Hackers Switch Refrigeration Controllers to Defrost, Forcing European Supermarkets to Bin Spoiled Food

Unit 42 has been tracking cyberattacks on European refrigeration systems since at least October 2026. Unidentified attackers gained unauthorised access to refrigeration controllers and set them to defrost mode. Hundreds of supermarkets had to throw away spoiled food. The timing is particularly damaging, because retailers need healthy stock levels as shoppers spend more over the holiday period.

The first wave hit overnight between 11 and 12 October 2026 and mainly targeted around 700 supermarkets in France. A second wave followed overnight between 1 and 2 November 2026, spreading to at least 10 more European countries and affecting an estimated 100 to 115 retail locations. French authorities have also disclosed that refrigeration systems at medical facilities were affected, though there is no evidence that blood products were spoiled. According to multiple sources, temperatures in some units were raised as high as 50°C (122°F), and in some cases the activity caused fires.

How the attackers got in has not been confirmed. There is widespread speculation that devices were running vulnerable software versions or still used default manufacturer credentials that were easy to find. On 5 and 6 November 2026, Unit 42 identified more than 5,000 internet-exposed devices from manufacturers named in a CERT-FR advisory. That figure does not necessarily mean those devices are vulnerable.