Stores report rising temperatures
The countries reporting failures included Sweden, Belgium, Luxembourg, Ireland, Italy and Estonia. One Swedish supermarket said attackers had set its refrigerators and freezers to 50 degrees Celsius (122 degrees Fahrenheit).
German stores were also affected, with cases in North Rhine-Westphalia, Lower Saxony and Bavaria, according to tagesschau.de. At an Edeka supermarket in Lilienthal, the owner told Radio Bremen he measured 70°C at the fresh-food counter and 30°C in the cold rooms. The store discarded a full container of food. In Reisbach, Lower Bavaria, an Edeka branch's refrigeration was changed overnight to heat at 50°C.
Remote controls used to turn cooling into defrosting
The attackers remotely activated defrost mode, raising temperatures inside the refrigeration units. Belgian refrigerator manufacturer Sabcobel, which makes some of the affected equipment, told the BBC that the units' evaporators had been switched to that mode.
French cybersecurity investigators traced the problems to outdated remote-control modules from Denmark's Danfoss and U.S.-based Copeland. France's cybersecurity agency, ANSSI, identified compromised controllers in the Danfoss AK-SM and AK-SC ranges, along with Copeland and Dixell xweb systems.
Danfoss said most affected systems were older models that no longer received software or security updates. Experts interviewed by the Associated Press said the attacks exploited known vulnerabilities, controllers exposed to the internet, firmware past the end of its supported life and default passwords. They found no evidence that AI had been used.
Earlier attacks in France and elsewhere
The November disruptions came after hundreds of French supermarkets were affected in mid-October 2026. Retailers told NPR that the October 12 attack targeted roughly 150 to 200 Intermarché stores and nearly 100 Coopérative U outlets. Carrefour was among the other chains affected.
NPR also reported incidents outside Europe. Following a May 2026 attack on an Israeli food-production plant, Israeli incident-response firm Profero attributed it to an Iranian military-linked group calling itself Cyber Isnaad Front.
In August 2026, multiple U.S. military commissaries experienced what the Pentagon called a "possible refrigeration disruption". Investigators were treating that incident as a cyberattack, with some evidence pointing toward Iran.
Responsibility remains unknown
As of November 3, 2026, no one had claimed responsibility for the European attacks, and investigators had established neither who carried them out nor their motive.
EU Agriculture Commissioner Christophe Hansen said the attacks were a deliberate effort to disrupt the food chain and undermine consumers' trust. He expressed deep concern about their recurrence but said that, as of November 3, food safety in Europe was not at risk.
