Industry update· 6 Nov 2026

Hackers turned up the heat on Europe's supermarket fridges

No clever exploit. Just a fridge with its front door open to the internet.

A supermarket chest freezer full of frozen food under glass lids — Photo: Eduardo Soares on Unsplash

Someone logged into the control panel of a supermarket freezer and turned the heat up. Then they did it to hundreds more.

That is more or less what has been happening across Europe since October. Supermarkets in France, Belgium, Italy, Sweden, Germany, Romania and more have been throwing away food after their refrigeration systems were tampered with remotely. This week it reached the UK, where a small number of meat suppliers were caught up in it.

If you don't sell food, you might think this has nothing to do with you. We'd push back on that. The way in wasn't clever, and that's exactly why it matters.

What actually happened to the supermarket fridges?

Refrigeration in a modern shop is run by a small box on the wall, a controller, that sets the temperature, defrost cycles and alarms. Those boxes are often connected to the internet so an engineer can check on them without driving out.

In the attacks, someone got into those controllers and changed the settings. Defrost thresholds were pushed up, the cooling stopped doing its job, and stock slowly cooked. In France, reports say many cabinets climbed to around 50°C within six hours, and one Normandy store reported 80°C.

Plain English

The small computer that runs a fridge or freezer system. It has a login page, just like your router does.

Figures as reported for the October 2026 French attack. A starting point of minus 18°C is a normal freezer setting.

How did it unfold, and who was hit?

11 Oct

Overnight, supermarkets across France see their refrigeration tampered with. Reports mention hundreds of stores across several chains.

The controller maker Danfoss says it had already told customers not to leave these systems directly reachable from the internet.

2 Nov

A second wave. Stores in at least nine EU countries report problems: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden.

3 Nov

Germany (four supermarkets) and Romania (six) report attacks, and the UK confirms it has been hit too. The EU says these are "not isolated incidents." The NCSC's chief executive, Richard Horne, warns of a possible "unprecedented rise" in cyber incidents in the coming months.

4 Nov

French blood banks report that temperature and defrost thresholds had been set far too high. Their alarms caught it, the blood products were moved, and none was damaged.

The damage varies by place. A Sicilian Coop manager told an Italian paper "we had to throw away everything." Italy's government called the impact limited. In Britain, the Association of Independent Meat Suppliers says a few of its members "operate the same software" as the targeted supermarkets and "none that have been affected have lost any meat."

We still don't know who did it or why. Nobody has claimed it. Romania's cyber security director called it "semi-amateurish" and said he doesn't suspect a state.

Why was it so easy?

Here's the uncomfortable part. A security analyst at Darktrace put it bluntly: nobody broke into these systems with a zero-day. They got in through controllers that were reachable from the internet, running old firmware, with default passwords.

We should be careful here. Different reports point at different weak spots, and not every detail is confirmed. One Swedish chain said its fridges were on old 4G connections. A widely repeated claim says some controllers accepted "admin" and the date as a password, but that rests partly on a social media post, so treat it as unverified. What is on the record is that researchers flagged a login weakness in some of these controllers in 2025, and a fix was released that August. Plenty of boxes were never updated.

How it got in

1Open to the internet
The controller's login page can be reached by anyone.
2Weak or factory login
Default password, or an old version nobody updated.
3Settings changed
Defrost and temperature limits are pushed far too high.
4Stock thrown away
Hours later, the freezer is warm and the shelves are bare.

Simplified from reporting on the French and European attacks. Individual cases differed and not every detail is confirmed.

Richard Horne, NCSC: "Far too many of our organizations and supply chains rest on weak technology and operational foundations."

Why should a small business care?

Nobody thinks of the fridge as IT. It was installed by a refrigeration engineer, not your IT person. It's not on any asset list. Nobody has ever logged in to change the password, because it was working. Most small businesses have a few of these: the door entry panel, the CCTV recorder, the smart heating, the alarm system with the remote access app.

Suppliers carry your risk. The meat suppliers hit in the UK say they were collateral damage, caught up because they run the same software as the supermarkets. If a customer or a supplier you depend on gets hit, you feel it too.

This is the oldest problem there is. It's the same story we told in default passwords and unpatched software. The only new thing is the target.

What should you actually do?

Make a list of everything that plugs in and connects. Not laptops, the other stuff. Fridge controllers, cameras, alarms, door entry, building management.
Ask whoever installed it if it's reachable from the internet. If they can't answer, treat that as a yes. Deloitte's Frank Groenewegen told Reuters the same: if you don't know, take them off the public internet immediately.
Change the factory login. Every one. Use a proper password, written down somewhere sensible, not the sticker on the side.
Apply the update. If the maker has released a fix, ask when it was last applied. Our 14-day patch rule explainer covers how fast that should be.
Ask your key suppliers the same questions. Short email, plain wording. Their answer tells you a lot.

Worth knowing

If it has a login page and a network cable, it needs the same care as your laptop. The fact that a fridge doesn't look like a computer is exactly what attackers are relying on.

Quick answers

Were UK businesses really affected by the fridge hack?

A small number, yes. The NCSC says it is supporting a small number of UK organisations affected through vulnerabilities on their systems, and a meat suppliers' trade body says a few of its 300+ members saw fridges warmed up. The trade body says none of them lost any meat, and the NCSC calls the national impact minimal.

Do I need to worry if I don't run a food business?

Not about fridges specifically, but about the same kind of kit. Most small businesses have something connected to the internet that nobody thinks of as IT: a door entry system, a CCTV recorder, a heating controller, a printer. If it's reachable from outside and still has its factory login, it's the same problem.

Does Cyber Essentials cover things like fridge controllers?

Only if they're inside your scope. Cyber Essentials is about the devices and services you define as in scope, and a refrigeration controller may well sit outside that. The habits it checks for (change default passwords, don't expose admin pages to the internet, apply security updates) are exactly the ones that would have stopped this, though.

If you're not sure what's sitting on your network that shouldn't be reachable from outside, ReadinessWatch checks your exposure every week, or book a free 30-minute call and we'll talk it through.