Μake us preferred on Google A supermarket’s refrigeration system can become a target for hackers even when its digital operations appear secure. Recent cyberattacks across Europe have shown that remotely changing the settings of commercial refrigerators and freezers can destroy large quantities of food within hours, potentially causing losses worth millions of euros.
The risk has prompted Greece’s National Cybersecurity Authority to contact supermarket chains, warning them about exposed refrigeration systems and urging them to strengthen their defenses. The authority identified more than 300 commercial refrigeration systems that were accessible from the internet and called on members of the Hellenic Supermarkets Association to take immediate protective measures.
These include disconnecting refrigeration controls from the public internet, requiring virtual private networks (VPNs) and multifactor authentication for remote access, changing default passwords and installing software updates. Equipment that is no longer supported should be replaced.
Cybersecurity company CyberPax has also briefed Greek retailers on the threat, highlighting the need to review not only digital security but also maintenance arrangements, insurance policies and procedures for protecting food stocks.
Six questions supermarket chains need to answer
For supermarket management, the threat raises practical questions about investment, maintenance contracts and insurance coverage. A refrigerator may still be working normally even though its digital controller is outdated and no longer receives security updates. Retailers therefore need an inventory of their equipment, including models, software versions and support expiration dates, to plan replacements.
CyberPax also warns that outsourcing maintenance does not remove a supermarket chain’s responsibility for its equipment. Retailers need to know who can access refrigeration systems remotely, what credentials they use and what permissions they have.
The company recommends keeping a record of every remote connection and revoking access granted to former contractors. Contracts should clearly specify who is responsible for installing updates, monitoring systems and terminating remote connections.
Insurance is another concern. CyberPax advises retailers not to assume that their policies cover cyberattacks targeting physical equipment or the resulting loss of stock. It recommends obtaining written confirmation from insurance brokers and checking for exclusions involving exposed or outdated equipment.
The company urges supermarket executives, particularly those responsible for information technology and maintenance, to answer six questions:
- Which refrigeration controllers do we use, what software versions are installed, and how many are no longer supported?
- Who has remote access — external contractors, installers or manufacturers — what credentials do they use, and when were those credentials last reviewed?
- Are the control consoles accessible from the internet?
- If someone changes a temperature setting at 12:30 a.m., who will notice within the next hour? Are temperature alarms independent of the controller that could be compromised?
- Who is authorized to switch the system to manual operation or disable remote access during the night without having to seek further approval?
- Does our insurance cover cyberattacks against physical equipment and the resulting loss of inventory?
What happens when stores are closed?
The risk is particularly serious outside normal business hours. If someone changes a refrigeration setting overnight, retailers must know who will receive an alert and who has the authority to intervene.
CyberPax recommends installing independent temperature sensors so that alarms do not rely exclusively on the refrigeration controller, which may itself have been compromised.
The company also advises supermarket managers to check and record refrigerator and cold-storage temperatures when stores open. Products should not be returned to sale after a temperature deviation without first being inspected.
A series of attacks across Europe and the United States
According to CyberPax, the incident in France was not an isolated event but the second in a series of three attacks.
The first reported incident occurred in late August, when freezers at food stores serving U.S. military bases malfunctioned overnight. On October 29, Reuters reported that the Pentagon was treating the incidents as a suspected cyberattack. Freezers at at least seven bases had switched to defrost mode during the night. U.S. Cyber Command became involved, while U.S. Army investigators began working with French police.
The second attack struck France on the night of October 11–12, 2026. Unknown perpetrators reportedly gained remote access to refrigeration controllers at approximately 700 supermarkets, according to figures provided by France’s finance minister to Parliament on October 13. They forced the systems into defrost mode and raised the target temperature to 50 degrees Celsius (122 degrees Fahrenheit). By morning, fresh and frozen food stocks had been discarded.
The affected chains included Intermarché and Netto, with estimates ranging from 180 to 300 stores; Coopérative U, with 80 stores; Carrefour, with 80; Monoprix, with approximately 30; and several Leclerc locations. Independent grocery stores and butcher shops using the same controllers were also reportedly affected.
Thierry Cotillard, president of the Mousquetaires group, which operates Intermarché, said the damage across France amounted to tens of millions of euros in a single morning. One Leclerc store in Alsace reportedly suffered losses of €220,000.
The third incident was reported on November 2, at around 2 a.m., when refrigeration systems at supermarkets in Belgium, Luxembourg, Sweden, Denmark and Ireland were allegedly set to 50 degrees Celsius (122 degrees Fahrenheit).
The affected businesses included 15 of Carrefour Belgium’s 700 stores, five Colruyt/Spar locations, Delhaize, one IKEA store, seven of Coop Sweden’s 800 stores, ICA in Stockholm and 13 of SuperValu Ireland’s 223 stores.
A Belgian butcher also found his cold-storage room at 18 degrees Celsius, with meat worth €15,000 spoiled. The systems involved used Danfoss controllers. The company said it was working with customers to implement fixes, while Belgian prosecutors opened a criminal investigation.
How ordinary defrost settings were turned into a weapon
CyberPax says the attacks did not involve data theft, encryption or demands for ransom. Instead, the perpetrators exploited a normal refrigeration function: the daily defrost cycle, which typically lasts about two hours.
The attackers allegedly extended the cycles from one hour to eight and raised the target temperature to 50 degrees Celsius. This also delayed the activation of temperature alarms, according to French newspaper Le Monde. One store in Normandy reportedly recorded a temperature of 80 degrees Celsius (176 degrees Fahrenheit), with equipment melted by the heat.
French prosecutors are also investigating reports of fires.
The equipment identified in connection with the attacks includes Danfoss commercial refrigeration controllers AK-SM 800 and AK-SC 355, which have been out of support since 2021 and 2016, respectively, as well as AK-SM 800A models that have not received updates. Such controllers are often connected to the internet to allow external refrigeration contractors to carry out maintenance remotely.
France’s CERT-FR cybersecurity agency also included Dixell xweb and Copeland xweb controllers in its warning.
Investigators have yet to identify those responsible
The precise method used to gain access to the systems has not been officially confirmed. CyberPax says the leading theory involves a known way of bypassing authentication on the controllers’ web interfaces, using a generic administrator account and a password derived from the date.
Researchers documented the vulnerability in 2025, and a corrective update was made available for models that remained supported. However, the update was not installed in the affected systems, according to the company.
The Paris prosecutor’s office, through its cybercrime unit (OFAC), and France’s National Cybersecurity Agency (ANSSI) are investigating. CERT-FR warned that the campaign was probably still underway, with exposed controllers remaining connected to the internet in France two weeks after the attacks.
Finance Minister Roland Lescure described the incident to Parliament as a wake-up call that affected the security of the country’s food supply.
The European campaign has been confirmed in the United States, France, Belgium, Luxembourg, Sweden, Denmark and Ireland, with cybersecurity authorities including France’s ANSSI, Belgium’s Centre for Cybersecurity (CCB) and Sweden’s National Cyber Security Centre coordinating their response.
No group has claimed responsibility, and no suspects have been identified or arrested. Belgium’s CCB has warned that the perpetrators may never be identified. European Commissioner for Agriculture Christophe Hansen described the incident as a “deliberate attempt to disrupt our food supply chain.”
Cybersecurity firm SentinelOne has also pointed to the absence of ransom demands as an indication that the attacks may have been intended to cause disruption rather than generate financial returns. It has noted that retailers are vulnerable because supermarket chains operate large numbers of refrigeration controllers.
Why Greek supermarkets are also at risk
CyberPax argues that Greek retailers use the same types of refrigeration controllers and maintenance arrangements found in the affected European markets. The company says Danfoss AK-SM and AK-SC controllers are commonly used in European retail refrigeration systems and may also be installed in Greek stores, including older versions that no longer receive support. It describes this as an assessment that could be verified through a one-day inspection.
The company says refrigeration equipment is often owned by individual stores or franchisees and maintained by external contractors who retain permanent remote access.
A check conducted on October 12 identified 2,752 Danfoss consoles accessible from the internet, including 1,590 in France. On November 2, Sweden’s cybersecurity center said exposed operational technology devices in the country still required security updates. No equivalent count has been conducted for Greece.
CyberPax also says that an inspection of a supermarket chain using a different brand of controller found a console with both its username and password fields left blank.
The company argues that the Greek market has no particular protection from the threat, other than the fact that no Greek supermarket has been reported as affected so far.
Speaking to OT, Giannis Masoutis, president of the Hellenic Supermarkets Association, confirmed that there had been no reported incidents involving Greek supermarkets. He said Greek chains were on alert and pointed to their response during the COVID-19 pandemic as evidence of their ability to maintain the uninterrupted supply of households.
Masoutis also said he believed the attackers were primarily seeking to cause damage rather than demand ransom payments.
Meanwhile, CyberPax has reiterated that insurance coverage remains uncertain. Intermarché has warned its members that their policies may not cover incidents of this kind, reinforcing the need for Greek retailers to review their own coverage and security arrangements.
