Cyber Threat Assessment: Hacking Supermarket Refrigerators and Freezers

Focus: Commercial refrigeration, operational technology (OT), cybercrime and food retail security

1. Executive summary

Supermarket refrigeration systems are essential components of modern food retail infrastructure. They maintain the temperatures required to preserve chilled and frozen products, protect food safety, support regulatory compliance and enable the continuous operation of supermarkets and distribution facilities.

Increasingly, these systems are connected to digital networks to support remote monitoring, automated maintenance, energy optimisation and centralised management. While these capabilities provide substantial operational benefits, they also introduce cybersecurity risks that can affect physical equipment and the products it protects.

The central finding of this report is that supermarket refrigeration must be treated as operational technology rather than as a collection of ordinary appliances. Unlike conventional IT systems, which primarily process and store information, refrigeration systems control physical processes. Unauthorised access can therefore cause direct consequences for food safety, business continuity, equipment reliability and public confidence.

Reported cyber incidents affecting European supermarkets in October and November 2026 illustrate the potential consequences of manipulating refrigeration controllers. According to the source reporting summarised in this assessment, attackers interfered with refrigeration settings, causing cooling disruption and losses of perishable stock. Investigations remained ongoing, and the identity and motivation of the perpetrators had not been publicly confirmed at the time of reporting.

The incidents highlight several interconnected security weaknesses:

• Refrigeration controllers exposed to the public internet without adequate protection.

• Outdated firmware and unsupported equipment that may contain unresolved vulnerabilities.

• Remote maintenance arrangements that create access pathways across multiple stores.

• Weak authentication, shared credentials and excessive user privileges.

• Insufficient monitoring of configuration changes and abnormal temperature behaviour.

• Inadequate separation between refrigeration networks and corporate IT infrastructure.

• Limited independent safety monitoring and recovery arrangements.

The principal threat is not limited to the theft of information or the deployment of ransomware. An attacker may be able to cause substantial disruption by abusing legitimate refrigeration control functions.

A change to a temperature setting, defrost schedule or alarm configuration can potentially result in spoiled stock, emergency repairs, lost trading and food safety investigations. These consequences may occur without the use of sophisticated malware.

The recommended defensive approach is to remove unnecessary internet exposure, secure all legitimate remote access, maintain supported equipment, monitor changes to refrigeration settings and establish independent safety controls.

Retailers should also ensure that refrigeration contractors, equipment manufacturers and internal IT teams share responsibility for securing the systems on which food safety and business operations depend.

2. Scope and assessment methodology

This assessment examines the cybersecurity risks associated with commercial refrigeration equipment used in supermarkets and food retail environments.

The scope includes:

• Refrigeration controllers and embedded management software.

• Temperature sensors, alarms and monitoring systems.

• Compressors, fans, defrost systems and associated control equipment.

• Remote engineering and maintenance connections.

• Centralised refrigeration management platforms.

• Network connections between refrigeration systems, contractors and corporate IT.

• Operational procedures for food safety, incident response and recovery.

The report considers both malicious cyber activity and the operational weaknesses that may increase the likelihood or impact of an incident.

The European incidents discussed in this report are treated as reported events rather than as fully investigated technical case studies. Public reporting does not establish every technical detail of the attacks, including the precise entry point, the complete number of affected stores or the identity of the perpetrators.

Where this report discusses possible attack methods, consequences or threat actor motivations, these are presented as threat scenarios and analytical assessments rather than confirmed findings.

3. The refrigeration environment: why connectivity matters

3.1 The role of refrigeration control systems

A modern supermarket may operate dozens or hundreds of refrigeration units, including chilled display cabinets, frozen food cabinets, cold rooms and storage freezers.

These systems are frequently connected to central controllers that coordinate the operation of multiple components.

A typical refrigeration control environment may include:

• Temperature sensors that measure conditions inside cabinets and storage areas.

• Controllers that regulate cooling and operating schedules.

• Compressors and fans that maintain refrigeration performance.

• Defrost systems that periodically remove accumulated ice.

• Alarm systems that identify abnormal temperatures or equipment faults.

• Remote management platforms that allow engineers to monitor and maintain equipment.

The controller acts as a management point for the physical refrigeration process. Its settings influence how equipment operates and whether the required temperatures are maintained.

This creates a direct relationship between cybersecurity and physical safety.

3.2 Legitimate reasons for internet connectivity

Connectivity provides significant commercial and operational benefits.

Business requirement	Operational benefit
Remote monitoring	Engineers can assess temperatures and equipment status without visiting every store.
Predictive maintenance	Developing faults can be identified before they cause equipment failure.
Remote engineering	Authorised technicians can diagnose faults and make approved configuration changes.
Energy management	Refrigeration operation can be adjusted to improve energy efficiency.
Food safety compliance	Temperature records can support monitoring and demonstrate compliance with applicable requirements.
Alarm management	Staff and contractors can receive alerts when equipment develops a fault.
Centralised management	Refrigeration performance can be monitored across multiple stores.

Remote access can reduce maintenance costs, improve equipment availability and help retailers identify failures before they cause significant losses.

The security challenge is therefore not to eliminate every connection. It is to ensure that the connectivity required for legitimate operations cannot be abused by unauthorised individuals.

3.3 The operational technology security challenge

Refrigeration systems differ from conventional corporate IT in several important respects.

First, they control physical processes. An unauthorised configuration change can affect cooling performance even if the controller continues to function normally.

Second, equipment may remain in service for many years. Hardware installed before current cybersecurity practices became standard may still be required for daily operations.

Third, replacing or updating equipment can be complicated. Changes may require engineering approval, testing and coordination with store operations.

Finally, refrigeration systems are often managed by facilities teams and external contractors rather than exclusively by corporate cybersecurity teams.

These differences can create gaps in security responsibility, asset visibility and incident detection.

The resulting risk is a mismatch between the operational importance of refrigeration systems and the security controls applied to them.

4. Threat landscape and reported European incidents

4.1 Reported incidents in France

The source report describes attacks reported on 11–12 October 2026 involving refrigeration systems at supermarkets operated by several major French retailers, including Carrefour, Intermarché, Netto and Monoprix.

The reported incidents involved manipulation of refrigeration settings, including changes that caused equipment to heat up or remain in defrost mode for extended periods.

Reported consequences included:

• Spoilage of refrigerated and frozen products.

• Financial losses associated with discarded stock.

• Disruption to normal supermarket operations.

• Potential damage to refrigeration equipment.

• Increased concern about food safety.

Initial reporting identified hundreds of affected supermarkets. Figures varied, with one government official reportedly estimating that approximately 700 stores had been affected.

These figures should be treated as reported estimates rather than as a definitive count of confirmed cyber compromises.

The source report also identifies refrigeration controllers supplied by Danfoss as relevant to the incidents. It notes that some equipment was older or operating outdated firmware.

However, the available information does not establish that a particular vulnerability was responsible for every incident.

4.2 Reported incidents in Belgium and other European markets

A subsequent wave of incidents was reported in early November 2026.

The source report identifies supermarkets in Belgium and other European countries, including Sweden, Finland and Ireland, as affected by refrigeration disruptions.

Belgian retailers reportedly included Delhaize, Carrefour and Spar.

At the time covered by the source material, investigations remained ongoing. No perpetrator had been publicly confirmed.

The incidents suggest that refrigeration security is a concern across multiple retail environments. They do not, by themselves, establish that all affected countries experienced the same attack method or that a single actor was responsible.

4.3 Significance of the incidents

The reported events demonstrate the potential for cyber activity to produce physical and commercial consequences.

They also highlight the importance of distinguishing between several different conditions:

1.    A controller is connected to the internet.

2.    A controller contains a known vulnerability.

3.    An attacker has obtained unauthorised access.

4.    An attacker has changed refrigeration settings.

5.    A physical or commercial consequence has occurred.

These conditions are related but are not interchangeable.

Internet exposure does not prove that a device has been compromised. The presence of a vulnerability does not establish that it was exploited in a particular incident. Likewise, a refrigeration fault does not automatically establish malicious activity.

A reliable investigation must therefore combine cybersecurity evidence with engineering diagnostics, temperature records and operational information.

5. How refrigeration systems may be attacked

The following attack scenarios describe the principal risks at a defensive threat-analysis level.

5.1 Discovery of exposed systems

Attackers may identify refrigeration controllers and remote management interfaces that are accessible from the public internet.

Publicly accessible management services create an opportunity for unauthorised individuals to identify equipment and assess whether its security controls are inadequate.

The scale of internet exposure is important because a common controller model or shared maintenance platform may be used across numerous stores.

However, discovering an exposed device is not equivalent to gaining access or establishing control.

5.2 Exploitation of software vulnerabilities

Refrigeration controllers contain embedded software and management applications that may have security weaknesses.

Depending on the vulnerability, an attacker might be able to bypass authentication, access management functions or interfere with the controller's operation.

The risk increases when manufacturers release security updates but retailers or contractors fail to install them.

Unsupported equipment presents a particular challenge because security fixes may no longer be available.

Retailers should therefore assess both the technical condition of their equipment and the availability of manufacturer support.

5.3 Weak or compromised credentials

Remote access may be protected by passwords that are weak, reused or shared between multiple engineers.

Shared credentials make it difficult to determine which individual performed a particular action.

They also complicate incident response because investigators may be unable to establish whether a configuration change was authorised.

A compromised contractor account may create additional risk if it provides access to multiple stores or refrigeration systems.

5.4 Abuse of legitimate maintenance access

An attacker who gains control of a legitimate remote-access account may be able to use the same functions available to an authorised engineer.

This type of compromise may be difficult to identify because the activity can resemble routine maintenance.

The risk is particularly significant when:

• Contractors have access to more equipment than necessary.

• Accounts remain active after maintenance work ends.

• Changes are not recorded or reviewed.

• Remote access is not restricted to approved maintenance periods.

• Multiple stores rely on the same contractor infrastructure.

These weaknesses can turn a single compromised account into a wider operational risk.

5.5 Manipulation of refrigeration settings

Once sufficient access has been obtained, an attacker may interfere with legitimate refrigeration functions.

Potentially harmful actions include:

• Altering temperature settings.

• Modifying defrost schedules.

• Changing equipment operating schedules.

• Disabling or modifying alarms.

• Interfering with temperature monitoring or records.

The consequences depend on the equipment involved, the duration of the disruption and the effectiveness of safety monitoring.

A short-lived change may produce limited operational impact, while prolonged or widespread disruption may result in significant stock losses and emergency intervention.

5.6 Wider network compromise

A poorly segmented refrigeration network may also create a pathway toward other systems.

Depending on the network architecture, this could include corporate IT, building management systems or shared service infrastructure.

The presence of a refrigeration controller on a network does not automatically provide access to other systems. The risk depends on network configuration, access controls and the privileges available to an attacker.

Nevertheless, retailers should ensure that a compromise affecting refrigeration equipment cannot easily spread into systems that support payments, logistics, business administration or other critical functions.

6. Threat actors and potential motivations

The identity and motivation of the perpetrators involved in the reported European incidents had not been publicly confirmed at the time covered by the source report.

The following categories represent possible threat actors rather than confirmed attribution.

Threat actor	Potential motivation
Cybercriminals	Financial gain, extortion or disruption for payment.
Hacktivists	Political protest, publicity or disruption of a targeted organisation.
Saboteurs	Deliberate financial or physical damage.
State-linked actors	Disruption, intelligence gathering or testing weaknesses in supply chains.
Opportunistic hackers	Curiosity, experimentation, notoriety or disruption for amusement.

Why refrigeration may be an attractive target?

Refrigeration equipment presents several characteristics that may make it attractive to attackers.

Physical impact: A change to an operating setting may produce a physical consequence without requiring conventional malware.

Commercial impact: A relatively small technical compromise may cause substantial losses if large quantities of food become unsafe or stores cannot trade normally.

Limited security visibility: Refrigeration equipment may not be included in the same monitoring and vulnerability management processes as corporate IT.

Shared infrastructure: Common equipment models, contractors and remote-access arrangements may create similar weaknesses across multiple stores.

Potential for extortion: An attacker could attempt to threaten further disruption in exchange for payment. However, the reported incidents do not establish that extortion was the motivation.

The key analytical point is that the physical importance of refrigeration can create leverage for an attacker even when the compromised device contains little valuable information.

7. Business, food safety and operational consequences

7.1 Food safety and public health

The primary concern is whether food remains within the temperature conditions required for safe storage.

If refrigeration is disrupted, products may enter unsafe temperature ranges. The risk depends on the product, the temperature reached, the duration of exposure and the applicable food safety requirements.

Where the safety of products cannot be established, retailers may need to isolate or discard affected stock.

Compromised monitoring also creates uncertainty. A temperature display may not provide reliable evidence if the controller or associated monitoring system has been manipulated.

Independent verification is therefore essential.

7.2 Financial losses

The financial consequences may extend beyond the value of spoiled food.

Potential costs include:

• Emergency engineering and maintenance.

• Replacement of damaged equipment.

• Lost sales and reduced store availability.

• Additional staff and incident management costs.

• Food disposal and replacement stock.

• Insurance claims and investigations.

• Regulatory or legal consequences.

A widespread incident may also affect distribution and replenishment operations, increasing the cost of recovery.

7.3 Operational disruption

A supermarket may be unable to sell affected chilled or frozen products until their safety has been established.

This can require the closure of individual cabinets, refrigeration circuits or entire store sections.

Where multiple stores are affected, the retailer may need to coordinate emergency engineering support, stock replacement and customer communications across its wider estate.

7.4 Reputation and customer confidence

Food safety incidents can undermine customer confidence, particularly when retailers cannot clearly establish whether affected products remained safe.

Poor communication or inconsistent responses between stores may increase reputational damage.

Retailers should therefore ensure that incident response procedures include clear decision-making responsibilities and appropriate communication with customers and relevant authorities.

7.5 Wider supply chain implications

Refrigeration is not limited to the supermarket sales floor.

Distribution centres, storage facilities and other food supply chain locations also depend on controlled temperatures.

If an attacker compromises shared infrastructure or a common maintenance arrangement, the resulting disruption could extend beyond individual stores.

This possibility reinforces the importance of assessing refrigeration security across the organisation rather than treating each store as an isolated environment.

8. Defensive strategy and mitigation

The most important principle is to treat refrigeration systems as industrial control systems that require security controls appropriate to their operational role.

8.1 Immediate actions: first 24–72 hours

Retailers should prioritise measures that reduce immediate exposure while preserving safe refrigeration operation.

Priority	Recommended action
1	Identify refrigeration controllers and remote management services accessible from the public internet.
2	Remove unnecessary public access and confirm that legitimate maintenance access remains secure.
3	Review controller models, firmware versions and manufacturer support status.
4	Remove default and shared credentials where possible, and restrict access to authorised personnel.
5	Review unexplained temperature changes, unusual defrost schedules and unexpected configuration changes.
6	Verify refrigeration conditions through independent monitoring where available.
7	Ensure store staff know how to respond if refrigeration control or monitoring becomes unavailable.

These actions should be coordinated with refrigeration engineers and operational personnel. Changes to connectivity or control settings must not introduce additional safety risks.

8.2 Network segmentation

Refrigeration systems should be separated from corporate IT, payment systems and guest Wi-Fi.

Segmentation limits the ability of an attacker to move between different parts of the organisation.

Retailers should also review connections between individual stores and central management platforms.

Where practical, refrigeration equipment should communicate only with the systems and services required for its operation.

8.3 Secure remote access

Remote engineering access should be provided through a protected connection rather than through unnecessary direct public exposure.

Recommended measures include:

• Strong authentication and individual user accounts.

• Multi-factor authentication where supported.

• Access restrictions based on job responsibilities.

• Time-limited access for maintenance activities.

• Removal of accounts that are no longer required.

• Regular review of contractor access permissions.

Remote access arrangements should be documented and reviewed whenever equipment, contractors or maintenance responsibilities change.

8.4 Firmware and vulnerability management

Retailers should maintain an accurate inventory of refrigeration equipment and its software versions.

A vulnerability management process should identify:

• Equipment affected by security advisories.

• Firmware updates and available security fixes.

• Unsupported controllers and systems.

• Equipment that cannot be updated safely.

• Replacement requirements for systems that cannot be adequately secured.

Updates should be tested and coordinated with engineering personnel to ensure that security improvements do not compromise refrigeration performance.

Where equipment cannot be patched, additional controls may be required to reduce its exposure.

8.5 Monitoring and detection

Monitoring should focus on both cybersecurity events and abnormal refrigeration behaviour.

Useful indicators include:

• Unexpected changes to temperature settings.

• Unusual defrost schedules.

• Disabled or modified alarms.

• Unexpected remote-access activity.

• Configuration changes outside approved maintenance periods.

• Temperature deviations that cannot be explained by normal operation.

These indicators should be reviewed alongside maintenance records and engineering information.

An alert should trigger investigation rather than an automatic assumption that a cyberattack has occurred.

8.6 Independent safety controls

Safety monitoring should not depend entirely on the same controller that is being investigated.

Where practical, retailers should maintain independent temperature measurement and alarm arrangements.

They should also ensure that staff can recognise abnormal refrigeration conditions and follow approved procedures if electronic monitoring becomes unavailable.

Independent verification is especially important before affected products are returned to sale.

8.7 Recovery and resilience

Retailers should maintain configuration backups and documented recovery procedures.

Recovery plans should identify:

• Who is authorised to restore refrigeration systems.

• Which configurations are trusted.

• How equipment will be checked after restoration.

• How temperature conditions will be verified.

• How affected products will be assessed.

• When normal operations can safely resume.

Recovery arrangements should be tested through exercises involving refrigeration engineers, store management, IT security and food safety personnel.

9. Contractor and supplier security

Third-party maintenance arrangements deserve particular attention because retailers may own refrigeration equipment without having full visibility of its configuration or remote-access arrangements.

A contractor may manage equipment across multiple stores, creating a shared dependency.

Retailers should therefore require contractors and suppliers to:

• Maintain an accurate inventory of installed controllers and remote-access connections.

• Document who has access to refrigeration systems and why.

• Use individual accounts rather than shared credentials.

• Apply manufacturer security updates where appropriate.

• Identify unsupported equipment and communicate associated risks.

• Report suspected compromises and unexpected configuration changes.

• Provide evidence that remote access is appropriately secured.

Contracts should clearly identify responsibility for security updates, access management, monitoring, incident reporting and recovery.

Retailers should also establish a process for reviewing contractor access when maintenance arrangements end or responsibilities change.

10. Incident response: suspected refrigeration compromise

The response to a suspected refrigeration cyber incident must protect people and food before attempting to restore the technology.

Phase 1: Protect food and customers

Store personnel should follow established food safety procedures and assess affected products.

Where the reliability of the refrigeration monitoring system is uncertain, staff should not rely solely on its displayed temperature.

Affected products should be isolated until their safety can be established.

Phase 2: Establish the nature of the incident

Refrigeration engineers and cybersecurity responders should work together to determine whether the problem is caused by equipment failure, unauthorised control changes or a combination of factors.

Relevant evidence may include temperature records, controller configurations, maintenance logs and remote-access records.

Phase 3: Contain the incident

Unauthorised remote access should be restricted, and affected systems should be isolated where this can be done safely.

Containment decisions must account for the physical consequences of disconnecting refrigeration equipment or monitoring systems.

Phase 4: Preserve evidence

Investigators should retain relevant controller logs, configuration records, access logs, contractor records and network evidence.

Evidence should be preserved before unnecessary system changes or restoration activities take place, where this is consistent with immediate safety requirements.

Phase 5: Restore safe operation

Recovery should use trusted configurations and manufacturer-approved procedures.

Refrigeration conditions should be independently verified before affected products are returned to sale.

Phase 6: Report and investigate

Retailers should notify relevant authorities, insurers, suppliers and affected stakeholders as required.

The investigation should establish the likely entry point, the scope of the incident and whether other stores or systems may be exposed.

In the UK, retailers should consider the appropriate national cyber incident reporting channels and relevant food safety authorities where food safety may be affected.

11. Governance, accountability and risk management

Effective refrigeration security requires cooperation between several organisational functions.

Corporate IT teams may be responsible for network security and monitoring, while refrigeration engineers understand the physical operation of the equipment.

Facilities teams may manage contractors, and store personnel are responsible for identifying operational problems.

Food safety teams must assess whether affected products remain suitable for sale.

If these responsibilities are not clearly defined, security issues may remain unresolved or incidents may be handled inconsistently.

Retailers should establish clear ownership for:

• Refrigeration asset inventories.

• Remote access and account management.

• Firmware updates and vulnerability remediation.

• Monitoring and incident escalation.

• Contractor and supplier security.

• Food safety decisions during incidents.

• Recovery and restoration approval.

Senior management should receive regular information about significant refrigeration security risks, including unsupported equipment, unresolved vulnerabilities and dependencies on third-party services.

12. Overall assessment

Supermarket refrigeration is an increasingly connected form of operational infrastructure. Its security has direct implications for food safety, commercial continuity and public confidence.

The reported European incidents in October and November 2026 demonstrate the potential consequences of unauthorised interference with refrigeration settings. They also highlight the need to distinguish confirmed incidents from broader risks associated with internet exposure and software vulnerabilities.

The most significant concern is the combination of physical control capability, extensive remote access and potentially limited security visibility.

A successful attack may cause disruption without requiring the theft of sensitive information or the deployment of conventional ransomware.

Retailers should therefore prioritise the removal of unnecessary internet exposure, secure remote access, supported firmware, network segmentation and monitoring of refrigeration settings.

These controls must be supported by independent temperature verification, safe manual procedures and tested recovery arrangements.

The central lesson is that refrigeration security is not solely an IT responsibility. It is a shared operational, engineering and food safety responsibility that must be managed across the entire retail organisation.

13. Conclusion

The increasing connectivity of supermarket refrigeration provides substantial operational benefits, but it also creates new opportunities for cybercriminals and other malicious actors.

The physical consequences of a refrigeration compromise can extend beyond the affected device. They may include spoiled stock, disruption to supermarket operations, financial losses and potential food safety concerns.

The appropriate response is not to abandon remote monitoring or digital refrigeration management. It is to ensure that these capabilities are protected by security controls proportionate to their operational importance.

Retailers should treat refrigeration equipment as critical operational technology, establish clear responsibility for its security and ensure that food safety does not depend entirely on the integrity of a single connected controller.

By combining cybersecurity controls with engineering safeguards and effective incident response, supermarkets can reduce the likelihood of compromise and improve their ability to maintain safe operations when incidents occur.

 Disclaimer

This report is intended for informational and cybersecurity awareness purposes only. The findings are based on available information and may not reflect the full details of ongoing investigations. Potential attack methods and threat actor motivations are analytical assessments, not confirmed facts. The report should not be considered a substitute for professional cybersecurity advice or food safety guidance.