Supermarkets across eight European countries are strengthening their cybersecurity measures after a second wave of attacks targeted refrigeration systems and manipulated fridge and freezer temperatures, forcing stores to discard large quantities of food. The attacks took place on November 2, 2026, and followed a similar incident that affected dozens of supermarkets in France approximately three weeks earlier. Retailers were working on Tuesday to upgrade their systems, identify potential weaknesses and prevent further unauthorized access to refrigeration equipment. In Sweden, supermarket chain Coop said it was moving its systems to 5G networks and modern modems instead of relying on older 4G connections. The transition had already begun following the earlier incident in France. Seven Coop stores affected by the latest attack have resumed operations, but their refrigeration systems have been disconnected from the internet as a precaution. A company spokesperson said Coop was conducting a detailed review of its entire store network to identify possible vulnerabilities. The repeated attacks have raised concerns about the security of connected refrigeration equipment, particularly systems that can be accessed remotely and are responsible for maintaining safe temperatures for food storage. The incidents also demonstrate how weaknesses in operational technology can disrupt everyday retail activities and create financial losses beyond conventional data breaches.
Software provider Danfoss, whose refrigeration systems were again among those targeted, said it had remained in close contact with customers over the previous three weeks to help them manage the security situation. The company recommended that refrigeration systems should not be directly accessible through the public internet. Cybersecurity expert Frank Groenewegen of Deloitte in The Hague urged retailers to act quickly by checking whether their refrigerator controllers were vulnerable, determining whether they were connected to the internet and ensuring that they had the latest security updates and manufacturer support. He also advised organizations that could not establish the security status of their equipment to remove it from public internet access immediately. Disconnecting vulnerable systems does not resolve the underlying security weakness, but it can prevent attackers from accessing and manipulating them while further checks are conducted. The structure of the European retail sector adds complexity to these efforts, as many supermarkets operate through independent business owners and cooperative arrangements. Consequently, equipment and security configurations can differ between individual stores, even when they belong to the same retail chain. Swedish grocer ICA said all 23 stores affected on Monday had refrigeration equipment connected outside the chain’s centrally managed store network. Store owner Christian Olofsson said the incident was particularly frustrating because he had been in the process of upgrading security systems at his stores in Tomelilla and Sjobo when they were targeted. Swedish police said around 10 complaints had been filed since Monday and expected the number to increase.
German supermarket operator Edeka also confirmed that refrigeration equipment at a store in Reisbach had been affected. The company explained that its network includes independently operated retailers using different refrigeration systems, making it difficult to apply one standard security approach across all locations. Larger integrated retail groups have also experienced repeated attacks. Carrefour, which had 80 franchised stores in France affected during the earlier wave, faced similar activity at 15 stores in Belgium on November 2. The incidents have prompted wider attention from European cybersecurity authorities, with the European Union Agency for Cybersecurity (ENISA) emphasizing the importance of cooperation between member states, rapid information sharing and coordinated responses to large-scale cyber incidents. The agency noted that attacks affecting retail businesses across several countries require organizations and authorities to work together to identify threats and limit their impact. In the United Kingdom, hackers also attempted to target smaller meat-processing businesses, although the impact was described as minimal by Richard Horne, chief executive of the National Cyber Security Centre (NCSC). Horne said the NCSC was working with organizations to identify vulnerabilities and address them before attackers could exploit them. He added that the agency remained on heightened alert as cyber threats against businesses and essential services continued to develop. The targeting of supermarket refrigeration systems has demonstrated that attacks on connected equipment can affect physical operations, supply chains and business continuity without necessarily involving the theft of customer information.
The latest incidents have also raised broader concerns about the security of older technology used across retail and other critical sectors. Horne warned that supermarket refrigeration attacks could be an early indication of more frequent disruptions as outdated systems struggle to keep pace with increasingly capable cyber threats. Many refrigeration controllers and operational technology devices were originally designed to manage physical processes rather than withstand the types of remote cyberattacks faced by connected systems today. When these devices are exposed to the internet without adequate protection, attackers may be able to alter settings and interfere with essential operations. Retailers are therefore being encouraged to review their equipment inventories, identify internet-facing controllers, apply available security updates and restrict remote access to trusted and protected networks. They also need to ensure that independent stores, franchise operators and third-party service providers follow appropriate security practices. The repeated attacks involving Coop, ICA, Edeka and Carrefour show how inconsistent technology arrangements can create challenges when responding to threats across large retail networks. Disconnecting affected systems can provide temporary protection, but a longer-term response requires identifying the weaknesses that allowed unauthorized access and ensuring that equipment remains securely configured. As European authorities and retailers continue investigating the incidents, the attacks underline the need to treat refrigeration infrastructure as an important part of business cybersecurity and operational resilience.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
