Cyberattacks are no longer limited to data theft or computer lockouts. On November 2, incidents targeting refrigeration systems were reported in at least nine European countries, following a massive wave in France in October.
In several stores, temperatures in refrigerators and freezers were pushed up to 50 °C, forcing retailers to remove or discard fresh and frozen products.
Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden are among the countries affected by this new wave. At this stage, no group has claimed the operation and investigators have not established that a single actor is behind all the incidents.
The essentials
Up to 50 °C: some refrigeration installations were remotely set to temperatures incompatible with food preservation.
Nine European countries at least: incidents confirmed or under investigation as of November 2, following the French wave of October 12.
Unknown author: no public claim and no evidence that a single coordinated operation explains all cases.
Tunisia: Hédi Baccour says that hypermarkets have taken precautions, but the proliferation of remotely controllable equipment demands particular vigilance.
France had sounded the first warning
The first major wave appeared during the night of October 11-12 in France. Hackers took control of refrigeration systems used in hundreds of retail outlets and remotely altered operating parameters.
According to the French Finance Minister, about 700 of the country’s roughly 10,000 supermarkets had been affected to varying degrees. Temperatures reached up to 50 °C for several hours in some installations, resulting in the destruction of fresh and frozen products.
Precise figures by chain remain variable depending on sources and subsequent tallies. Tunisie Numérique therefore does not retain here local tallies that could not be confirmed with sufficiently solid evidence.
The weak point: obsolete firmware and remotely accessible controllers
Modern refrigeration equipment is often connected to remote management systems. A technician can thus monitor temperature, modify a setting, schedule a defrost, or intervene remotely without going to the store.
This functionality represents a significant operational gain, but becomes a vulnerability when remote access is poorly secured or when software is not properly maintained.
Danfoss, one of the manufacturers of systems involved in the French wave, stated that the affected equipment was operating with obsolete firmware, lacking the latest patches. This phrasing is important: it does not mean that all affected controllers were officially end-of-life.
An older range, AK-SM 800, did indeed reach end of support in May 2021. But other equipment may remain supported while still being vulnerable if updates are not applied. Security responsibility therefore does not rest solely on the manufacturer: it also concerns the operator, the installer, and the service provider who maintains remote access.
How a normal defrost function becomes a weapon
Hackers do not necessarily need to install complex malware. Once connected to the refrigeration controller, they can exploit the equipment’s normal functions.
Defrosting is the most telling example. A freezer must regularly interrupt its normal operation to remove frost. Attackers can artificially prolong this cycle or modify the target temperatures.
Early French investigations show they would also have lengthened certain defrost cycles by several hours or altered alarms. The system could then interpret the temperature rise as a normal maintenance phase, delaying the triggering of alerts.
It is this detail that turns a cyber intrusion into physical destruction of merchandise: while the system thinks it is operating normally, the actual product temperatures keep rising.
The simplest measure: an alarm independent of the controller
For industrial systems security specialists, one of the most concrete lessons is not to rely on a single system to control the cold and trigger the alarm.
An independent temperature probe or recorder, connected to an alert channel separate from the main controller, can serve as a second line of defense. Even if an attacker alters the defrost program or disables the alarm embedded in the telemanagement system, this separate device continues to measure the real temperature and can alert staff.
The benefit is not only technical. In this type of incident, the difference between saving a shelf and destroying several tons of product can hinge on mere minutes, especially at night.
A new wave on November 2 in at least nine countries
Three weeks after France, new incidents were reported across Europe. The observed modus operandi is similar, but authorities have not yet proven that all of them belong to the same campaign.
In Belgium, Carrefour confirmed that 15 stores had been affected, while several tens of Delhaize stores experienced disruptions. Incidents were also reported at Intermarché, Spar, and in at least one IKEA store.
In Ireland, the Musgrave group said that the refrigeration systems of 13 SuperValu stores were affected. Refrigerated and frozen products were withdrawn from sale as a precaution before the installations were restored.
In Sweden, ICA reported several incidents. At Coop, sources mention six or seven stores affected. In one ICA store, the freezers reached 50 °C.
In the Netherlands, Danfoss reported at least 17 companies affected, including local shops, butcheries and cold storage facilities.
In Portugal, the Les Mousquetaires group confirmed an attack against seven Intermarché stores. The company notes that its supply chain was not affected.
In Italy, several Coop stores operated under franchise in Sicily were affected. Italian authorities have also stepped up monitoring and asked operators in distribution, food logistics, and industrial cold to urgently check their remote-management systems.
Anomalies or attacks were also reported in Estonia, Finland and Luxembourg.
Nearly 13,000 refrigeration services visible on the Internet
A study by Forescout, reported by Euronews, shows the scale of the potential problem. Researchers identified 12,976 refrigeration management services exposed on the Internet, associated with 6,017 IP addresses in 99 countries and territories.
Being visible on the Internet does not mean being hacked. But this exposure makes it easier to search for poorly configured systems using default passwords or running outdated software versions.
According to the same study, a large portion of visible Danfoss systems used firmware older than versions containing the latest security patches.
Who is attacking supermarkets? No author identified
At this stage, no solid attribution is possible. No group has claimed both the French and European waves, and no generalized ransom demand has been made public.
This absence of a financial claim fuels the hypothesis of sabotage rather than a classic ransomware operation. But it remains only a hypothesis: investigators have not established the identity of the perpetrators, their motivation, or a single operational link between all incidents.
The Belgian federal prosecutor’s office has opened an investigation, and authorities in several European countries are analyzing the compromised systems.
European food safety is not at risk at this stage
The losses are real for the retailers involved: destroyed food, shelves emptied temporarily, technical interventions, and sometimes thousands or tens of thousands of euros in damages per store.
The European Commission described the repetition of these incidents as an attempt to disrupt the food chain and undermine consumer confidence. It did specify, however, that the European Union’s food safety was not at risk at this stage.
Logistics centers and deliveries remained operational in several affected groups. The consequences observed thus remain mainly local: stock losses, temporary unavailability of certain shelves, and costs to restore service.
Tunisia: Hédi Baccour assures that retailers have taken precautions
The question is not theoretical for Tunisia. From the first French wave, Hédi Baccour, president of the National Syndicate Chamber of Large Retail Chains, had responded to Tunisie Numérique on the exposure of the Tunisian sector.
He explained that new technologies allow large retailers to monitor and control their refrigeration equipment remotely, notably from company headquarters or other sites.
These tools are used in particular to optimize energy consumption and to track temperatures, the state of equipment, and their performance. Baccour had however acknowledged that this digitization creates new risks and highlighted the need to protect systems against intrusions.
He had affirmed that Tunisian retailers had put precautions in place to secure their IT infrastructures. These assurances do not mean the risk is zero: the level of protection depends notably on the models of controllers used, the software versions, the network configuration, the management of remote access, and the alert procedures.
No comparable incident affecting a Tunisian large retailer is reported in public sources consulted as of November 3.
What a Tunisian retailer should check
1. Inventory refrigeration controllers: model, firmware version, and manufacturer support status.
2. Check Internet exposure: no telemanagement interface should be directly accessible via just a public address and a password.
3. Secure remote access: VPN, multi-factor authentication, and individual accounts for technicians and contractors.
4. Separate networks: the cold-control system must be isolated from the office network and other company systems.
5. Install an independent temperature alarm: a sensor and alert channel not dependent on the remotely controlled refrigeration controller.
6. Monitor configuration changes: unexpected modification of a setting, a defrost cycle, or an alert threshold.
7. Test nighttime response: define who receives the alert, who calls the maintainer, and who can quickly bring the equipment back to a safe mode.
When cyber becomes a physical threat
This European wave illustrates a major evolution in cybersecurity: a cyberattack can now directly inflict physical damage.
In an operational technology system, or OT, the software controls a temperature, a pump, a motor or an industrial installation. A malicious command thus does not merely result in a blocked screen: it can alter a product, interrupt production, or render equipment out of service.
For Tunisian retailers, but also for the food industry, refrigerated warehouses, pharmacies, and certain health facilities, the European lesson is concrete: a connected piece of equipment must be secured like an IT system, but also monitored like a physical machine.
And in the specific case of the cold chain, one simple rule emerges: if the same controller can both change the temperature and silence the alarm, a second independent alert is no longer a luxury. It becomes a business continuity measure.
