Imagine you are a supermarket manager arriving at work one morning to discover that the refrigerators and freezers in your supermarket have been running at 50°C overnight.
Thousands of pounds worth of food have been spoilt. Refrigeration equipment may have suffered damage. Customers are unable to purchase essential products, and the business faces substantial financial losses.
Now imagine that nobody physically entered the building, no equipment was stolen, and no ransomware appeared on the company’s computers.
Instead, someone simply logged into the refrigeration control system and instructed it to change its operating temperature.
This is precisely the type of incident that has recently affected supermarkets across Europe.
In the last few weeks of October, cyberattacks against supermarket refrigeration systems in France and other European countries caused widespread disruption, with hundreds of stores reportedly affected. A further wave of incidents on 2 November extended the problem across several more European countries, including Belgium, Sweden, Ireland, Luxembourg and Estonia.
The incidents demonstrate an important fact of modern cybersecurity – An attack does not need to target a computer, steal information or deploy malware to cause serious damage.
When computer systems control physical equipment, compromising those systems can have consequences in the real world.
For cybersecurity professionals accustomed to protecting laptops, servers, cloud infrastructure and corporate networks, these attacks provide a particularly important lesson In the modern world, anything connected to a network can, and will be a target.
And the same principle applies to factories, hospitals, power stations, water treatment facilities and countless other environments.
So, what actually happened?
During October 2026, attackers remotely manipulated refrigeration systems at hundreds of supermarkets, particularly in France. The affected businesses included major retailers such as Carrefour, Intermarché, E.Leclerc and Monoprix.
Reports described refrigeration units being forced into defrost cycles or having their temperature settings altered. Some systems reportedly reached temperatures of approximately 50°C.
For equipment designed to keep food refrigerated or frozen, this is obviously disastrous.
The attacks resulted in:
- Large quantities of food being spoiled and discarded.
- Significant financial losses for retailers.
- Disruption to supermarket operations.
- Reports of fires associated with some affected refrigeration equipment.
A second wave of attacks was reported on 2 November, affecting supermarkets and other retailers across several European countries.
Why would someone attack a refrigerator?
At first glance, the motivation seems unusual.
There is no obvious financial benefit from destroying supermarket food unless the attacker is attempting extortion, causing economic damage, or pursuing some other objective.
However, attacks against OT systems can have several motivations:
| Motivation | Explanation |
|---|---|
| Financial | Extortion, ransomware or disruption designed to generate payment. |
| Sabotage | Deliberately damaging equipment or disrupting operations. |
| Political | Creating economic disruption or undermining public confidence. |
| Demonstration | Showing that an organisation or infrastructure can be compromised. |
| Criminal experimentation | Testing capabilities against real-world systems. |
At the time of writing, attribution remains uncertain. Responsibility for the incidents has not been established – No threat actors have publicly stated that they were responsible for the attacks, but speculation has included state-sponsored activity and politically motivated sabotage.
The important point is that the attack demonstrates how relatively straightforward access to a control system can produce disproportionately serious consequences.
What actually controls a fridge?
To understand how the attack worked, we need to look beyond the refrigerator itself.
A modern supermarket refrigeration installation is not simply a collection of independent appliances. It is often a network of interconnected control systems designed to monitor, manage and optimise refrigeration across an entire store.
A large supermarket needs to keep a close eye on things like electricity prices – the ability to adjust the temperature of the refrigeration units in specific stores when the outside temperature fluctuates, or when the prices alter can save the stores thousands of pounds in bills.
Several technologies make this possible. the se technologies are commonly called Operational Technology (OT).
Operational Technology refers to hardware and software used to monitor or control physical processes.
Examples include:
- Refrigeration and heating systems.
- Manufacturing machinery.
- Industrial pumps and valves.
- Power generation and distribution equipment.
- Water treatment systems.
- Building management systems.
Traditional Information Technology (IT) primarily deals with information: processing, storing and communicating data. OT, by contrast, interacts with the physical world.
This distinction is important, but it is not absolute. Modern OT increasingly relies on existing IT technologies, including operating systems (Windows, Linux, Android), Networking technologies (Ethernet, TCP/IP, WiFi, Mobile) cloud services and remote management platforms.
The two environments are becoming increasingly interconnected.
Industrial Control Systems (ICS)
An Industrial Control System (ICS) is a general term for systems used to control industrial processes.
ICS encompasses several different technologies, including:
- Programmable Logic Controllers (PLCs).
- Supervisory Control and Data Acquisition (SCADA).
- Distributed Control Systems (DCS).
- Human-Machine Interfaces (HMIs).
These technologies perform different functions, but they frequently work together.
A supermarket refrigeration installation may use industrial controllers, sensors, network connections and central management software rather than a traditional SCADA system.
Programmable Logic Controllers (PLCs)
A PLC is a specialised industrial computer designed to control physical equipment.
It receives information from sensors, executes programmed logic and sends commands to equipment.
For example, a refrigeration PLC might:
- Receive temperature readings from a sensor.
- Compare the readings against a configured temperature range.
- Activate a compressor if additional cooling is required.
- Control fans and refrigeration valves.
- Trigger alarms if temperatures exceed acceptable limits.
A PLC is essentially a computer that interacts directly with machinery.
Unlike a conventional desktop computer, it is designed for reliable operation in industrial environments, often running continuously for years.
Supervisory Control and Data Acquisition (SCADA)
SCADA systems allow operators to monitor and control industrial processes across multiple locations.
A SCADA environment typically includes:
- Sensors and field equipment.
- Industrial controllers.
- Communication networks.
- Central monitoring software.
- Operator workstations.
A SCADA system might allow an engineer to monitor water levels across a regional water network or control equipment at multiple electricity substations.
The key distinction is that SCADA provides supervisory monitoring and control, while PLCs and other controllers often execute the immediate control logic.
Human-Machine Interfaces (HMIs)
An HMI provides the interface through which an operator interacts with an industrial system.
It may be a touchscreen mounted beside a machine, a desktop application in a control room, or a web-based management interface.
An HMI allows authorised personnel to:
- View operational status.
- Change settings.
- Start or stop equipment.
- Acknowledge alarms.
- Modify operating parameters.
In the refrigeration attacks, the management interface was particularly important because it allowed remote users to interact with the refrigeration controllers.
The attacker did not necessarily need to understand the mechanical workings of every refrigerator.
They needed access to the interface that controlled them.
How the attackers compromised the refrigeration systems
This is where the incident becomes particularly interesting from a cybersecurity perspective. The attackers did not necessarily need to exploit an advanced vulnerability, deploy sophisticated malware or penetrate the supermarket’s corporate IT infrastructure.
The reported incidents highlight a combination of weaknesses involving remote access, exposed management interfaces, inadequate authentication and outdated firmware.
The precise technical intrusion method has not been conclusively established for every affected installation.
Security researchers identified vulnerabilities in relevant refrigeration controllers, but public reporting indicates that French authorities attributed the initial attacks primarily to elementary security failures, including internet exposure and weak passwords.
Investigators did not confirm that the publicly disclosed vulnerabilities were the ones exploited.
The vulnerabilities behind the attack
The refrigeration incidents highlight several security weaknesses that are particularly relevant to OT environments.
- Internet exposure – Industrial equipment is often connected to the internet for convenience.
- Default and weak credentials – Many industrial devices are deployed with default passwords.
- Outdated firmware – Firmware is the software embedded in hardware devices, and unlike a desktop application, firmware updates may require a complex series of processes to take place such as Scheduling engineering work for less-busy times, testing equipment compatibility, and even obtaining manufacturer approval. Consequently, industrial equipment may remain unpatched for considerably longer than conventional IT systems.
- Poor asset management – One of the most significant problems in OT security is simply knowing what exists. A retailer may have an extensive corporate IT asset inventory but no comprehensive record of refrigeration controllers, heating systems or contractor-installed equipment.
- Third-party access – Industrial environments frequently rely on external contractors. These may include refrigeration engineers, building maintenance companies, equipment manufacturers and specialist service providers.
Other significant OT cyberattacks
The refrigeration attacks are not an isolated phenomenon. Over the past two decades, cybersecurity incidents have demonstrated that attackers can compromise industrial systems and manipulate physical processes.
Some attacks have caused financial losses, and others have threatened public safety or national infrastructure.
The following examples illustrate different ways OT systems can be compromised.
Stuxnet: The attack that changed industrial cybersecurity
- Date: Discovered in 2010
- Target: Iranian nuclear enrichment infrastructure
- Technology: Windows systems, Siemens industrial control software and PLCs
Stuxnet remains one of the most significant examples of a cyberattack designed to manipulate physical equipment.
The malware targeted industrial systems associated with uranium enrichment.
It used several Windows vulnerabilities and propagation mechanisms to reach systems running Siemens industrial control software. Once inside the target environment, it manipulated PLC operations while attempting to conceal its activity from operators.
The significance of Stuxnet was not simply that malware infected industrial computers, it demonstrated that attackers could manipulate industrial control logic to damage physical machinery.
Ukraine’s power grid attacks
- Date: 2015 and 2016
- Target: Ukrainian electricity distribution infrastructure
- Technology: SCADA, industrial control systems and operational networks
In 2015, attackers gained access to electricity distribution systems and caused power outages affecting hundreds of thousands of customers.
The following year, another attack used malware designed to interact with industrial electrical equipment.
These incidents demonstrated that attackers could move from conventional IT systems into operational networks and manipulate infrastructure.
Triton / Trisis: Targeting safety systems
- Date: 2017
- Target: Industrial safety systems
- Technology: Schneider Electric Triconex safety controllers
Triton, also known as Trisis, was a particularly concerning attack because it targeted industrial safety systems designed to prevent dangerous conditions.
They may automatically shut down machinery if temperatures, pressures or other operating parameters become unsafe.
The attackers attempted to compromise the systems responsible for these protective functions, and demonstrated that cyberattacks against OT can extend beyond production equipment and target the safety systems designed to protect people.
Oldsmar water treatment attack
- Date: 2021
- Target: Water treatment facility in Oldsmar, Florida
- Technology: Remote access and industrial control software
In February 2021, an attacker accessed a water treatment system and attempted to increase the concentration of sodium hydroxide in the water supply.
The attacker reportedly manipulated the system’s controls to increase the chemical concentration significantly. Fortunately, an operator noticed the change and reversed it before the water was distributed.
The incident demonstrated how compromising a relatively small industrial system could potentially affect public health. It also highlighted the importance of monitoring control-system changes and ensuring that remote access is appropriately secured.
Colonial Pipeline
- Date: 2021
- Target: US fuel pipeline operator
- Technology: Corporate IT systems and operational infrastructure
The Colonial Pipeline incident is often discussed in the context of ransomware and critical infrastructure. Here, attackers compromised the organisation’s IT environment and deployed ransomware. This meant that the company could not manage the safety of the high-pressure fuel pipeline
The company subsequently shut down pipeline operations as a precaution causing significant disruption to fuel distribution across large parts of the United States.
The problem with insecure industrial protocols
Many industrial protocols were designed decades ago, when cybersecurity was not a primary consideration.
Examples include:
- Modbus.
- DNP3.
- BACnet.
- EtherNet/IP.
- PROFINET.
These protocols are used for communication between industrial devices, controllers and supervisory systems. Many legacy implementations lack strong authentication or encryption.
This does not automatically make every device using these protocols vulnerable, but if an attacker gains access to a network where these protocols are used, they may be able to observe communications or interact with industrial equipment in ways that would be impossible from an isolated network.
This is why industrial network segmentation and access control are so important.
These recent supermarket refrigeration attacks demonstrate that cybersecurity is no longer confined to protecting computers, servers and information – It is about protecting the systems that control the physical world.
A refrigeration controller may seem like an unlikely target, but it illustrates a fundamental security problem in that a device that is connected to the internet, running outdated software and protected by inadequate authentication can become an entry point for attackers.
Once compromised, the consequences may extend far beyond the device itself.
These same vulnerabilities can affect heating systems, manufacturing equipment, water treatment plants, electrical infrastructure and other industrial environments.
The next major cyber incident may not involve stolen customer records or encrypted servers.
It might involve a factory that stops producing food, a water treatment system that behaves unexpectedly, or a hospital emergency ward that suddenly cannot monitor patient health.
