Two waves, one mechanism
On the night of 11 October, attackers took control of refrigeration controllers in hundreds of French supermarkets and instructed them to run defrost cycles with stock still inside. The French government later put the number of affected stores at around 700. Temperatures were driven as high as 50°C. In some stores equipment melted or caught fire, with sprinkler discharge adding water damage to the spoiled food.
Three weeks later, on 2 November, the pattern repeated across a wider footprint. Delhaize and Colruyt stores in Belgium and Luxembourg, ICA and Coop branches in Sweden, SuperValu stores in Ireland, K Group stores in Finland, and retailers in Estonia and the Netherlands all reported overnight temperature spikes. In Belgium the tampering began in the early hours but was only noticed hours later. The installer that manages Delhaize’s refrigeration said the mechanism was identical to the French attack. Some stores reported losses above €130,000.
No malware was required. The attackers used a legitimate engineering function, the automatic defrost, against the asset it exists to protect. A settings change destroyed physical stock rather than merely interrupting a computer system, which is precisely the class of outcome that sits outside most organizations’ idea of a cyber incident.
The asset no security programme owned
A supermarket refrigeration controller occupies an awkward position. It is not an IT asset in any sense the information security team would recognize: it does not appear in the endpoint estate, it is not on the patch cycle, and it rarely sits behind the corporate perimeter. Nor is it a physical security asset that a guard force or CCTV system would protect, because the threat arrives over the internet rather than through the loading bay. Facilities management treats it as plant. The refrigeration contractor treats it as a maintenance agreement. In France, refrigeration is commonly outsourced to third parties, leaving retailers with little direct control over the security of controllers in their own stores.
The controller is, in plain terms, an Internet of Things device. It is not the smart fridge of the consumer imagination but its commercial cousin: an embedded system with a web interface, a network connection and authority over a physical process. Commercial IoT of this kind has spread through retail estates, offices and hospitals by way of energy-efficiency projects, facilities upgrades and remote-servicing contracts, rather than through any security decision. Each connection was justified on convenience or cost. Collectively they have created an attack surface that few organizations have mapped.
Tom Hegel of SentinelOne put the question to the BBC with some precision: retailers need to establish “who owns the security of that equipment, not just who repairs it.” That is the converged security problem in miniature. Each function holds a legitimate piece of the asset. None holds the risk. The attackers did not need to defeat a security programme. They needed only to find the space between three of them.
End-of-life plant and the limits of patching
Danfoss has said that most affected units were older AK-SM 800 and AK-SC 355 supervisors, with some newer 800A units running outdated firmware. Updates for the AK-SM 800 ended in May 2021, and for the AK-SC 355 in 2016. For those devices there is nothing to patch.
This is a familiar pattern in operational technology. Refrigeration racks, HVAC plant and building management systems are bought on capital cycles measured in decades, while the software controlling them is supported for a fraction of that time. A controller can be mechanically sound and digitally obsolete for years. A security programme built around patch compliance has no answer to a device that will never receive another update, other than to remove its exposure or replace it.
The method of initial access has not been publicly confirmed. Exposed management interfaces, known vulnerabilities and stolen contractor credentials all remain plausible. The defensive conclusions do not depend on which proves correct.
Exposure is visible to everyone, including the attacker
Shodan searches after the French incident found more than 4,500 internet-facing Danfoss controller interfaces, over half of them in France. UK Cyber Defence has separately identified more than 800 refrigeration and building-control interfaces associated with British retailers that can be reached from the public internet. The NCSC says it is unaware of any UK impact so far. Exposure is not compromise, but it is the precondition for this type of attack, and it is discoverable by anyone with the same search tools.
This is where intelligence has a direct role. The attack surface was not hidden. It was indexed, enumerable and in many cases labelled with manufacturer and model. An organization that does not routinely examine its own external footprint the way an adversary would is relying on nobody else looking either. After France, that assumption no longer held. The second wave struck retailers who had three weeks’ notice, and Coop in Sweden noted that the incident came ahead of an upgrade already planned in response to France. Awareness without completed remediation offered no protection.
Detection sat in the wrong place
Several of the 2 November incidents were discovered by staff arriving in the morning, or by a manager who drove to a store south of Antwerp to find units at 18°C. Refrigeration systems carry temperature alarms, but those alarms were designed to flag mechanical failure. They route to maintenance contractors and store managers, not to anyone tasked with recognizing hostile activity. A temperature excursion across several sites in the same hour is not a fault pattern. It is an attack signature, and it only reads as one to someone positioned to see the sites together.
In Estonia, by contrast, the refrigeration firm Kitman Coldtech said its technicians responded within minutes and prevented significant damage. The difference lay less in the technology than in where the signal went and who was watching it.
Where the definition of CNI stops
Food is one of the UK’s national infrastructure sectors, with Defra as its lead government department. That does not make every supermarket critical national infrastructure. The government’s definition applies only to those elements of a sector whose loss or compromise would cause a major detrimental impact on essential services, with severe economic or social consequences or loss of life. A single store’s freezers do not meet that test, and it is the lead department that decides which assets do.
European regulation draws a similar line. NIS2 brings food businesses into scope where they are engaged in wholesale distribution or industrial production and processing; retail trade, storage and transport sit outside it. In the UK, the NIS Regulations 2018 do not cover food at all, and the Cyber Security and Resilience Bill, which has been passing through Parliament this year, extends the regime to managed service providers, data centres and designated critical suppliers rather than to new sectors. Consumer smart devices are governed separately, under the product security regime that has applied since April 2024. A commercial refrigeration controller in a supermarket falls between all of them: too industrial for consumer product law, too far downstream for the food provisions of NIS2, and outside the UK’s NIS sectors entirely.
The definitions are built around individual assets and individual operators. The October and November attacks were built around a device class. An attacker who can reach the same controller model in several hundred stores across several countries in a single night produces an aggregate effect that no single store’s designation would anticipate. Each site falls below the threshold; the campaign does not. Criticality, in that sense, is an emergent property of shared technology and shared exposure rather than a fixed attribute of an asset on a register.
The bleed runs across sectors as well as within them. The same family of refrigeration supervisors, and the contractors who maintain them remotely, serve hospital pharmacies, vaccine stores, pharmaceutical logistics and food production. A technique proven against a supermarket on Sunday is equally available on Monday against a site that does sit inside Health or Food CNI. Supply chain provisions offer a partial answer, since the Bill allows regulators to designate critical suppliers to essential services. Its managed service provider category, however, is framed around the management of IT systems, and it is not yet clear that a refrigeration contractor’s remote access to plant would fall within it.
The practical consequence is that a CNI designation, or the absence of one, is a poor proxy for risk. The more useful questions are whether a technology is shared across sites and sectors, whether it is reachable from the internet, and who holds remote access to it. Those questions cross the boundaries the definitions draw, which is precisely why they belong to a converged function rather than to any single regulatory silo.
What a converged posture looks like
The immediate technical measures are well rehearsed: remove direct internet exposure from management interfaces, restore remote maintenance through a secured gateway, replace unsupported supervisors and patch those that can be patched, and segment plant networks from store IT and point-of-sale systems. Those steps are necessary. They are not sufficient, because they address the device rather than the organizational gap that left it exposed. A converged approach rests on four further disciplines.
Ownership. Every connected physical asset needs a named owner for its security, distinct from whoever maintains it. Where maintenance is outsourced, the contract should specify remote access arrangements, credential management, firmware currency and notification duties. A supplier who can operate a controller remotely is part of the attack surface.
Inventory. Building management, refrigeration, access control and HVAC belong in the same asset register as servers and laptops. Plant that nobody knows is online cannot be defended.
External visibility. Periodic surveys of internet-facing infrastructure, conducted from the outside in, will find what an attacker finds. That work sits naturally with an intelligence function rather than a compliance one.
Fused monitoring. Physical-process alarms should reach a function capable of correlating them across sites and against threat reporting. A GSOC or fusion centre receiving cold-chain alerts alongside cyber and physical incident feeds is far better placed to recognize a coordinated campaign at 01:00 than a store manager is at 07:00.
Beyond the supermarket
Refrigeration is the visible case because empty freezers photograph well. In the United States, the Pentagon is reported to be investigating suspected attacks on refrigeration at six military commissaries. Water and power operators run comparable remote-access arrangements, and Ken Munro’s concern, as reported by the BBC, is less the well-funded national operator than the smaller one still running legacy equipment.
The lesson of the past three weeks is not that freezers are uniquely vulnerable. It is that any connected physical asset whose security belongs to no single function will eventually be found by someone who notices that gap first. Converged security exists to close it before they do.
How Global Protect can help
Global Protect works at the seams these attacks exploited. Fusion Hub analysts monitor threat reporting and open sources for emerging campaigns against connected plant, and the INTSUM service turns that monitoring into assessed intelligence a client can act on before the same technique reaches its own estate. OSINT-led exposure work examines an organization’s internet-facing footprint as an adversary would, identifying building, refrigeration and other control interfaces that should not be public. The Converged Security Maturity Assessment, through its Convergence Gap diagnostic, shows where ownership of connected physical assets falls between IT, facilities and suppliers. Global Protect’s consultants then help clients assign that ownership, tighten supplier contracts and route plant alarms to a watch function capable of correlating them across sites.
Find out where your gaps sit. Take the Converged Security Maturity Assessment to see how your organization scores across eight security domains, or speak to the Global Protect team about an exposure review of your connected plant and building systems.
Frequently asked questions
What happened in the European supermarket refrigeration cyber-attacks?
Attackers remotely took control of internet-connected refrigeration controllers and drove fridge and freezer temperatures as high as 50°C. Around 700 French supermarkets were affected on the night of 11 October 2026. A second wave on 2 November 2026 hit stores in Belgium, Luxembourg, Sweden, Ireland, Finland, Estonia and the Netherlands, forcing retailers to discard spoiled stock.
How did hackers take control of supermarket fridges and freezers?
The attackers used a legitimate engineering function, the automatic defrost cycle, to heat units with stock still inside. Most affected devices were older Danfoss supervisory controllers, some of which no longer receive security updates. The method of initial access has not been publicly confirmed, but exposed web interfaces, known vulnerabilities and stolen contractor credentials all remain plausible.
What is converged security?
Converged security is the management of physical, cyber and information security risk as a single discipline rather than as separate functions. It recognizes that one incident can cross all three domains, as when a cyber intrusion into building or refrigeration controls destroys physical stock. A converged approach assigns clear ownership, shares intelligence across teams and correlates alerts from every domain.
Are supermarkets classed as critical national infrastructure in the UK?
Food is one of the UK’s national infrastructure sectors, but an individual supermarket is not normally classed as critical national infrastructure. The UK definition covers only those assets whose loss would cause a major impact on essential services, and the lead government department, Defra, decides which qualify. Coordinated attacks across many stores can still produce national-scale effects.
Does NIS2 apply to supermarket refrigeration systems?
NIS2 covers food businesses engaged in wholesale distribution or industrial production and processing, but it excludes retail trade. A supermarket’s in-store refrigeration controllers therefore usually fall outside its food provisions. The UK’s NIS Regulations 2018 do not cover the food sector at all, and consumer IoT security law does not extend to commercial equipment.
Are UK retailers exposed to the same type of attack?
The NCSC has said it is unaware of any UK impact so far. However, UK Cyber Defence has identified more than 800 refrigeration and building-control interfaces linked to British retailers that can be reached from the public internet. Exposure does not mean compromise, but it is the precondition this type of attack relies on.
How can organizations protect connected refrigeration and building systems?
The first step is to remove management interfaces from direct internet access and route remote maintenance through a secured gateway. Organizations should replace unsupported controllers, patch those that can be patched and segment plant networks from corporate IT. They should also record these assets in the main asset register and route their alarms to a monitoring function that can correlate them across sites.
Who is responsible for the security of outsourced building and refrigeration equipment?
Responsibility often goes unassigned, which is the gap these attacks exploited. Maintenance contractors repair the equipment, facilities teams operate it, and IT security teams rarely include it in scope. Every connected physical asset should have a named security owner, and supplier contracts should define remote access, credential management, firmware currency and incident notification duties.
Sources
- BBC News, “If hackers can take control of a supermarket freezer, how vulnerable is other tech?”, 2 November 2026
- CNBC: Cyberattack on fridges hits supermarkets across Europe
- Euronews: Cyberattacks hit supermarket fridges and freezers in Europe
- AP via PBS: Freezers at supermarkets in several European countries hit by apparent cyberattacks
- ABC News: European grocery chains’ freezers targeted in apparent cyberattacks
- Axios: Europe’s fridges are getting hacked
- Wikipedia: 2026 French supermarket refrigerator hack
- CSO Online: OT lessons from France’s supermarket attack
- Retail Gazette: French supermarket attacks were product of basic security flaws
- The Register: Supermarket refrigeration attacks in France
