Freezer Attacks Spread Across Countries as Refrigeration Systems Become a Cyber Target

A cyberattack campaign that hit about 700 French supermarkets on October 11, 2026 has grown into a multi-country pattern of attacks on critical infrastructure. A second wave struck food businesses in 13 countries on November 2. Cold rooms at a contractor for France's national blood service were set to 110°C (230°F), and three UK meat suppliers were hit through Copeland XWEB controllers. On November 5, five US agencies warned of ongoing attacks on refrigeration and cold chain systems.

The US is also affected. Freezers at six or more US military commissaries failed overnight in late August, and the Pentagon now treats those failures as a suspected cyberattack. US federal investigators are examining the incidents, and Belgian and French prosecutors have opened cases. As of November 9, 2026, no government has published indicators of compromise or named a perpetrator. The technique is well established, but the attribution is not, and no public technical evidence ties the blood service incident to the same actor as the supermarket attacks.

The attackers needed no zero-days and no custom malware. Honeypot data points to default passwords as the main way in, while the disclosed flaws appear largely unused. They relied on exposed management interfaces and weak configuration, and rather than targeting individual display cases, they took over the store-level system manager that runs the whole refrigeration estate.