The European Supermarket Attacks of 2026 | OT Security | Cyber-Physical Security
There is something unusual about the latest cyberattacks targeting European supermarkets. The attackers were not interested in stealing customer databases, compromising payment systems or encrypting corporate servers. Their target was something far less conspicuous but equally important to business operations: refrigeration controllers.
Imagine a supermarket where everything appears normal. The billing counters are operational, employees are at work, and customers are moving through the aisles. But the refrigeration systems are no longer maintaining their intended temperatures. Somewhere outside the store, someone has remotely manipulated the settings controlling its freezers and refrigerators.
By the time the problem becomes visible, the damage has already started. Frozen products are melting, chilled inventory is warming up, and the store is left dealing with food losses and operational disruption.
This is not a hypothetical attack scenario. It happened in Europe in October and November 2026.
What makes this incident particularly interesting is that the attackers did not need to bring down the enterprise network to disrupt the business. They went after the systems that keep the business running.
When refrigeration became an attack surface
The first major wave of attacks was reported during October 11–12, 2026, affecting hundreds of supermarkets across France. Refrigeration systems were remotely manipulated, causing temperatures to rise and disrupting normal cooling operations.
Before the industry could fully understand the scale of the incident, another wave followed during November 1–2.
This time, the impact extended across several European countries, including Belgium, the Netherlands, Sweden, Ireland, Luxembourg, Estonia and Finland, with additional reports emerging from other European markets.
The consequences were straightforward but expensive. Refrigerators and freezers were reportedly forced into defrost mode or had their temperature settings increased, in some cases reaching approximately 50°C. Retailers were forced to discard spoiled inventory and investigate the security of their refrigeration infrastructure.
The incident also moved beyond supermarkets.
Refrigeration equipment at three French Blood Establishment plasma-storage facilities was reportedly targeted. Monitoring systems detected the activity, allowing staff to protect or transfer stored plasma. Fortunately, no blood products were compromised.
That is where this incident deserves considerably more attention. Refrigeration is not simply a retail convenience. It supports food safety, pharmaceutical storage, healthcare operations and several temperature-sensitive supply chains.
A compromised refrigeration controller can therefore create consequences that extend well beyond the organization operating it.
The technology behind the disruption
Commercial refrigeration systems are considerably more sophisticated than the appliances we use at home.
A large supermarket operates multiple refrigeration units, compressors, sensors and freezers. Managing each component independently would be operationally inefficient. Manufacturers therefore provide supervisory platforms that allow facility operators and maintenance providers to monitor and manage refrigeration infrastructure centrally.
Two product families have featured prominently in the French cybersecurity agency CERT-FR’s investigation and advisory:
- Danfoss AK-SM and AK-SC series.
- Copeland and Dixell XWEB supervisory systems.
These platforms provide temperature monitoring, compressor management, defrost scheduling, configuration and remote maintenance capabilities.
The convenience is obvious. An engineer can troubleshoot refrigeration equipment without travelling to every store.
But convenience introduces another security boundary.
When these supervisory interfaces are exposed directly to the internet, the same management functionality intended for authorized engineers becomes accessible to potential attackers.
CERT-FR published its security alert CERTFR-2026-ALE-012 on October 12, subsequently updating it on October 16. The advisory identified compromises involving these refrigeration controller families and specifically warned against exposing their management interfaces directly to the internet.
The problem is not necessarily the technology itself. It is how these systems are deployed, configured, maintained and connected.
The attack did not need ransomware
One of the most interesting aspects of this incident is the nature of the disruption.
We are accustomed to associating cyberattacks with ransomware, data theft, privilege escalation and malware execution. Here, the operational impact came from manipulating the functionality that the equipment was designed to provide.
An attacker who gains unauthorized access to a refrigeration supervisory system can potentially misuse legitimate control functions.
A temperature setpoint can be changed. A defrost schedule can be manipulated. A cooling operation can be disrupted.
The system may continue accepting commands and reporting its status, but it is no longer operating as intended.
This is a different kind of cyberattack. The objective is not necessarily to compromise the confidentiality of information. It is to interfere with the integrity and availability of a physical process.
The precise initial access mechanism has not been conclusively established across every affected organization. Internet exposure, insecure configurations and weak authentication are important concerns identified in the official guidance. However, they should not be treated as a confirmed, identical exploitation chain for every incident.
That distinction matters when discussing the technical details of an incident.
The exposure was much bigger than the affected stores
Following the first wave, security researchers began examining how many similar refrigeration controllers were visible across the internet.
Censys reported that the number of internet-exposed systems belonging to the two affected product families declined from 6,695 on October 9 to 3,124 on November 5.
That is a reduction of approximately 53%.
The decline is encouraging, but it should not be mistaken for proof that every exposed system was patched. Some organizations may simply have disconnected their equipment from public internet access.
The bigger concern is the number of operational systems that were discoverable in the first place.
Think about the typical enterprise asset inventory. Servers, endpoints, network devices, cloud workloads and applications are generally tracked through established asset management and security processes.
But what about refrigeration controllers? What about HVAC systems, building management platforms and other connected equipment maintained by external service providers?
These assets may not always be part of the conventional IT inventory. They may sit under facilities management, engineering or third-party maintenance contracts.
This creates a familiar problem in a different form: the organization cannot protect what it does not know it has.
The blindspot between IT and OT
This incident brings an important weakness in enterprise security governance into focus.
IT and OT environments have traditionally evolved with different priorities. IT focuses heavily on confidentiality, integrity and availability. OT places significant emphasis on safety, availability and continuous operation.
That difference has often resulted in different ownership models, maintenance practices and security controls.
In a supermarket, the IT team may manage the corporate network while refrigeration equipment is maintained by a specialist contractor. Remote access may be provided through a separate connection, and the security team may have limited visibility into the controller itself.
Now consider an attacker accessing that controller through an exposed management interface.
The corporate SOC may not see a suspicious endpoint, malware execution or unusual database activity. The refrigeration controller may simply accept a configuration change.
But the business impact is already developing.
This is where conventional security monitoring needs to expand. Monitoring network traffic and authentication events is not enough when the ultimate target is a physical process.
Security teams need visibility into operational changes as well.
An unexpected temperature adjustment, an unusual defrost schedule, repeated configuration changes or remote access outside approved maintenance windows should receive attention.
The question is no longer just whether someone accessed the system. It is whether the changes made to the system were authorized and operationally justified.
What should organizations be looking at?
The immediate lesson is not to disconnect every connected device and hope the problem disappears. It is to understand the exposure and establish proper control over the operational environment.
Internet-facing refrigeration controllers should be identified and removed from direct public exposure. Remote maintenance should take place through protected networks or secure VPN connections, with access restricted to authorized personnel.
Default credentials must be replaced, supported firmware should be updated, and end-of-life equipment requires particular attention.
CERT-FR also makes an important point about recovery. A factory reset alone is not sufficient if the underlying equipment remains vulnerable and internet-accessible. The system may simply be compromised again.
Organizations should review the complete configuration, including temperature settings and defrost schedules, and validate the equipment before restoring normal operations.
There is another aspect that deserves equal attention: independent monitoring.
The controller should not be the only source of information about the physical condition it manages. Independent temperature alarms, operational checks and documented recovery procedures can help identify abnormal conditions before they become irreversible business losses.
For security leaders, this is an asset management, third-party risk and business continuity problem as much as it is a vulnerability management problem.
The CISO perspective: Are we securing the systems that run the business?
There is a tendency to measure cybersecurity maturity through the number of protected endpoints, vulnerabilities remediated, security incidents detected and controls implemented.
But those measurements tell only part of the story.
A business can have a mature endpoint security program, a well-monitored cloud environment and an established vulnerability management process while leaving connected operational equipment outside its security governance.
That is precisely the kind of gap these attacks expose.
The CISO needs to ask whether refrigeration controllers, HVAC infrastructure, industrial equipment and building management systems are included in the organization’s attack surface inventory.
Who owns remote access? Are third-party maintenance connections governed by the same identity and access management principles? Are operational configuration changes monitored? Are unsupported devices identified? Can the business continue operating safely when a connected control system is compromised?
These questions should not wait until an incident occurs.
The bigger challenge is bringing IT, OT, facilities management and third-party service providers under a common security governance model without disrupting the operational requirements of the business.
Beyond refrigeration: The next physical-world attack surface
Replace the supermarket refrigerator with a pharmaceutical cold-storage facility, a hospital HVAC system, an industrial boiler, a water treatment controller or a manufacturing temperature-control system.
The underlying risk remains the same.
A digital command can create a physical consequence.
The European refrigeration attacks are a useful reminder that connected operational infrastructure is no longer isolated from the cyber threat landscape. Systems that were originally deployed for convenience and remote maintenance have become part of the enterprise attack surface.
We have spent years improving visibility across endpoints, networks, identities and cloud workloads. The same discipline needs to extend into the operational systems that businesses depend on.
This is not about turning every facilities engineer into a cybersecurity specialist. It is about ensuring that operational technology receives the same level of asset visibility, access governance and risk management that we expect from conventional IT infrastructure.
Final thoughts
The most interesting part of this incident is also the most uncomfortable.
The attackers did not necessarily need to steal anything. They did not need to encrypt anything. They needed access to a system that could influence the physical environment, and the consequences followed.
A refrigerator may not look like a traditional cybersecurity asset. But when it is connected to a remote management platform, it becomes part of the organization’s digital attack surface.
The next major business disruption may not begin with a compromised server or a ransomware alert. It could begin with an unauthorized change to a temperature setting, a cooling schedule or an industrial control parameter.
We have become better at protecting the information that businesses hold. The next challenge is protecting the systems that keep those businesses operational.
We secured the enterprise network. But did we secure the systems controlling the enterprise itself?
That is the question this incident leaves behind.
