Hackers have repeatedly broken into the remote-control systems of supermarket refrigerators and freezers across Europe since October, forcing units into prolonged "defrost mode" so they overheated. Some units reportedly reached temperatures as high as 50 degrees Celsius, with isolated reports of 80 degrees Celsius. The result was spoiled food, a few small fires caused by the heat, and losses running into millions of euros.
The attacks have come in two major waves. On October 11-12, around 700 of France's 10,000 supermarkets were hit, including Carrefour, Monoprix, Intermarche, Netto and Cooperative U. Attackers extended normal one-hour defrost cycles to six to eight hours and delayed alarms, giving staff little warning before food spoiled.
A second wave struck on November 2-3, hitting seven more countries: Belgium (around 40 Delhaize stores), Sweden (ICA and Coop outlets), Luxembourg, Ireland (13 SuperValu stores), the Netherlands, Estonia and Finland. One Delhaize branch in Belgium alone lost produce worth 100,000 euros, according to BBC's report citing the store manager. The BBC also reported on November 4 that cold rooms storing blood at the French Blood Establishment were affected by the hacks.
Both waves targeted the same weak point: remote-management software that lets retailers monitor and adjust refrigeration units over the internet. The affected systems were chiefly made by Danish firm Danfoss, and also included equipment from Copeland and Dixell. Many of the compromised units were older models that no longer receive security updates and were connected directly to the internet without adequate firewalls. Cybersecurity experts quoted by Reuters described the method as unsophisticated, saying the attackers were essentially "pushing at an open door" rather than exploiting a complex vulnerability.
No group has claimed responsibility for either wave, and no ransom was demanded, which has puzzled investigators. France's cybercrime unit and the national cyber agencies of Belgium and Sweden are all investigating. Russian hacktivist groups Noname057(16) and Z-Pentest Alliance claimed a related breach of Danfoss systems, but cybersecurity researchers at the French firm Sekoia told the BBC they remain sceptical of that claim, noting the groups mainly conduct distributed denial-of-service attacks and have a history of false attributions.
Analysts at cybersecurity firm Sophos told The Guardian that the two most plausible explanations are a state-linked actor demonstrating disruptive capability, or a lone hacker acting for personal reasons. Some experts say the psychological impact of empty supermarket shelves makes state-linked signalling a stronger theory, given that no money was extorted. United States authorities are separately investigating refrigeration failures at several military bases in August using a similar method, and are checking for any link to the European incidents.
Security analysts say the episode is a wake-up call on operational technology, or OT, security — the systems that control physical equipment rather than just hold data. A breach at this layer does not steal information. It breaks something physical, in this case spoiling food and starting small fires. Experts warn the same vulnerability could, in principle, affect larger cold-chain or industrial refrigeration systems.
Indian cybersecurity experts have already begun flagging the risk. Citing experts speaking to The Economic Times, a report by CXO Digital Pulse said cybersecurity safeguards for operational technology systems controlling India's refrigeration and cold-storage infrastructure remain at an early stage, even as the sector increasingly adopts connected, internet-linked equipment. Business Today separately asked whether India's smart refrigeration systems could be next, noting that the European incidents and the suspected cyberattack on US military grocery stores raise the same question for India's connected cooling infrastructure.
Danfoss and Copeland, the two companies at the centre of the European breach, both sell remote refrigeration-control technology into India's food retail and cold-chain market, including under Make in India manufacturing commitments. No cyberattack on an Indian supermarket or cold-storage facility has been reported so far. This is, for now, a preparedness and risk story for India rather than a confirmed incident.
The bigger takeaway for Indian retailers and cold-chain operators is that a low-sophistication exploit of an internet-connected fridge controller, not a complex hack, was enough to disrupt food supply across more than ten European countries. Experts say that is reason enough to review how India's own connected cooling systems are secured, even without a domestic incident yet on record.