Supermarket Fridges Hit 50°C: What the European Cold-Chain Cyberattacks Mean for Your Business

On the night of 11 October 2026, attackers reached the refrigeration controllers of hundreds of French supermarkets and pushed fridge and freezer temperatures as high as 50°C. Managers arrived on Monday morning to spoiled stock and, in some stores, equipment that had melted or caught fire. Retailers reported millions of euros of lost food.

It was not a one-off. On 2 November, supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia reported the same kind of failure, and more than 100 shops were affected in a single day. No group has claimed responsibility, and police in France and Belgium are investigating.

If you run a supermarket, a restaurant group, a food plant or a cold store, the lesson is not about France. It is that your refrigeration is now an IT system, and it can be attacked like one. This post covers what happened, what experts say made it possible, and six checks you can make this week. It also explains where a monitoring service like simpliSOC helps, and where it does not.

What happened

• France, 11-12 October. Reports put the number of affected shops above 500, across Intermarché and Netto, Coopérative U, Carrefour, Monoprix and others. Attackers forced the units into a defrost state overnight while the shops were closed.
• Europe, 2 November. Fridges and freezers at more than 100 shops overheated. A Swedish store reported its units set to 50°C, and Carrefour said 15 of its more than 700 Belgian stores were affected.
• Earlier warning signs. Reports say freezers at a US Army base market and a naval station failed in August, and that the Pentagon suspected a hack.

France’s cybersecurity agency reportedly said the affected systems were made by Danish manufacturer Danfoss, and Danfoss said most of the affected units were older legacy products with outdated firmware that customers had been told to update. The agency’s advice was to disconnect such units from the internet or restrict access, and to install updates.

What experts say made it possible

Officials have not said exactly how the attackers got in, so treat any single explanation with care. Experts quoted in the coverage describe a familiar pattern:

• Store cold aisles are managed by control panels that can be reached over the internet, so maintenance companies can adjust them from anywhere.
• Many units are managed by third parties and have missed software updates.
• Some controllers have documented vulnerabilities and are past end of life.
• Passwords were described as easy to guess.

None of these is exotic. They are the same gaps that appear in office networks, applied to equipment that nobody thinks of as a computer.

Six checks for this week

1. List every remotely managed cooling system. Fridges, freezers, cold rooms, chillers, and the controllers and gateways that run them. Include the ones your vendor installed and you never see.
2. Find out what is reachable from the internet. Ask your vendor in writing whether any controller has a public address, and have your network team scan your own ranges.
3. Review vendor remote access. Who can log in, through which route, with what authentication? Prefer a VPN with multi-factor sign-in over a port open to the internet, and remove accounts for people who no longer work with you.
4. Fix defaults and end-of-life firmware. Replace default or shared passwords. Ask for the firmware version of each controller and whether the vendor still supports it.
5. Add a temperature alarm that does not depend on the controller. A separate sensor with its own alert (SMS or LINE) tells you about a temperature rise even if the controller is being manipulated.
6. Write a one-page runbook. Who is called at 2 a.m., how to switch to manual control, where to move stock, and who decides when food is discarded.

Where monitoring helps, and where it does not

Most of the checks above are configuration work. Monitoring comes in after that, so you can see an attack in progress instead of discovering it in the morning.

simpliSOC is a Wazuh-based monitoring stack. It ingests firewall, VPN, server and endpoint logs, applies more than 50 custom detection rules, and raises an alert when a log source goes silent. That fits the vendor-access part of this story well: who logged in through the VPN, from where, and at what time, with an alert when something looks wrong.

Be clear about the limits. The simpliSOC page does not describe OT or IoT support, and refrigeration controllers rarely run a monitoring agent. Collecting their logs or temperature readings is something we would scope for your site, not a built-in feature. And a monitoring stack reduces the time to notice; it is not a guarantee against any specific attack.

Talk to us

Tell us how your cold storage is managed and who has remote access. We will tell you what we would monitor and what needs fixing first. A short scoping call is enough to start.

• Email: hello@simplico.net
• LINE: iiitum1984
• Phone: (+66) 97496 6397

For network design and integration questions beyond monitoring, see our system design and consulting service.

FAQ

We use a different refrigeration vendor. Are we safe?
Not necessarily. The reported pattern, internet-reachable controllers, third-party remote access and old firmware, is not specific to one brand. Run the six checks regardless of vendor.

Should we cut off all remote access?
Not automatically. Remote management is useful, and France’s agency advised disconnecting affected units or restricting access. A sensible middle path is to remove public exposure, route access through a VPN with multi-factor sign-in, and log every session.

Is a SOC the same as a temperature alarm?
No. A temperature alarm tells you the result. A SOC watches the access and network activity that can cause it. You want both, and the alarm should be independent of the controller.

Do we know who was behind it?
No. No group has claimed responsibility and officials have not published an attribution, so be wary of anyone who sounds certain.

Sources

• Freezers at supermarkets in several European countries hit by apparent cyberattacks, ABC News / AP, 2 Nov 2026
• Very cold war: Who’s attacking Europe’s supermarket freezers?, Al Jazeera, 3 Nov 2026
• French fridge fright: Why supermarkets have become target for hackers, Al Jazeera, 13 Oct 2026