Retail refrigeration systems compromised across Europe

An incident targeting refrigeration and freezer units disrupted supermarkets across Western Europe on Monday 2 November 2026, forcing stores to discard affected food.

It follows a similar incident in France in October, when threat actors compromised cooling units at hundreds of retailers, causing fires and food losses. According to security researchers, the threat actors exploited weak credentials on unpatched, internet-exposed devices, in combination with a vulnerability in a software those devices were running, made by Danish firm Danfoss.

No direct link between the two incidents has been established. However, researchers report that some of the devices affected in November also use Danfoss temperature control technology.

Who is responsible?

No threat actor has claimed responsibility for the incidents and attribution remains uncertain. Absence of public claims or extortion demands rules out financially motivated cybercrime, suggesting activist or a nation state activity.

Some researchers see the opportunistic nature of the October incident as a sign of hacktivism, possibly linked to public unrest in France. Others argue that the disruption to essential services has wider economic and public health implications, which, in conjunction with the sophisticated defence evasion techniques lends to a deliberate sabotage by a nation state.

Our assessment

We assess that the October and November incidents are likely part of a coordinated campaign to disrupt essential services in Europe. There is a realistic possibility that the campaign has been conducted by a nation state actor.

The broader context

The incidents come amid political instability and public unrest across Western Europe, driven by a cost-of-living crisis. Several major European democracies are heading into election years, with polling showing growing disillusionment with centrist parties and liberal democratic institutions, which many voters blame for the perceived deteriorating economic conditions and rising prices. Disruption to food supply is likely to add to these pressures, even if only marginally. It also risks deepening public disillusionment, as empty shelves and spoiled food can be seen as a tangible sign that governments cannot keep essential services running.

These incidents also come as Europe finds itself increasingly at odds with US geopolitical interests, namely when it comes to digital exports, while facing hybrid warfare and economic pressure from Russia and China. Incidents that hit European companies through vulnerable European-made software undermine the EU’s digital sovereignty ambitions and expose the limits of its ability to respond quickly to external threats.

What this means for you

Whoever is responsible, attribution matters less to you as a defender than the security gap these incidents expose.

In France, the threat actors reportedly gained access to a fleet of unpatched devices by exploiting default credentials combined with a software vulnerability. Regardless of who carried out the attack, the root cause is the same. The devices were connected to the internet without even basic security measures in place.

The problem is not unique to refrigeration or retail. Cameras, security alarms, and even cars, not to mention industrial equipment that were once primarily mechanical now have software components with internet access and can be monitored or controlled remotely. Each insecure device connected to the internet expands the attack surface and attracts malicious activity.

If your organisation delivers essential services, we recommend that you:

• Complete an inventory of your connected devices.
• Connect devices to the internet only when necessary.
• Secure remote access and use strong, unique credentials.
• Patch devices regularly while they are still supported and run hardened gold builds on legacy devices.