Hacked fridges, spoiled food — the safety decision behind Europe's supermarket attacks
At an ICA supermarket in Sjöbo, southern Sweden, the freezers were set to 50°C overnight on 1–2 November. By morning, staff were loading frozen goods into shopping trolleys to be thrown away, AP photographs showed.
Nothing had broken down. Someone had apparently told the freezers to heat up.
That is why this story belongs in a food-safety publication, not only a cybersecurity one. Across Europe, suspected attacks on refrigeration controllers have produced no stolen data and no ransom demand that we know of. They have produced something more tangible: a retailer standing in front of a warm freezer, asking which food is still safe to sell.
What happened across Europe
The larger episode came first, in France, overnight on 11–12 October. Attackers took control of refrigeration controllers at hundreds of supermarkets and forced them into defrost mode, Reuters and AFP reported. Les Mousquetaires, which owns Intermarché, said fridges at about 150 of its stores were heated to as high as 50°C for six hours, and that it discarded all affected food to avoid health risks. Carrefour reported 80 stores hit; Coopérative U, 80 of 2,000. Paris prosecutors opened an investigation and cited food losses and fires.
Store counts vary by source, from roughly 400 to 700; losses of "tens of millions of euros" are company estimates, not audited totals.
The second wave struck overnight on 1–2 November. In Belgium, about 40 Delhaize stores and 15 Carrefour stores were affected, with Intermarché and Spar outlets and an IKEA store in Mons also reporting problems. In Sweden, ICA and Coop reported cases, with Coop citing six or seven of roughly 800 stores. In Ireland, SuperValu's owner Musgrave pulled chilled and frozen products from 13 of 223 stores. Estonia, Luxembourg, Finland and the Netherlands, where Danfoss said at least 17 businesses were hit, mostly butchers and small shops, also reported incidents. AFP reporting adds Portugal and Italy. The country count depends on who is counting: most outlets say six or seven.
The temperatures need care. "50°C" describes a setting, not the temperature of the food. At a Selver store in Estonia, a freezer was set to 50°C but its temperature rose only 2–3°C before the fault was fixed in about ten minutes; the supplier said no products were damaged. At a butcher near Antwerp, fridges were turned up to 18°C, and the owner estimated about €15,000 of meat was ruined.
No one has claimed responsibility. Belgium's Centre for Cybersecurity said it may never be established who was behind the attacks. Danfoss, the Belgian contractor Sabcobel and Estonia's Kitman Coldtech each say the method resembled the French one, but a similar method does not prove the same attacker.
How a cooling system becomes a weapon
Supermarket refrigeration is run by central controllers: small computers that manage temperature targets, alarms and defrost schedules for a store's display cases and cold rooms. Engineers call such systems operational technology, or OT: digital systems that control physical equipment. Many are connected to the internet so contractors can monitor and repair them without visiting the store.
Defrost is a normal function, a short heating cycle that clears ice from the cooling coils. Sabcobel, which manages Delhaize's refrigeration, said attackers switched units into defrost mode. Elsewhere the temperature setting itself was raised.
Danfoss says most French units were older models: the AK-SM 800 (end of life since 2021) and AK-SC 355 (phased out in 2016), plus some newer AK-SM 800A units running outdated firmware. France's CERT-FR alert lists Danfoss AK-SM and AK-SC controllers and Copeland and Dixell xweb units, and tells owners to disconnect them from the internet. Danfoss told Dutch broadcaster NOS that the Dutch systems hit were not on a secure network and still used default passwords.
What nobody has published is the exact way in. Neither CERT-FR nor Danfoss has named a vulnerability used in these attacks. Security firm Claroty reported flaws in the AK-SM 800A in August, which Danfoss says it fixed in later firmware. Whether any were used here is unconfirmed.
This was an attack on operational technology, not on tills or customer data. That distinction matters. A retailer's IT security programme protects payments, loyalty data and head-office networks. The refrigeration controller often belongs to a contractor and sits outside that programme. ICA said its affected stores used an outside supplier connected outside its central network, and Finland's Kesko said its affected stores' equipment sat outside its central protections.
The second problem: deciding what to throw away
A hacked controller creates a physical problem, then an information problem.
Food-safety guidance turns on two variables: how warm, and for how long. The standard "danger zone", where bacteria multiply fastest, runs from roughly 4–5°C to 57–60°C. A temperature of 50°C sits well inside it. US public-health guidance written for power cuts treats up to two hours above safe temperature as the limit for selling perishable food, and longer exposure as potentially hazardous. Those rules were written for unpowered fridges warming slowly. Active heating to 50°C is harsher, so IFT reads them as a floor for caution, not a safe window. That is our analysis, not an official position.
Thawing adds risk. Frozen food releases moisture and nutrients as it thaws, which can support microbial growth, and meat, dairy and eggs are more likely to support pathogen growth, Virginia Tech food scientists note. California health guidance warns that food subjected to temperature abuse may not be safe even when recommended steps are followed. Re-chilling, refreezing or cooking is therefore not an automatic fix. Equally, not every item exposed to a spike becomes dangerous: risk depends on the food, the temperature, the duration and handling.
That is why retailers' reactions were blanket. Les Mousquetaires discarded all affected food. Musgrave removed chilled and frozen products from 13 stores as a precaution. Belgium's food-safety agency, FAVV/AFSCA, reportedly reminded stores they must check whether products exceeded their maximum temperatures. We found that only in a security firm's briefing, not in the agency's own notice.
Then comes the information problem. A defensible discard decision needs trustworthy records: temperature logs, alarm history, batch traceability. If the controller that was tampered with also produces the log and sends the alarms, the record may be incomplete. Researchers have previously shown, on another vendor's controllers, that a compromised unit could alter displayed temperatures or silently stop cooling, Cyber Security News reported. Whether anything similar happened here is unknown. A separate, independent data logger is one obvious safeguard, though that is our suggestion, not a requirement.
On consumers: we found no report of illness, and no report of contaminated food reaching shoppers. We also found no reporting that settles whether any affected food was sold before the problem was detected.
The vulnerability behind the attack
Danfoss says the weakness lies mainly in outdated software. Sabcobel's chief executive says an update alone is not enough, because some installations need physical changes that cost money; most of its customers have since moved to a secure connection. Internet scans have found Danfoss controllers exposed in several countries, including South Africa, the US and the UK, Time reported.
Coopérative U's chief executive said his stores buy these systems through refrigeration contractors, not from Danfoss directly. Leclerc said one of its refrigeration suppliers was attacked. Food businesses are generally responsible for the safety of what they sell, but the remote access sits with a contractor and the firmware with a manufacturer. This reporting did not establish whether any country's law assigns the cyber duty to any of them.
CERT-FR and Sweden's National Cybersecurity Centre have both issued recommendations: take controllers off the public internet, restore remote access only through a VPN or protected network, change default passwords, update firmware, check defrost schedules, and list every internet-connected device. These are agency recommendations, not legal requirements.
What this could mean for India
There is no confirmed Indian incident. BusinessToday reported on 3 November that no Indian supermarkets have been linked to comparable attacks, and IFT found none either. What follows is exposure analysis, not evidence of attack.
What can be established: India's cold chain is large and temperature-regulated. The country had 40.22 million tonnes of cold-storage capacity across 8,815 facilities as of June 2025, according to a FICCI–Grant Thornton Bharat report cited by BusinessToday. FSSAI's requirements specify receiving frozen food at −18°C or below. A 15 October 2026 FSSAI advisory says temperature abuse of perishables such as khoa, paneer, meat and fish breaches hygiene requirements under Schedule 4 of the licensing regulations, with seizure and destruction possible. We found no evidence the advisory responded to the European attacks.
What could not be established: how many Indian stores, cold stores or dairies run internet-connected central refrigeration managers of the kind attacked, or who holds their remote access. We found no CERT-In or NCIIPC advisory specific to refrigeration controllers, and no evidence that retail or cold-storage refrigeration is designated critical information infrastructure. One trade-press commentary claims these Danfoss controllers are standard across named Indian retailers and dairies, mostly on default passwords. It offers no source and IFT could not verify it, so it should be treated as unconfirmed.
The FSSAI framework is built around temperature. The European attacks raise a question it does not obviously answer: who can change the temperature, and how would a business know? Four questions for Indian operators and regulators:
Which refrigeration controllers are reachable from the internet, and who holds the credentials?
Do alarms and temperature logs run independently of the controller?
Do inspections check how temperature records are protected, or only that they exist?
Who decides what to discard when the record itself is in doubt?
Food safety now has a cybersecurity dimension
Europe's supermarket attacks have not, on current reporting, poisoned anyone. They have shown that food safety is only as strong as the machine holding the temperature. Regulators have long asked whether food was kept cold. They now also need to ask who could make it warm. Protecting the systems that preserve food, not only those that sell it, is a food-safety control.