A stranger may already know your age, address, family details and SSN
Find out with a free scan
Imagine walking into a supermarket and discovering that its refrigerators have stopped keeping food cold.
Fresh meat, dairy products, and frozen food are suddenly at risk.
It sounds like an equipment failure.
But what if someone deliberately changed the temperature settings remotely?
In November 2026, a second wave of cyberattacks targeted supermarket refrigeration systems across several European countries, forcing stores to remove chilled and frozen products from sale and, in some cases, throw away thousands of euros worth of food.
The attacks affected supermarkets and businesses in Belgium, Sweden, Estonia, Ireland, the Netherlands, Finland, Portugal, and Italy.
Attackers remotely accessed refrigeration control systems and changed their settings, causing cooling units to warm up instead of maintaining safe temperatures.
The incident followed an earlier wave of attacks against hundreds of supermarkets in France.
And that’s what makes these attacks particularly concerning.
The targets weren’t customer databases, payment systems, or corporate email accounts.
They were the systems responsible for keeping food safe.
What Happened?
On November 3, 2026, The Hacker News reported a second wave of cyberattacks targeting supermarket refrigeration systems across Europe.
The attacks took place overnight into November 2, affecting refrigeration controls at multiple retail businesses.
The affected companies included Delhaize, Carrefour, Intermarché, Spar, IKEA, ICA, Coop, and SuperValu.
The impact varied between locations.
In Belgium, attackers switched refrigeration units into defrost mode, a function normally used to remove accumulated ice. Instead of maintaining cooling, the units began warming up.
In Sweden, an ICA supermarket reported that its refrigerators and freezers had been set to 50°C, forcing staff to discard affected products.
In Estonia, a freezer at a Selver supermarket was also reportedly set to 50°C. However, the issue was resolved within approximately 10 minutes, and no food was damaged.
The consequences were not limited to supermarkets.
At a butcher shop in Hove, Belgium, refrigeration units were reportedly turned up to 18°C. The owner estimated that approximately €15,000 worth of meat had been ruined.
Ireland’s Musgrave, which operates SuperValu, also removed chilled and frozen products from sale at 13 stores as a precaution.
The incident was eventually resolved, and restocking began.
The attacks involved refrigeration equipment supplied by Danfoss, a Danish manufacturer whose systems had also been involved in the earlier French incidents.
However, investigators had not established whether the different waves were carried out by the same attackers.
How Did the Attacks Work?
Unlike traditional cyberattacks that focus on stealing information or compromising user accounts, these incidents targeted industrial control systems.
Supermarket refrigeration systems use computers and connected controllers to manage cooling temperatures, defrost schedules, and equipment performance.
Many of these systems can be accessed remotely, allowing refrigeration contractors to monitor equipment and troubleshoot problems without physically visiting a store.
That remote access is useful for maintenance.
But it can also create an entry point for attackers when the systems are not properly secured.
According to Danfoss, some affected systems were outdated, used default passwords, or were connected to networks without adequate security protections.
In the Netherlands, a Danfoss spokesperson told NOS that some affected refrigeration systems were not on secure networks and still used default passwords.
In other cases, outdated software and older controllers were identified as contributing factors.
Once attackers gained access to the control systems, they could manipulate refrigeration settings remotely.
In simplified terms, the attack chain looked something like this:
Exposed Refrigeration System → Unauthorized Access → Control Settings Manipulated → Temperature Changes → Food Losses
This is an important distinction.
The attackers didn’t necessarily need to damage the physical refrigeration equipment.
They could interfere with the software controlling it.
Why Are Supermarket Refrigerators Connected to the Internet?
Modern supermarkets rely on connected technology to manage far more than checkout counters and inventory.
Refrigeration systems are an important part of that infrastructure.
They continuously monitor temperatures, regulate cooling, manage defrost cycles, and notify maintenance teams when something goes wrong.
Remote access allows contractors to identify faults, adjust settings, and maintain multiple locations from a central system.
For businesses operating hundreds of stores, this can save time and reduce maintenance costs.
But connectivity also expands the attack surface.
A refrigeration controller connected directly to the internet or an inadequately protected network can become accessible to unauthorized parties.
The problem becomes more serious when older equipment remains connected without receiving security updates.
A system that was originally installed for operational convenience can become a cybersecurity weakness.
The Problem With Outdated Systems and Default Passwords
One of the most concerning details in this incident is how some of the affected systems were protected.
According to Danfoss, certain compromised refrigeration systems were still using default passwords and were not connected to secure networks.
This is a problem that extends far beyond supermarket equipment.
Many connected devices are installed with manufacturer-provided credentials that users are expected to change.
When those credentials remain unchanged, attackers may be able to access devices using publicly known login information.
Outdated software creates another problem.
Manufacturers regularly release updates to address security weaknesses and improve system protection.
But industrial equipment isn’t always easy to update.
Businesses may depend on older hardware, maintenance contracts, or systems that cannot be taken offline without disrupting operations.
In some cases, the equipment may have reached the end of its support life and no longer receive security fixes.
That creates a difficult situation.
Even if an organization understands the risks, replacing or upgrading operational equipment can be expensive.
But leaving unsupported systems connected to the internet can make them easier targets.
Why Does This Matter?
The supermarket attacks demonstrate how cybersecurity incidents can move beyond the digital environment and affect physical operations.
A compromised email account might expose confidential information.
A ransomware attack might prevent employees from accessing important files.
But an attack against industrial control systems can interfere with the physical processes that businesses depend on.
In this case, changing refrigeration settings affected food storage.
The consequences included:
- Food spoilage and financial losses.
- Temporary removal of chilled and frozen products.
- Disruptions to supermarket operations.
- Additional costs for inspection, repairs, and system security.
- Potential food safety concerns.
The incident also highlights the interconnected nature of modern infrastructure.
A supermarket may depend on an external refrigeration contractor, a third-party equipment manufacturer, and remote monitoring systems to keep its operations running.
A weakness in one part of that environment can create risks for the others.
The Dark Web Isn’t Always the Starting Point
When we think about cybercrime, the dark web is often associated with stolen credentials, leaked databases, ransomware negotiations, and underground marketplaces.
But not every cyberattack begins there.
Some attacks exploit weaknesses in systems that are directly accessible over the internet.
Others take advantage of outdated software, exposed remote access services, or poorly protected connected devices.
The supermarket incidents demonstrate that attackers don’t always need to steal information to cause significant damage.
Sometimes, gaining control over a connected system is enough.
There is also an important distinction between the attack itself and its aftermath.
Although compromised devices and credentials can potentially become part of underground cybercrime activity, there was no confirmed evidence that the supermarket attacks involved dark web marketplaces or that stolen access was being sold there.
The broader lesson is that the same security weaknesses that affect traditional IT infrastructure can also put physical operations at risk.
When Digital Attacks Affect Physical Infrastructure
The supermarket incidents are part of a much broader cybersecurity challenge involving operational technology (OT) and the Internet of Things (IoT).
Operational technology refers to the hardware and software used to monitor and control physical processes.
It includes systems used in manufacturing plants, energy facilities, transportation networks, refrigeration equipment, and other industrial environments.
IoT devices, meanwhile, connect physical objects to networks so they can exchange information and be managed remotely.
These technologies offer efficiency and convenience.
But they also create new security challenges.
Unlike traditional office computers, industrial systems often need to operate continuously.
Taking them offline for maintenance or security updates can interrupt essential services.
That means organizations must balance operational availability with cybersecurity.
The supermarket attacks show what can happen when that balance isn’t properly managed.
Lessons for Businesses
Organizations operating connected equipment should treat operational technology as part of their cybersecurity environment.
Several security practices can help reduce the risk:
1. Remove Direct Internet Exposure
Industrial control systems should not be directly accessible from the public internet unless there is a specific, securely managed requirement.
2. Change Default Passwords
Manufacturer-provided credentials should be replaced with strong, unique passwords before equipment is deployed.
3. Keep Software and Firmware Updated
Organizations should apply security updates and review whether older devices still receive manufacturer support.
4. Secure Remote Access
Remote maintenance should take place through protected networks, secure VPN connections, and properly controlled access permissions.
5. Monitor Connected Devices
Businesses should maintain an inventory of internet-connected equipment and monitor unusual access or configuration changes.
6. Separate IT and OT Networks
Corporate office networks and industrial control systems should be segmented so that a compromise in one environment doesn’t automatically provide access to the other.
7. Review Equipment at End of Life
Devices that no longer receive security updates should be replaced or isolated from exposed networks wherever possible.
The goal isn’t simply to protect business data.
It’s to prevent unauthorized access from disrupting the physical systems that keep businesses operating.
What Does This Mean for Everyday Internet Users?
You might not operate a supermarket or manage industrial equipment, but these incidents still have implications for everyday consumers.
The services and products people rely on increasingly depend on connected infrastructure.
Food storage, electricity, transportation, healthcare, and other essential services use network-connected systems behind the scenes.
A cyberattack against these systems can affect people who have no direct interaction with the compromised technology.
For everyday users, the incident is also a reminder that connected devices need proper security.
Smart home appliances, cameras, routers, and other internet-connected products can introduce vulnerabilities when left with default passwords or outdated software.
Here are a few precautions worth taking:
Change Default Device Passwords
Never assume the password supplied with a connected device is secure enough to keep using.
Keep Firmware Updated
Check for updates to routers, smart devices, and other connected equipment.
Secure Remote Access
Disable remote access features that you don’t need and use strong authentication wherever available.
Review Connected Devices
Know which devices are connected to your home network and remove those you no longer use.
Secure Your Network
Use strong Wi-Fi encryption and avoid exposing device management interfaces directly to the internet.
Use a VPN When Appropriate
A VPN can help protect internet traffic when connecting through unfamiliar networks and provide an additional layer of privacy. However, it cannot secure an improperly configured industrial controller or replace device-level security.
Security works best when every connected layer is properly protected.
Final Thoughts
The second wave of supermarket cyberattacks is a reminder that cybersecurity is no longer just about protecting information.
It is also about protecting the systems that make everyday life possible.
A compromised refrigeration controller might not sound as serious as a stolen database or a ransomware attack.
But when it causes food to spoil across multiple stores, the consequences become very real.
The attackers didn’t need to steal customer information or encrypt business files.
They simply needed access to the systems controlling the temperature.
And that’s the bigger lesson.
As more physical infrastructure becomes connected to the internet, the consequences of weak cybersecurity will increasingly extend beyond screens, accounts, and networks.
Sometimes, a cyberattack doesn’t just disrupt your digital world. It can disrupt the real one too.
Why Subscribe? Every month, we uncover the latest dark web threats, from ransomware and leaked data to underground fraud trends and emerging cybercrime tactics.
