Attacks on refrigeration systems hit supermarkets in nine European countries, resulting in tons of spoiled food.
What You Need to Know
- Nine countries affected: hackers targeted refrigeration systems at supermarkets and butcher shops across nine European countries. There is no evidence that artificial intelligence was used, and those responsible remain unknown.
- Extreme temperatures: in Sweden, refrigerators and freezers were remotely set to 50 °C (122 °F). In Greece, intruders attempted to raise the temperature of a butcher shop’s equipment to 150 °C (302 °F).
- Basic security flaws: no sophisticated technology was involved. The attackers exploited internet-connected controllers, outdated software, and default passwords.
Imagine opening your store at 4 a.m. and finding the freezer set to 302 °F (150 °C). That’s what happened to a butcher in Athens. In Sweden, a supermarket’s refrigeration equipment was also set to 122 °F (50 °C). On Monday, November 2, stores in Belgium, Luxembourg, Ireland, Italy, and Estonia reported problems too.
The result: tons of spoiled food and millions in losses.
It Wasn’t Sophisticated, and That’s the Problem
The incident follows an attack weeks earlier that hit hundreds of stores in France, Belgium, and the Netherlands. French investigators traced it to compromised remote refrigeration control modules made by Denmark’s Danfoss and America’s Copeland.
France’s cybersecurity agency, ANSSI, named the AK-SM and AK-SC controllers (Danfoss) and the xweb systems (Copeland and Dixell). Danfoss said most of the affected units are older devices that no longer receive updates. Copeland said it identified a vulnerability in discontinued controllers.
According to the Associated Press (AP), Nicole Carignan of Darktrace said the attackers did not exploit a zero-day vulnerability, meaning a flaw the manufacturer hadn’t yet patched when it was exploited. Instead, the attackers got in through:
- Controllers connected directly to the internet
- Outdated firmware
- Factory-default passwords that no one changed
Richard Horne of the UK’s National Cyber Security Centre (NCSC) confirmed that the French refrigeration units were “connected directly to the internet with default passwords.”
Why Is a Refrigerator Online?
The answer is economic. According to Katerina Mitrokotsa of the University of St. Gallen, retail chains monitor temperatures 24/7 across hundreds of stores. Connected systems also send alerts before food spoils, cut energy use, and let technicians fix problems remotely.
The downside: every connected device becomes an entry point into the network. “A refrigerator doesn’t look like a security risk, and that’s exactly why attackers like it,” Mitrokotsa says.
Carignan adds that companies are investing heavily in AI and digital transformation. Meanwhile, the systems that keep “food cold, drinking water clean, and the lights on” often run on hardware that hasn’t seen an upgrade since installation.
AI? Not This Time
The attacks come amid growing concerns over AI systems allegedly breaching organizations without human oversight. Even so, experts say there is no evidence AI was involved. “The techniques didn’t require it,” Carignan said. Paul Chichester of the NCSC said the attack “exploited vulnerabilities that have existed for a long time.”
No Culprit and No Motive Yet
No one knows who is behind the attacks, or why. ANSSI has been investigating since mid-October and maintains an alert, published October 12, that is updated frequently. Italy called cybersecurity and intelligence meetings, and the European Commission did the same. Spokesperson Thomas Regnier said the incidents “are not isolated” and that Europe must be “collectively resilient.”
In Athens, one response was to turn off Wi-Fi on the refrigeration units. Even so, it took a technician two hours to regain control of the equipment.
Sources and References
- Skai News: Hackers target commercial refrigerators in Greece
- Associated Press (AP News): Supermarkets across Europe hit by cyberattack on refrigerators
- The Washington Post: France supermarkets hacked and cybercrime investigation
- CERT-FR (ANSSI): Official Security Alert (CERTFR-2026-ALE-012)
- Reuters: UK cybersecurity warnings and critical infrastructure reports