A growing wave of cyberattacks targeting refrigeration systems across Europe reveals how overlooked operational technology, exposed remote-management interfaces and fragmented asset visibility can turn an ordinary supermarket appliance into a potential business-disruption weapon. The incidents offer a wider warning for retailers, hospitals, manufacturers and critical infrastructure operators about the need to rethink cybersecurity beyond conventional IT networks.
Europe’s supermarket refrigeration systems have become an unlikely target in an emerging wave of cyberattacks that is challenging conventional assumptions about enterprise cybersecurity. What initially appeared to be an isolated incident involving compromised refrigeration controls in France has evolved into a wider campaign affecting supermarkets across several European countries.
The attacks, which reportedly manipulated the temperature settings of refrigerators and freezers, have resulted in spoiled food, operational disruption and financial losses. More importantly, they have exposed a fundamental vulnerability in the increasingly connected infrastructure that supports everyday business operations: operational technology (OT) is often digitally accessible but not adequately understood, inventoried or protected.
“Visibility is not a dashboard. It is the ability to make a safe decision while there is still time to act.”— Frank Ruge, Senior Vice President, Direct Sales EMEA, Infoblox
According to Reuters’ November 3 reporting, a second wave of attacks affected supermarkets in eight European countries, following similar incidents in France in October. Retailers including Coop, ICA, Edeka and Carrefour were among those reporting problems. Some refrigeration units were reportedly manipulated to reach temperatures as high as 50 degrees Celsius, forcing stores to discard substantial quantities of food. Reuters +1
The incidents demonstrate that cybersecurity is no longer exclusively about protecting corporate databases, financial information or customer records. It is increasingly about protecting the physical systems that keep businesses functioning.
For retailers, that means refrigeration. For hospitals, it could mean medical storage and environmental controls. For manufacturers, it could involve production lines, industrial machinery and temperature-regulated processes.
The underlying lesson is the same: when digital systems control physical infrastructure, a cyber incident can quickly become an operational crisis.
From French supermarkets to a European cybersecurity concern
The first major wave of refrigeration-related cyber incidents emerged in France in October 2026. Hundreds of supermarket outlets reportedly experienced disruptions after attackers manipulated refrigeration and freezer settings.
According to reporting by Le Monde, the October 11–12 incident affected several hundred stores belonging to multiple retail groups. In some cases, attackers reportedly increased temperatures and extended defrost cycles, delaying the detection of the problem and worsening the damage. One affected store reported temperatures reaching approximately 50 degrees Celsius in its cold-storage area.
The second wave, reported on November 2, demonstrated that the problem was not confined to France.
Retailers in Belgium, Sweden, Ireland, Luxembourg, Estonia, Finland and the Netherlands reported refrigeration-related disruptions. Subsequent reporting also identified incidents in Portugal and Italy. In Belgium alone, dozens of outlets across different retail chains reportedly experienced problems. Euronews +2
The scale and recurrence of the incidents have raised questions about the security of remotely managed refrigeration infrastructure.
Although investigations are continuing, reports indicate that internet-connected refrigeration controllers and remote-management systems may have provided an entry point. Some affected installations reportedly involved older equipment and systems that had not received the necessary security upgrades.
No group has publicly claimed responsibility, and investigators have not conclusively established whether all the incidents were orchestrated by the same attackers.
This distinction is important. While the similarities suggest a possible connection, attributing the attacks to a particular criminal or politically motivated group without forensic evidence would be premature.
Nevertheless, the incidents expose a systemic problem: technologies designed to improve operational efficiency can create new attack surfaces when connectivity is introduced without corresponding security controls.
The overlooked vulnerability: Operational technology
Operational technology refers to hardware and software that monitor, control or directly influence physical equipment and processes.
Unlike conventional information technology, which primarily manages information, OT interacts with the physical environment. Industrial control systems, programmable logic controllers, building management platforms, refrigeration controllers and supervisory control and data acquisition systems are examples.
In supermarkets, modern refrigeration systems are increasingly connected to central monitoring platforms. This allows operators and service providers to monitor temperatures, adjust settings, identify equipment failures and optimise energy consumption remotely.
These capabilities offer significant operational advantages. They reduce the need for physical inspections, improve efficiency and help organisations manage equipment distributed across multiple locations.
However, remote connectivity also introduces cybersecurity risks.
A refrigeration controller that can be accessed remotely may become vulnerable if its management interface is exposed to the public internet, authentication is weak, software is outdated or access permissions are inadequately controlled.
The problem becomes more complicated when third-party maintenance providers manage equipment across hundreds of locations.
A retailer may own the store, another company may install the refrigeration infrastructure, and a specialist vendor may operate the remote-management platform. Responsibility for cybersecurity can consequently become fragmented.
This creates a dangerous gap between knowing that a system exists and knowing who is accountable for securing it.
The National Institute of Standards and Technology (NIST), in its Special Publication 800-82 Revision 3, recognises the distinctive security requirements of OT environments. It emphasises that OT security must account for operational reliability, performance and safety rather than simply applying conventional IT security controls.
For organisations operating complex infrastructure, this distinction is critical. A security measure that works for an office network may disrupt an industrial process if applied without understanding operational dependencies.
Why asset visibility has become the first line of defence
One of the most significant lessons from the European incidents is that organisations cannot secure infrastructure they do not adequately understand.
Traditional cybersecurity programmes have generally prioritised servers, endpoints, applications, databases and network devices. However, the expansion of connected infrastructure has introduced thousands of additional devices that may not appear in conventional IT asset inventories.
These include refrigeration controllers, sensors, industrial gateways, building automation systems and remotely managed equipment.
Some devices may be operated by third parties or connected through networks that are not directly controlled by an organisation’s central IT department.
Consequently, security teams may have limited visibility into the devices operating within their environments, the software and firmware they use, their network connections and the operational processes they support.
This is where asset visibility becomes more than an inventory exercise.
Organisations need to establish an authoritative understanding of their connected infrastructure, including:
- What devices and controllers exist across different locations.
- Which systems are connected to the internet or external management platforms.
- What software, firmware and configurations they operate.
- Which business processes depend on those devices.
- Who owns, maintains and secures each asset.
- What vulnerabilities or unusual communications could expose them to compromise.
The joint OT asset inventory guidance published by CISA and international cybersecurity agencies in August 2025 similarly emphasises identifying, classifying and documenting OT assets, their dependencies and communication pathways.
Without this foundation, security teams risk responding to individual alerts without understanding the broader operational consequences.
Frank Ruge: Visibility must translate into action
Against this backdrop, Infoblox argues that the European incidents highlight the importance of connecting internal asset intelligence with external threat intelligence.
Frank Ruge, Senior Vice President, Direct Sales EMEA, Infoblox, believes that the immediate challenge for organisations is not merely identifying exposed controllers but understanding their operational significance.
“The immediate question for a retailer, hospital or manufacturer is not only whether a controller is exposed. It is whether the organisation knows the controller exists, what it supports, who owns it and how it can be secured or isolated.”
His observation points to a critical weakness in conventional security operations.
An organisation might identify an exposed device through a vulnerability scanner or receive an alert about suspicious network activity. However, without knowing what the device controls, whether it supports a critical process or which team is responsible for it, responding effectively becomes difficult.
A controller connected to a supermarket’s refrigeration infrastructure, for example, requires a different level of urgency from an ordinary office device.
Similarly, an exposed controller supporting hospital environmental systems or manufacturing operations could carry consequences that extend well beyond data confidentiality.
Ruge argues that simply collecting more security alerts or removing remote-management capabilities will not address the underlying problem.
“No single layer substitutes for the basics. Holistic asset visibility that turns into actionable insights is what matters most.”
This is an important distinction. Visibility must provide context, not merely generate another dashboard.
Security teams need to connect device intelligence with business ownership, network relationships, vulnerabilities and operational dependencies. Only then can they make informed decisions about isolation, remediation and continuity.
The importance of looking beyond the corporate perimeter
Another important dimension of the emerging threat is that organisations cannot limit their security assessments to infrastructure operating inside their networks.
The growing dependence on external service providers, cloud platforms, remote-management systems and connected devices means that threats can develop beyond the conventional corporate perimeter.
Attackers may discover exposed services, compromised credentials, vulnerable infrastructure or malicious domains associated with an organisation before security teams identify the risk internally.
This makes external attack surface management (EASM) and digital risk protection increasingly relevant.
Infoblox has expanded its Exposure Management capabilities through its integration with Axur, bringing together external attack surface management and digital risk protection capabilities.
The objective is to help organisations identify external exposures, compromised credentials, malicious infrastructure and other digital risks that could affect their operations.
Ruge explains the significance of this approach:
“Organisations cannot manage risk solely from the inside out. External attack surface management and digital risk protection provide an outside-in view of exposed credentials, relevant malicious infrastructure and other risks forming beyond the perimeter.”
The value of this approach lies in connecting external intelligence with internal asset information.
For instance, identifying an exposed remote-management service becomes more useful when security teams can determine which internal devices depend on it, who manages those devices and what operational consequences could follow from a compromise.
This allows organisations to prioritise risks based on their potential business impact rather than treating every vulnerability as an isolated technical issue.
Protective DNS: An additional layer of defence
While asset visibility and exposure management help organisations understand their risks, protective DNS can provide another layer of defence.
Domain Name System (DNS) is fundamental to internet communication. When devices and applications attempt to connect to external services, DNS helps translate domain names into the corresponding network addresses.
Cybercriminals frequently use malicious domains and infrastructure for command-and-control communications, malware distribution and other harmful activities.
Protective DNS can identify and block connections to known malicious domains, preventing devices from communicating with recognised hostile infrastructure.
In an OT environment, this can help reduce the possibility of compromised devices reaching malicious external services.
However, protective DNS should not be mistaken for a complete solution to OT vulnerabilities.
If an attacker already has access to an exposed refrigeration controller through a vulnerable management interface, DNS filtering alone may not prevent unauthorised changes to its settings.
Its effectiveness depends on the nature of the attack, the availability of reliable threat intelligence and whether the relevant communications pass through protected DNS infrastructure.
It must therefore operate as part of a broader defence strategy that includes secure remote access, network segmentation, vulnerability management, identity controls and continuous monitoring.
Why disconnecting devices is not a long-term solution
Following the latest incidents, several European retailers have reportedly moved to disconnect refrigeration equipment from the internet or upgrade their remote connectivity arrangements.
Sweden’s Coop, for instance, said it was transitioning from older 4G connections to 5G networks and modern modems. Refrigeration systems at affected stores were also disconnected from the internet while corrective measures were undertaken.
Such measures can reduce immediate exposure, but they do not automatically resolve underlying security weaknesses.
A device that is disconnected today may be reconnected tomorrow for maintenance or operational reasons. If its vulnerabilities remain unaddressed, the risk returns.
Moreover, completely eliminating remote connectivity may not be practical for retailers managing refrigeration infrastructure across hundreds of geographically dispersed outlets.
The answer lies in controlled connectivity.
Organisations should restrict remote access to authorised users, enforce strong authentication, monitor vendor access, apply security updates and isolate OT systems from corporate networks wherever operationally feasible.
Network segmentation is particularly important because it limits the ability of an attacker to move between connected environments.
NIST’s OT security guidance recommends separating OT networks from corporate networks and controlling the communication permitted between them.
The UK National Cyber Security Centre also recommends maintaining a definitive view of OT architecture, identifying assets, documenting connectivity and understanding third-party dependencies.
From supermarkets to hospitals and manufacturing: A wider warning
Perhaps the most important implication of the European incidents is that refrigeration systems are only one example of the growing attack surface created by connected operational infrastructure.
The same security challenges exist across multiple industries.
In healthcare, connected systems support medical refrigeration, laboratory environments, building management and specialised equipment. A compromised controller could potentially disrupt temperature-sensitive storage or other essential operations.
In manufacturing, industrial controllers and environmental management systems influence production quality, equipment availability and worker safety.
In logistics and food distribution, refrigeration and cold-chain monitoring are essential to preserving products throughout transportation and storage.
An attack that compromises these systems could create consequences extending beyond the immediate organisation, affecting suppliers, customers and wider supply chains.
The concern is therefore not simply the financial cost of spoiled supermarket inventory. It is the possibility that similar techniques could be applied to systems where operational disruption has more serious consequences.
This makes OT cybersecurity a board-level business resilience issue rather than a technical responsibility confined to infrastructure teams.
Building resilience before the next incident
The European refrigeration attacks offer a timely opportunity for organisations to reassess their approach to cyber resilience.
The first priority should be a comprehensive and continuously updated inventory of connected infrastructure. Organisations must understand not only their conventional IT assets but also the operational systems managed by facilities teams, specialist vendors and external service providers.
Second, remote access must be governed through strong identity controls, multi-factor authentication, restricted permissions and continuous monitoring.
Third, OT networks should be segmented to prevent unauthorised movement between corporate and operational environments. Legacy systems should be identified, assessed and upgraded or isolated according to their risk and operational importance.
Fourth, security teams should integrate internal asset intelligence with external exposure management and threat intelligence. This creates a more complete picture of the risks developing both inside and outside the organisation.
Finally, incident response plans must incorporate operational teams. Cybersecurity professionals, facilities managers, engineering teams, equipment vendors and business continuity leaders should know who makes the decision to isolate a compromised system and how essential services will continue.
For Infoblox, the central message is that technology investments must ultimately enable faster and better-informed decisions.
Ruge concludes:
“The lesson from France, and the later incidents reported elsewhere in Europe, is that resilience depends on connecting asset visibility, external risk intelligence and clear ownership before a technical exposure becomes operational harm.”
The message resonates well beyond European retail.
The next major cyber incident may not begin with a ransomware note, a stolen database or a compromised employee account. It could begin with an ordinary connected device quietly accepting an unauthorised command.
In an increasingly connected enterprise, the boundary between cybersecurity and physical operations is disappearing. Protecting digital infrastructure now means understanding every connected system that can influence the real world.
And as Europe’s supermarket refrigeration attacks demonstrate, sometimes the cost of overlooking a small controller can be measured not in stolen data, but in an entire store’s inventory going to waste.
Editorial note: This story is based on reporting available as of 4 November 2026 and the commentary supplied by Infoblox. The precise perpetrators and the extent to which the European incidents share a common origin remain unconfirmed.
