Cyberattacks targeting refrigeration systems across European supermarkets expose fundamental weaknesses in operational technology security, from publicly accessible control panels and inadequate authentication to insecure software development and delayed patching. Experts from Infoblox and Kaspersky warn that organisations must rethink how they secure connected physical infrastructure before a technical vulnerability turns into business disruption.
Europe’s supermarket refrigeration systems have become an unexpected battleground in the expanding cyber threat landscape. What might once have been considered a peripheral operational technology (OT) concern has now emerged as a stark example of how cyberattacks can directly interfere with physical infrastructure, disrupt business operations and create tangible financial losses.
The reported attacks on supermarket refrigeration and freezer systems across Europe have exposed a fundamental weakness in the way organisations approach cybersecurity: while enterprises increasingly connect physical equipment to digital networks for efficiency and remote management, the security of these devices has not always kept pace with their connectivity.
The incidents, initially reported in France in October 2026, subsequently spread across several European countries. Supermarkets experienced disruptions after refrigeration controls were reportedly manipulated, with some systems registering temperatures significantly above normal operating levels. The consequences included spoiled food, operational disruption and financial losses.
Reuters reported on November 2 and 3 that retailers in several European markets, including Sweden, Belgium, Ireland, Luxembourg, Estonia, Finland and the Netherlands, had reported refrigeration-related incidents. Retailers including Coop, ICA, Edeka and Carrefour were among those affected or reporting problems. Some refrigeration units reportedly reached temperatures as high as 50 degrees Celsius.
Although investigations are continuing and the precise perpetrators and technical pathways have not been conclusively established, the incidents have raised serious questions about the security of internet-connected refrigeration controllers and remote-management infrastructure.
More significantly, they demonstrate that a cyberattack no longer needs to target an organisation’s corporate network or customer database to cause substantial damage. Compromising a relatively small operational device can be enough to interrupt an essential business process.
For retailers, that could mean losing thousands of euros’ worth of perishable inventory. For hospitals, manufacturers and logistics companies, the consequences of similar attacks could be considerably more serious.
The cyber-physical security blind spot
Modern refrigeration systems are no longer standalone electrical appliances. They are sophisticated cyber-physical systems that combine sensors, controllers, software and network connectivity to monitor and regulate physical processes.
Remote monitoring allows supermarket operators to manage temperatures across multiple outlets, receive alerts when equipment malfunctions and optimise energy consumption. Maintenance providers can also diagnose problems and adjust settings without physically visiting individual locations.
“Visibility is not a dashboard. It is the ability to make a safe decision while there is still time to act.”
— Frank Ruge, Senior Vice President, Direct Sales EMEA, Infoblox
However, this convenience introduces another dimension of risk.
Vladimir Dashchenko, Principal Security Researcher at Kaspersky, points out that refrigeration systems illustrate the growing security challenges associated with cyber-physical infrastructure.
“Modern refrigeration systems are a typical example of cyber-physical systems. It means they can be monitored and controlled remotely, while their level of security often remains insufficient,” he observes.
The concern is that manufacturers may introduce connectivity and remote-management capabilities without implementing adequate security safeguards.
Dashchenko identifies weaknesses such as inadequate password policies, the absence of two-factor authentication and shortcomings in secure software development processes.
These are not necessarily sophisticated vulnerabilities. They are often fundamental security deficiencies that can leave equipment exposed to unauthorised access.
The problem is compounded by the long operational life of industrial and commercial equipment. Unlike conventional IT devices, which organisations may replace or upgrade relatively frequently, refrigeration controllers and industrial systems can remain in service for many years.
Consequently, equipment designed under older security assumptions may continue operating in environments where cyber threats have become significantly more sophisticated.
Publicly exposed control panels: An invitation to attackers
One of the more concerning aspects of the refrigeration attacks is the possibility that internet-accessible control panels could provide an entry point for malicious actors.
According to Dashchenko, refrigeration control panels and similar cyber-physical devices can be discovered using internet-wide scanning platforms such as Shodan and Censys.
These platforms index devices and services that are accessible over the internet. They are legitimate tools used by security researchers and administrators to identify exposed infrastructure, but the same information can also be exploited by attackers.
“If a device is publicly reachable and insecurely configured, it can be discovered both by administrators and by threat actors,” Dashchenko explains.
“If a device is publicly reachable and insecurely configured, it can be discovered both by administrators and by threat actors.”
— Vladimir Dashchenko, Principal Security Researcher, Kaspersky
This creates a potentially dangerous situation for organisations that assume their operational equipment is protected simply because it is not part of their conventional corporate IT environment.
A refrigeration controller exposed through an internet-facing management interface may become discoverable without an attacker first penetrating an organisation’s internal network.
Once discovered, the device can be assessed for weak authentication, outdated software, known vulnerabilities and other security deficiencies.
Dashchenko also highlights that information about methods for achieving remote arbitrary code execution on similar refrigeration control panels has previously appeared in the public domain.
Remote code execution is particularly serious because it can potentially allow an attacker to execute commands or malicious code on a vulnerable device.
He further points to the absence of mechanisms for enforcing critical software updates in some products. Where manufacturers cannot ensure that important patches are installed, known vulnerabilities may remain exploitable long after security fixes become available.
This combination of public exposure, inadequate authentication, known vulnerabilities and weak patch management creates an attractive attack surface.
The precise exploitation method behind the European supermarket incidents remains subject to investigation. However, the weaknesses identified by Kaspersky illustrate why connected refrigeration systems deserve the same security attention as other networked enterprise assets.
Manufacturers must take responsibility for security by design
The refrigeration incidents also raise an important question about the responsibility of equipment manufacturers.
Traditionally, industrial and commercial equipment manufacturers have prioritised reliability, performance, energy efficiency and operational life. Cybersecurity has not always received equivalent attention, particularly in legacy products and devices designed before widespread internet connectivity became standard.
Dashchenko argues that security must become an integral part of the product development process rather than an additional feature introduced after deployment.
Manufacturers need to incorporate security requirements from the design stage, establish secure software development life cycle (SSDLC) practices and ensure that authentication, access management and software updates are fundamental product capabilities.
His recommendations include avoiding direct internet exposure, enforcing strong authentication and ensuring the timely installation of critical updates.
This also means designing products with secure default configurations, eliminating unnecessary services, maintaining vulnerability disclosure processes and providing customers with clear security guidance.
A critical consideration is the ability to update equipment throughout its operational life.
Manufacturers should establish reliable mechanisms for distributing security patches and communicating vulnerabilities to customers. Where equipment cannot support updates, organisations should receive clear guidance on compensating security controls and eventual replacement.
Dashchenko also believes that buyers must exercise greater scrutiny when procuring connected infrastructure.
Organisations should evaluate vendors not only on equipment performance, cost and energy efficiency but also on their cybersecurity practices, patch-management capabilities and remote-access protection.
In an increasingly connected enterprise, procurement decisions are also cybersecurity decisions.
Why asset visibility is becoming the first line of defence
While manufacturers have a responsibility to build secure products, organisations deploying connected infrastructure must also understand what is operating within their environments.
This is where asset visibility becomes critical.
Traditional cybersecurity programmes have generally focused on servers, endpoints, applications, databases and network infrastructure. However, connected enterprises increasingly operate thousands of additional devices, including industrial controllers, sensors, building automation systems, refrigeration equipment and remote-management gateways.
Many of these devices may be managed by facilities departments, engineering teams or third-party service providers rather than central IT security teams.
This fragmentation creates a significant governance problem.
An organisation may know that refrigeration equipment exists across its stores but may not know which controllers are internet-facing, what software they run, who manages them or what business processes depend on them.
Frank Ruge, Senior Vice President, Direct Sales EMEA, Infoblox, believes that the European incidents highlight the need to connect asset visibility with operational context.
“The immediate question for a retailer, hospital or manufacturer is not only whether a controller is exposed. It is whether the organisation knows the controller exists, what it supports, who owns it and how it can be secured or isolated,” he says.
His argument goes beyond conventional vulnerability management.
Simply identifying an exposed device or generating another security alert does not necessarily help an organisation understand the business consequences of a compromise.
Security teams need an authoritative view of connected infrastructure, including unmanaged devices where relevant telemetry and specialist OT security integrations are available.
Ruge emphasises:
“Holistic asset visibility that turns into actionable insights is what matters most.”
The distinction is important. Asset visibility must help organisations make decisions, prioritise vulnerabilities and establish clear accountability rather than simply populate security dashboards.
Connecting internal visibility with external threat intelligence
Another important dimension of the problem is that organisations cannot manage cybersecurity risks exclusively from within their networks.
Connected infrastructure frequently depends on external vendors, cloud platforms, remote-management services and third-party maintenance providers.
Attackers may identify exposed services, compromised credentials or malicious infrastructure beyond an organisation’s conventional security perimeter before internal security teams become aware of the threat.
This makes external attack surface management (EASM) and digital risk protection increasingly relevant.
Infoblox has expanded its Exposure Management capabilities with Axur, combining external attack surface management and digital risk protection to provide organisations with an outside-in view of their digital exposure.
Ruge explains:
“Organisations cannot manage risk solely from the inside out. External attack surface management and digital risk protection provide an outside-in view of exposed credentials, relevant malicious infrastructure and other risks forming beyond the perimeter.”
The objective is to connect external threat intelligence with information about assets, services and ownership within the organisation.
For example, identifying an exposed remote-management service becomes significantly more useful when security teams can establish which operational devices depend on it, which service provider manages it and what the consequences of unauthorised access could be.
This integrated approach can help organisations identify emerging risks and take corrective action before an external exposure becomes an operational incident.
Protective DNS: Another layer in the defence architecture
Infoblox also highlights the role of Protective DNS in disrupting communications with known malicious infrastructure.
DNS is fundamental to internet communication, translating domain names into the IP addresses required to connect to online services.
Cybercriminals frequently use malicious domains and command-and-control infrastructure to distribute malware, communicate with compromised devices and coordinate attacks.
Protective DNS can identify and block requests to known malicious domains, helping prevent devices from communicating with recognised hostile infrastructure.
For organisations managing connected OT environments, this provides an additional security layer.
However, Protective DNS is not a substitute for securing vulnerable controllers or eliminating exposed management interfaces. If an attacker gains direct access to a poorly protected refrigeration panel, DNS filtering alone may not prevent unauthorised changes to its settings.
Its effectiveness depends on the nature of the attack and whether the relevant communications pass through protected DNS infrastructure.
It must therefore complement strong authentication, network segmentation, vulnerability management, secure remote access and continuous monitoring.
Disconnecting equipment is not a sustainable strategy
Following the European incidents, some retailers have reportedly disconnected affected refrigeration systems from the internet while implementing corrective measures.
Such action can reduce immediate exposure, but completely removing connectivity is not necessarily practical for organisations managing hundreds of geographically distributed outlets.
Remote monitoring and maintenance are integral to modern retail operations. The challenge is to retain these efficiencies without exposing critical infrastructure unnecessarily.
Organisations should restrict remote access to authorised users, enforce multi-factor authentication, monitor third-party access and separate operational networks from corporate IT environments.
Network segmentation is particularly important because it limits the ability of attackers to move between connected systems if one device is compromised.
The NIST Guide to Operational Technology Security, SP 800-82 Revision 3, highlights the need to account for OT-specific requirements, including reliability, performance and safety, when implementing security controls.
In other words, cybersecurity measures must protect operations without inadvertently disrupting the processes they are designed to secure.
Beyond supermarkets: A warning for critical infrastructure
The wider significance of the European incidents lies in the possibility of similar attacks affecting other sectors.
Hospitals depend on connected systems for medical refrigeration, laboratory storage, environmental controls and specialised equipment. Manufacturers rely on industrial controllers, production systems and automated processes. Logistics companies depend on temperature-controlled storage and transportation to preserve sensitive goods.
A compromise involving these systems could disrupt essential operations, affect supply chains and potentially create safety risks.
The lesson is that OT cybersecurity can no longer remain an isolated technical responsibility. It must become part of enterprise risk management, procurement governance and business continuity planning.
Organisations need to bring together cybersecurity teams, engineering departments, facilities managers, vendors and business leaders to establish clear responsibility for connected infrastructure.
They must also prepare incident response procedures that address the physical consequences of cyberattacks, including when and how to isolate compromised equipment while maintaining essential operations.
The next cyber crisis may begin with an ordinary device
The European supermarket refrigeration attacks offer a powerful reminder that the digital and physical worlds are now inseparable.
The vulnerability may sit in an overlooked controller, an outdated management interface or a device that nobody realised was directly accessible from the internet. Yet its compromise can result in tangible business losses.
Kaspersky’s assessment highlights the importance of secure product development, authentication and patch management. Infoblox’s perspective reinforces the need for comprehensive asset visibility, external threat intelligence and actionable security insights.
Together, these perspectives point towards a more integrated approach to cybersecurity: manufacturers must build secure equipment, organisations must maintain control over their connected assets, and security teams must continuously monitor both internal and external exposure.
As Ruge observes:
“Visibility is not a dashboard. It is the ability to make a safe decision while there is still time to act.”
That may be the most important takeaway from Europe’s refrigeration incidents.z
The next major cyberattack may not announce itself through a ransomware message or a stolen database. It could begin with an ordinary connected device quietly accepting an unauthorised command.
In an increasingly connected enterprise, protecting digital infrastructure means protecting every device capable of influencing the physical world.
