Europe's fridge cyber attacks: what food businesses should ask

In October, attackers took over the remote controls on refrigeration plant in French supermarkets and pushed it into defrost overnight. In early November the same pattern reached shops in more than ten countries, including a few British meat processors, and a report says a contractor for France's blood service was hit too. Here is what the sources confirm, what they do not, who in Dorset might have the same kind of kit, and the questions worth putting to a refrigeration engineer this week.

By Elliot · Published 4 November 2026 · 11 min read

A warm night, caused by software

A modern supermarket does not run its fridges one cabinet at a time. A supervisory unit records the temperatures, sets when each cabinet defrosts, raises alarms and lets a contractor log in remotely to see what is going on. Defrosting is a normal job: the cabinet stops cooling for a while to clear ice. The attackers reportedly used that built-in function, locking the equipment in defrost for hours so it kept warming. Reuters put the highest temperatures at about 50°C.

Because the attacker is using the controller's own settings, the change can look like routine maintenance. Forescout makes the same point: attackers can use legitimate supervisory functions such as setpoints, schedules, alarms and users so their changes blend in. Claroty's earlier research went further, finding that an attacker could stop cooling on a compromised controller while staff still saw normal temperatures.

Danfoss told the press that most of the affected equipment was legacy hardware that no longer receives software or security updates. Researchers had published flaws in some of these controllers and fixes existed. But ANSSI's director told the French Senate that the agency's assessment pointed to exposed administration interfaces and weak passwords, not those published flaws. That is an assessment at the time, not a final finding, and it covers the French cases only.

The same trick, across the continent

From Monday 2 November, shops in a run of countries reported refrigeration switching to defrost or heating overnight. The European Commissioner for agriculture and food, Christophe Hansen, called it, as reported by Danish broadcaster DR, a deliberate attempt to disrupt European food security, while also saying food security was not at risk. Nobody has claimed it, and no authority has said who did it.

It was not only chains. A butcher in Athens reported its fridges set to 150°C, with staff unable to intervene because they had no access to the system. Franchised Spar shops in Belgium and at least 17 Dutch businesses were hit. In several places the reports describe an external refrigeration or maintenance provider as the target, which SentinelLABS treats as a hypothesis that does not yet show a common provider or a compromised update channel.

Counts are moving fast and some are the retailer's own figure, some a newspaper's. Treat each line as what that source said on 2 or 3 November. Sweden's national cyber centre said the country has quite a lot of exposed operational technology devices that need updating or patching, which is the same message CERT-FR gave in October.

In Britain, the trade press reported on 3 November that the abattoir units heated up but were empty, and the National Cyber Security Centre's director of operations, Paul Chichester, said “at the moment, the impact is minimal.” The NCSC's advice to food businesses, as reported, was to address software vulnerabilities and keep contingency plans, including for moving food after a refrigeration failure. Its chief executive, Richard Horne, cited the disruption of refrigeration units across Europe in his annual review speech the same day, and listed refrigeration controls among automated processes whose security is often overlooked. We have not seen a published NCSC notice naming the products involved in the UK cases.

What is, and is not, known about the plasma freezers

On 3 November the weekly Le Canard enchaîné reported an attack on Coolworld, a refrigeration contractor for the French blood service, the Établissement français du sang (EFS). Overnight on 1 to 2 November, freezers normally held at about -30°C were reportedly reprogrammed to a target of 110°C. Sites in Bourgogne-Franche-Comté are among those mentioned. The EFS first described donor samples kept for health monitoring, then confirmed that frozen plasma for patient transfusion was among the products stored in the units. The health ministry said an on-call technician noticed the rising temperature and acted, and that there were no operational consequences.

Everything beyond that is open. The 110°C figure is a programmed setpoint, not a reading from inside a freezer, so it does not show how hot anything got, or for how long. No plasma loss, withdrawn transfusion or patient harm has been confirmed, and no donor data theft has been reported. The report does not say how the attackers got in, we found no public statement from Coolworld, and no source has shown that Coolworld's equipment is one of the controller families in the October alert. Some social media posts went further than the reporting, with talk of blood nearly boiling. The reporting does not support that.

The detail worth keeping is the shape of it. A contractor held remote access to equipment in a sensitive setting, and the thing that limited the damage was a person on call who noticed the numbers going the wrong way. ANSSI's director had already warned at a Senate hearing about refrigeration risks in healthcare, and said the agency was working with the health sector's response team.

Seven steps for a food business owner

None of this needs technical knowledge. It needs one call to whoever services your refrigeration, and a written answer.

Five things we would not claim

That it is one attack by one group. The two waves look alike, and SentinelLABS calls Russian-aligned groups a credible hypothesis, but it says responsibility is not publicly established and that nothing shows the November cases used the same route as France. How they got in. ANSSI's assessment for France was exposed interfaces and weak passwords. For November, reports point variously at a contractor, default passwords and unprotected networks. Treat all of it as provisional.

That plasma was damaged. The blood-service account rests on one weekly newspaper's reporting, as relayed by others, and on a setpoint, not a measurement. How far it reached Britain. The UK reports are a trade-press account of a few meat processors with empty units, and the NCSC says impact is minimal. We found no UK exposure figure, and a map shared on social media that shades Great Britain “attempted” carries no source, so we rely on the named reports and not the map. Treat the UK picture as early.

That we can fix it. We build and look after websites, email and the accounts around them. We do not install, test or secure refrigeration systems, and we have not scanned or touched anyone's equipment. This guide is to help you ask the right questions of the people who do.

More guides and comparisons