ไทย
English
A cyberattack affecting refrigeration systems at stores across Europe has once again drawn attention after reports revealed that refrigerators and freezers at multiple locations were remotely manipulated. The incidents involved changes to temperature settings, refrigeration system shutdowns, and activation of Defrost mode that caused temperatures to rise, forcing some stores to take immediate action to prevent further losses.
The latest incidents occurred shortly after France experienced a cyberattack targeting supermarket refrigeration systems in October 2026. With similar incidents occurring across multiple locations within a relatively short period, greater attention is being placed on the security of connected devices and systems, particularly those that support remote management.
More Than 115 Stores Across Europe Were Affected
BleepingComputer reported on November 2, 2026, that more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia were affected by refrigeration system disruptions.
The affected locations covered several types of stores, including supermarket chains that confirmed problems such as ICA, Coop, Ahold Delhaize, Carrefour, Spar, Intermarché, and SuperValu. In the Netherlands, at least 17 butcher shops and neighborhood stores were also affected.
According to the report, attackers remotely changed temperature settings, while some incidents involved refrigerators and freezers being shut down or Defrost mode being activated, causing temperatures to rise.
The impact varied across locations. Some stores experienced complete refrigeration and freezer shutdowns, while others were able to maintain partial operation. Coop in Sweden also reported one case in which the system began generating heat. In another incident involving an ICA store in Sweden, the store manager reported that the temperature setting had been changed to +50°C overnight and could not be restored, forcing the store to discard affected frozen food.
At the same time, BleepingComputer noted that it remains unclear whether all affected stores were targeted as part of a coordinated attack or through separate incidents in different locations.
These incidents demonstrate how cyberattacks can directly affect business operations. When digital systems control physical equipment, changes to system settings can have an immediate impact on products, services, costs, and Business Continuity.
France Had Recently Experienced a Similar Attack
Around one month before the latest incidents, France experienced a cyberattack targeting refrigeration systems across several retail chains. BleepingComputer reported on October 12, 2026, that approximately 250–350 stores were affected.
Attackers gained control of Refrigeration Controllers running outdated Danfoss Control Software and remotely activated Automatic Defrost, causing temperatures inside refrigerators to rise. The affected retailers included Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U.
The incident caused losses involving fresh and frozen food products and also led to an investigation by the Paris Public Prosecutor’s Office.
For more details about the incident in France, including vulnerabilities, OT systems, and Proactive OT Security, read “Lessons from the Cyberattack on Refrigeration Systems in France and the Importance of Protecting OT with Proactive Cybersecurity”
Repeated Incidents Place Greater Importance on Exposure
For the latest incidents, Sabcobel, a refrigeration service provider supporting several affected locations, stated that attackers exploited the same vulnerability previously used in the attack in France the month before.
This information places greater importance on how systems can be accessed. Organizations need to understand which systems are externally accessible, who has Remote Access privileges, and what security measures are in place to control those access channels.
Many OT, IoT, and control systems are connected to networks to support monitoring, management, and remote maintenance. These connections increase the Attack Surface, particularly when systems contain vulnerabilities or remain externally accessible without appropriate security controls.
Examples of risks that organizations should assess include:
- Management Interfaces accessible from the internet
- Devices running outdated Firmware or Software
- Systems that are no longer supported by the manufacturer
- Remote Access without appropriate access control and authentication
- User accounts or Credentials that are not properly managed
- Connections with Third-Party Service Providers where the organization has limited Visibility
These systems should be included within the organization’s Cybersecurity management processes because connectivity can provide an entry point for attackers to access systems supporting business operations.
OT Security Is Directly Connected to Business Operations
The incidents across Europe clearly demonstrate the connection between Cyber Risk and Operational Risk.
For retail businesses, refrigeration systems directly affect product quality and safety. When these systems malfunction, businesses may face product losses, system recovery and management costs, and disruption to store operations.
For other industries, similar impacts could affect building control systems, manufacturing machinery, warehouse systems, utilities, or other network-connected Infrastructure.
Organizations should therefore extend Cybersecurity coverage across Servers, Endpoints, data, devices, and systems associated with Business Operations. This includes identifying which devices are connected to the network, which systems are externally accessible, who has Remote Access privileges, and whether those devices are still receiving Security Updates from their manufacturers.
Knowing What Is Connected Helps Organizations Manage Risk Faster
The incidents in France and other European countries highlight the importance of maintaining Visibility across organizational Assets and Exposure. Having clear information about IT and OT Assets helps organizations identify systems that are externally accessible, vulnerabilities requiring remediation, and Remote Access connections that may require additional restrictions.
Organizations should regularly assess their External Attack Surface, vulnerabilities, and Firmware, while managing Network Exposure and Remote Access according to operational requirements. Monitoring should also be used to identify abnormal behavior or unauthorized changes within systems.
For systems directly supporting Business Operations, the speed of detecting abnormal activity can influence the scale of the impact. Early detection allows organizations to respond faster and reduce the likelihood of the incident affecting products, systems, or service availability.
Strengthen IT and OT Security with BMSP
Cybersecurity covers data, IT systems, and systems supporting organizational operations. When these devices and systems are connected to networks, cyber risks can directly affect Business Operations and Business Continuity.
BMSP helps organizations assess and strengthen Cybersecurity across risk identification and assessment, Vulnerability and Attack Surface management, and continuous threat detection and monitoring, supported by End-to-End Cybersecurity and IT Managed Services.
Comprehensive Visibility and continuous risk management help organizations identify vulnerabilities, internet-exposed systems, and Remote Access connections that require improvement, enabling risks to be addressed before those access points are exploited in an attack.
References
BleepingComputer. Hackers disrupt refrigeration systems at European supermarkets. 2 November 2026.
