERR that a client’s system was accessed by an attacker who raised temperatures to 50C on older Danfoss models, and France’s cyber agency said two refrigeration management product lines were involved.

Claroty researchers disclosed critical vulnerabilities affecting the Danfoss AK-SM 800A and the Copeland XWEB Pro on Aug. 9, 2026, and a hidden authentication bypass mechanism allowed attackers without credentials to seize remote control of the units. Danfoss released firmware version R4.3.1, and Copeland released firmware 1.13, yet many operators did not apply them. Older discontinued models were among the compromised units: Danfoss AK-SM 800, which reached end-of-life in 2021, and AK-SC355, retired in 2016. Censys found more than 1,000 StoreView management interfaces from Danfoss exposed to the public internet worldwide, with France, Belgium, the Netherlands and Sweden showing the most exposure.

Belgian federal prosecutors opened a formal criminal investigation after the November incidents, and ANSSI led the French investigation, securing a judicial inquiry and sharing intelligence with European counterparts since the October attack. National cybersecurity agencies across affected countries are actively coordinating their response. Security professionals urged retailers to audit operational technology devices — the computers and sensors that run physical equipment — isolate refrigeration systems from the public internet, and replace unpatched end-of-life controllers. Shared remote access credentials from third-party maintenance contractors are an added risk vector under scrutiny, and the twin attacks have pushed European policymakers to speed up discussions on required cybersecurity standards for food supply infrastructure.

Grey zone aggression, or hybrid warfare, means hostile acts by adversaries that stop short of full military conflict. The same week saw related disruption: attacks targeted fridges at French blood banks, and hoax bomb threats forced airliners across Europe to divert, land in emergencies or fly under fighter jet escort. The UK government’s Be Ready campaign on emergency stockpiling launched last month.