Hacks on refrigerators in Europe, likely due to an old vulnerability being exploited, caused an estimated millions of euros in losses in food spoilage.
This month, cyberattacks on refrigerator systems across Europe have resulted in food spoiling and being thrown out in grocery stores in several countries. Supermarkets in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden experienced disruptions to their refrigeration systems on November 1st. In some of these cases, the hackers turned the refrigeration temperature up to 50°C (122°F), leaving the food items unsalvageable.
This series of hacks is reminiscent of another rash of fridge-related cyberattacks in France that happened on October 12th. There, attacks on grocery titans like Carrefour, Coopérative U, Intermarché, Monoprix, among other food retailers in the country, led to other temperature spikes of up to 50°C (122°F) that not just spoiled food, but even started fires in some cases. The incident caused significant financial damages - two stores disclosed €270,000 ($303821.55) in losses, which could mean millions of euros lost across the country. The reason for the intrusion, at least in some cases, was traced to refrigeration controllers made by Danfoss, a Danish company that produces technology for better machine productivity and energy use. The company said that the stores that experienced hacks were using outdated firmware, possibly allowing exploitation through vulnerabilities that received patches over a year ago.
Claroty and other security experts confirmed that a hack to change the temperatures could be very easily managed. Kevin Beaumont, a cybersecurity expert, explained the situation on cyberplace.social: “Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing. The username is admin and the password changes every day automatically to.. the current date. Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.” Beaumont asserted that while the impact of the hack has caused some initially to suspect agentic artificial intelligence as the cause, the true reason was much simpler: “It’s a complete lack of security controls and negligent product development by the vendor.”
In the France attacks, there were an estimated 400 stores (out of a total 15,000) that were affected, leading to rebuke from EU officials and supermarket leadership. Christophe Hansen, the European Commissioner for Agriculture and Food shared his thoughts in a post on X: “I strongly condemn the cyberattack targeting food products at @intermarche @CooperativeU @Leclerc. Food security requires more attention at all levels. Because the weaponization of food has become a reality.” Dominique Schelcher, the CEO of Coopérative U, shared that their teams were working to investigate and recover from the attack, while condemning the hacks on LinkedIn: “Attacking equipment that is essential to the preservation of fresh products and the food supply of the French is extremely serious and unprecedented. This is unacceptable.”
The more recent hacks, reported on November 2nd, have also sparked investigations across the continent. In Italy, potential victims of this type of attack (industrial refrigeration businesses, large retailers, and food logistics operators) were warned by the National Cybersecurity Agency about the incidents. The agency is working with the postal police to investigate the event with the agency director planning to meet with the leaders of other intelligence agencies to address the danger. Belgium has also initiated an examination of the case, even with the Carrefour Belgium spokesman, Mich Vergauwen, saying that the “impact is very limited”, with 15 of their 700 shops being affected. Even the US Army has been looking into the attacks - but their history with the attacks precede the French cyber intrusions.
On August 26th, freezers in Arizona’s Fort Huachuca malfunctioned, suddenly going to defrost mode and spoiling the food that was stored. Another military base, Rhode Island’s Naval Station Newport, also disclosed “refrigeration system issues at the commissary” on the same day. In an exclusive article with Reuters, officials in the Pentagon confirmed that the Cyber Field Office was examining the August disruptions, and collaborating with the French to understand the potential attacks. Like the attacks in France, and now across the rest of Europe the temperatures in the refrigeration units were also increased to ‘defrost’ the food, leading to spoilage. The article, released on October 29th, 2026, was the first time that the American incidents were publicly being looked at as suspected hacks.
Part of the difficulty around the investigation is likely due to the fact that no organizations have claimed responsibility for the attacks. There haven’t been any requests for payment, as one would expect for a case of ransomware. While Christophe Hansen called the attacks “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”, no nation-state or politically aligned group has been linked to what could be hacktivism. The senior director for threat intelligence at the cybersecurity company Sophos, Rafe Pilling, weighed in on the possible culprits: “The two most plausible attribution scenarios for me are some kind of state-based signalling and demonstration of capability or some kind of lone-wolf hacker that is conducting these attacks for their own personal reasons”.
The crime’s lack of complexity means that there are less clues to examine, making the work around the case even harder. Piling compared the hack to “wearing rubber gloves and messing with the switches”. Kevin Beaumont also emphasized the simplicity of the intrusions and called the French hack a “zero-skill thing to pull off”, even suggesting that the person behind the intrusion is “likely a bored teen in their underpants in between Roblox sessions.”
Though it’s still unclear which cybercriminal(s) can be held accountable for the estimated millions of euros lost to food waste and cooling unit damage, retailers are not completely helpless to protect against more intrusions. Claroty CTO, Amir Preminger, recommended that companies address the risk that comes with network connected remote controllers: "While this convenience significantly reduces maintenance costs by allowing engineers to troubleshoot issues remotely, it also lowers the barrier to entry for attackers. Organizations must take proactive measures to ensure that management interfaces are not insecurely connected to the internet, and ensure that access to administrative services is restricted to trusted management networks or secured through VPNs and other appropriate network segmentation controls."
The easiest way to prevent similar attacks appears to be patching software systems and keeping network security measures up to date. Reportedly, Sabcobel (a refrigeration company in Belgium) limited the scope of the November hacks by patching fridge networks after the first round of cyberattacks in October. Bitdefender cyber-operations director, Nick Jackson, attributed the lack of updated software to the inconvenience of having to take machinery offline (potentially getting in the way of operations for supermarkets), and the fact that people in charge of the fridges may not recognize the risks, as they “don’t think about that and it’s not top of their agenda.” It’s hard to imagine that this will continue to be the case, as the story has been covered by many publications and the bad actors remain at large. Hopefully, these conversations will inspire better cybersecurity posture across the food and beverage industry.