Hackers Turned Supermarket Freezers Into Heaters Across Europe and the Weak Point Was the Remote Maintenance Link
On the night of Sunday November 1 2026, freezers in supermarkets across a dozen European countries switched themselves to defrost. Nobody inside the stores touched them. By morning, refrigerated shelves and cold rooms in Belgium, Sweden, Ireland, the Netherlands, Luxembourg, Estonia, Finland, Portugal and other countries were warm, and staff were filling shopping trolleys with food to throw away. On Tuesday the wave reached Germany, where Edeka, REWE and CAP-Märkte confirmed their cooling systems had been taken over.
It was the second time in three weeks. On October 11 and 12, several hundred supermarkets in France had been hit the same way. The food waste was large. The more useful signal is the route the attackers used.
How it worked
The attackers did not break into the supermarkets. They went in through the systems that let refrigeration contractors watch and adjust cold rooms from a distance. In Germany, the attack on CAP-Märkte, which the Workers’ Welfare Association runs in North Rhine-Westphalia and Bavaria, reportedly targeted the company responsible for remotely maintaining the refrigeration units. Investigators and security researchers point to internet-connected controllers made by Danfoss, with Copeland units also mentioned in some reports. Many ran outdated software, kept default passwords or sat directly on the public internet. A Forescout report in October had already flagged refrigeration systems running old software without security updates.
Once in, the attackers didn’t just switch the units off. They set them to defrost or heating mode, so temperatures climbed fast. Some shelves and freezers reached 50 degrees Celsius. In Athens a butcher’s cold store was reportedly set to 150 degrees. Belgian police opened a criminal investigation after one butcher alone lost about 15,000 euros of meat.
Why it matters beyond the frozen peas
Supermarkets are a good target for anyone who wants disruption without bloodshed. They run on just-in-time logistics, with little stock held back, and a few hours of warmth makes a whole store’s chilled range unsellable. The damage lands on ordinary shoppers and small franchise owners, and it shows up on social media within the hour.
Nobody has claimed the attacks, and German authorities say they have nothing that links them conclusively to a particular group or state. German intelligence services joined the investigation, according to Der Spiegel on November 7. The European Commission and national police forces are also looking into the incidents. The timing, in the same week as bomb threats at several European airports, has led plenty of commentators to suspect a state hand. That is a suspicion, not a finding.
What is already clear is that the problem is structural. Building technology, from cold rooms to heating, ventilation and lighting, was connected to the internet for the convenience of maintenance firms long before anyone treated it as critical infrastructure. Authorities have now told supermarkets and industrial operators to take control devices off the public network immediately, and Germany is examining whether standards for digital building and logistics technology need tighter regulation.
The cheapest fix is old advice nobody followed: change the default password, patch the controller, and don’t expose it to the internet. The harder fix is deciding who is responsible when a store’s freezer is managed by a contractor’s software, made by a third company, and reachable by anyone who finds it. Until that is settled, the cold chain will stay one of Europe’s softer targets.
For the security market behind this story, see CybersecurityMarket.com.