What happened at European supermarkets
The first major wave was recorded in France on 12 October 2026, according to in.gr. Hundreds of supermarkets had cooling problems, as the perpetrators reportedly gained remote access to the equipment. In some places the temperature rose to 50 degrees Celsius and businesses threw away large quantities of fresh and frozen food. SKAI adds that fires also broke out.
A new wave followed on 2 November. In.gr, citing a Deutsche Welle report, mentions at least seven countries: Belgium, Sweden, Estonia, Finland, Ireland, Luxembourg and the Netherlands. Digital Life lists five of them, while Techgear names only four. The discrepancy shows that the picture is still incomplete.
SKAI reports that the Ahold Delhaize group spoke of an "IT incident" at dozens of its stores in Belgium and Luxembourg. In October, the group had reported an earlier cybersecurity incident to Dutch police authorities. Chains such as Carrefour, Delhaize, ICA, Coop, IKEA and SuperValu also reported problems, while Digital Life also names Colruyt.
How the hackers got in and what it cost
Commercial fridges do not rely only on mechanical thermostats. They have digital controllers and sensors and are often connected to central platforms so that technicians can monitor them remotely, Digital Life explains. If someone gets into the management network, they can change settings or trigger faulty defrost cycles. The temperature inside the chambers then rises.
In.gr writes that some older devices were accessible from the public internet, ran outdated software or lacked the necessary security updates. The same report, citing Euronews, notes that some of the affected supermarkets used equipment from Danish company Danfoss. The company says many of the compromised systems were older models, and urges its customers to update their software and secure their online connections. Systems from Dixell and Copeland also appear in the investigations, but that does not mean they bear any responsibility.
Techgear adds factory default passwords and insufficient isolation of the refrigeration network from the store's central network as possible causes. According to the same report, the attacks take place during the night so that the damage goes unnoticed. An ICA store in Sweden saw its freezers reach 50 degrees, and Coop confirmed a breach of refrigeration control at some of its stores.
On the cost, the sources do not agree on scale. Digital Life reports that a Belgian meat trading business estimated its losses at around €15,000. Techgear speaks of damage in the millions of euros and thousands of tonnes of food in the trash, without giving a specific source for the figures.
Who may be behind the attacks
In.gr, citing the Guardian, writes that experts are mainly examining two scenarios: a state-backed operation, or a technically skilled lone hacker or small group. Russia and China are among the countries being considered, but there is no public evidence proving their involvement. Rafe Pilling of Sophos presented both as possibilities. No conventional ransom demands have been identified, which limits the scenario of simple financial extortion.
Techgear goes further and says analysts link the incidents to malfunctions in freezers at US military bases, suspecting state-funded hackers. In.gr reports that US military investigators began an investigation into a simultaneous temperature rise in freezers at military facilities in South Korea. It cites Bloomberg and Reuters of 29 October, which spoke of simultaneous freezer outages at food stores at six US military facilities in August.
The European Commission condemned the incidents and spoke of a deliberate attempt to disrupt the food supply chain. European cybersecurity authorities are checking whether the French incidents are linked to the later ones. In.gr stresses that it would be premature to blame any government without concrete evidence.
What it means for your own home
Naftemporiki writes that there are reports of similar attacks in Greece as well. iefimerida reports an attack on a Greek butcher's shop. The key point is that any internet-connected device can become a target. In homes this covers smart fridges, ovens, cameras, video doorbells, robot vacuums, TVs and speakers.
The number one target, however, is the router. According to industry data cited by iefimerida (via Reuters) and SKAI, it accounts for more than three quarters of attacks on connected devices. Iefimerida adds that even simple smart bulbs and switches are used as a "back door" into the network. Naftemporiki warns that a compromised fridge can become a stepping stone to your computer or phone, allowing e-banking passwords and personal data to be stolen.
The measures are simple. Change factory default passwords immediately. Set up a separate Guest network on your router for smart devices, so that a breach does not reach your phones and computers. Install updates regularly. SKAI adds two-factor authentication where available, and replacing devices that no longer receive security updates, when feasible.
