Published 3 November 2026
A suspected cyberattack sent temperatures in supermarket freezers across Europe soaring to 50 degrees Celsius overnight. Stores in Belgium, Sweden, Ireland, Estonia, Finland, Luxembourg, and the Netherlands reported widespread spoilage, fires, and tonnes of ruined stock. The attacks were not random vandalism. They were targeted manipulation of commercial refrigeration systems that businesses had quietly connected to the internet for convenience.
This is not a story about smart fridges in people’s homes. It is about industrial control systems that run cold storage for millions of shoppers. And the same hardware is used in Australia, the UK, the US, and many other countries.
How Attackers Turned Defrost Into a Weapon
The European incidents followed a now-familiar pattern. Hackers reached refrigeration controllers through internet-facing management interfaces. Once inside, they did not deploy destructive malware. They used legitimate supervisory functions: raising temperature setpoints, forcing defrost cycles, and holding those settings while stores were closed.
By morning, freezer units had heated enough to spoil stock, melt components, and in some cases start fires. At one ICA store in Sweden, everything in the freezers was destroyed. In Belgium, one butcher shop reported roughly 16,000 dollars in ruined meat. Across France in October, around 700 supermarkets were hit before the November wave spread further.
Vincent Strubel, head of France’s cybersecurity agency ANSSI, told the French Senate that the attackers used basic security flaws: direct exposure of refrigeration equipment to the internet, weak passwords, and administration without meaningful security measures. He specifically said the vulnerabilities published earlier by Claroty were not the method used. The breach was simpler than that.
The Same Controllers Are Used Here
Jason Pearce, chief technology officer at cybersecurity firm Claroty, told Yahoo News Australia that the same manufacturers and controller families involved in the European incidents are present in the Australian market. Supervisory refrigeration systems from Danfoss and Copeland are used in supermarkets, cold storage, hospitals, pharmaceutical facilities, and food processing plants.
Forescout Research’s Vedere Labs identified 12,976 internet-exposed service observations across 10 product groups in 99 countries and territories. The breakdown includes 7,075 Copeland or Dixell XWEB services, 4,697 Danfoss StoreView services, 551 Copeland Site Supervisor services, and 513 Carel pCOWeb services. Many of these are reachable without authentication, or they run firmware with known vulnerabilities.
The exposure is not accidental. Manufacturer documentation for some of these platforms described port forwarding, public static IP addresses, and remote maintenance over the open internet as standard deployment options. Remote connectivity was sold as a feature, not a misconfiguration.
What the UK Is Already Facing
The UK National Cyber Security Centre has stated it is unaware of direct impact on British stores from the recent European attacks. That reassurance is limited. UK Cyber Defence researchers identified more than 800 refrigeration and building-control interfaces associated with British retailers that can be accessed over the public internet.
Peter Bassill, founder and chief information security officer at UK Cyber Defence, said having web login pages discoverable on the internet does not automatically give attackers access. It does, however, expose those systems to whoever finds the next flaw or guesses a weak password.
The UK already has recent experience of retail cyber disruption. In May 2025, ransomware attacks against Marks and Spencer and the Co-op wiped hundreds of millions of pounds from sales and left shelves empty. Those attacks hit payment and logistics systems. The refrigeration threat is different: it turns physical stock into the casualty without demanding a ransom.
Why Australia Is Not Immune
The Australian Signals Directorate’s Australian Cyber Security Centre has stated it is aware of cyber security incidents affecting commercial refrigeration systems overseas. It has not seen active targeting in Australia, but the warning is explicit: businesses should remain vigilant.
Pearce said the same measures used by threat actors overseas can definitely be exploited in Australia. The risk rises significantly if a management interface is exposed directly to the internet, protected by default or weak credentials, or running vulnerable firmware. He also noted that regional areas face sharper consequences because longer resupply times, fewer alternative grocery providers, and limited local cold storage mean a single compromised hub can affect a wider catchment.
The ACSC advises Australian organisations to ensure operational technology environments are not directly exposed to the internet, patch vulnerabilities promptly, apply strong authentication and network segmentation, and monitor for unusual automated activity. That guidance is sound, but it is only effective if organisations actually know which refrigeration controllers they have, who owns them, and whether any are end-of-life or unpatched.
The US Has the Same Architecture
The US operates the same vendor ecosystem and faces the same technical exposure. Forescout’s global data includes thousands of exposed refrigeration management interfaces reachable from American networks. The Cybersecurity and Infrastructure Security Agency has issued industrial control systems advisories for multiple product families used in commercial refrigeration.
No US supermarket has publicly confirmed a refrigeration sabotage campaign of the scale seen in Europe. That is not proof of safety. It is proof that the attack surface exists, that the controllers are present, and that the same entry conditions are reproducible elsewhere if organisations leave interfaces exposed, credentials weak, and firmware outdated.
What Needs to Change
Tom Hegel, a researcher at SentinelOne, put the core problem plainly: retailers need to answer who owns the security of that equipment, not just who repairs it. Refrigeration systems often sit outside the board’s cyber risk register because they are classified as facilities rather than IT.
Charles Radclyffe, CEO at EA Global AI, said it is remarkable that a system capable of destroying an entire store’s chilled stock often escapes proper oversight. Operational technology in stores now includes heating, ventilation, air conditioning, electronic shelf labels, digital advertising screens, and refrigeration controllers. Each device is effectively a small computer on the network. Most retailers know their payment compliance and email security posture in detail. Far fewer can say which refrigeration controllers are internet-facing, what software they run, or who has remote access.
The NCSC advises retailers to maintain accurate records of their operational technology environment, understand and document connectivity, integrate security into procurement, monitor connections, and plan secure decommissioning of assets. Claroty’s Pearce recommends a more operational focus: confirm what controllers are installed, remove direct internet exposure, patch where available, eliminate shared contractor credentials, and set up alerts that reach people who can act overnight rather than entries on a dashboard.
The Real Lesson
The attackers did not need zero-day exploits. They did not need nation-state resources. They found controllers that businesses had put online for convenience, logged in with weak or default credentials, and changed settings that ordinary technicians use every day. The damage was physical, immediate, and expensive.
The same pattern can repeat anywhere the same controllers are deployed. Europe is already experiencing it. The UK, Australia, and the US have the same hardware, the same connectivity habits, and in many cases the same gaps in visibility. The difference is whether operators treat refrigeration security as a facilities issue or as part of their cyber risk.
“Once an attacker can operate those controls, legitimate functions such as defrosting become tools for disruption. Changing a setting can destroy physical stock, not just interrupt a computer system.”
Tom Hegel, SentinelOne
Related Reading
How this analysis is researched, sourced and corrected: Editorial standards and corrections. Spotted an error? Contact Philip Hall.
