A second wave of supermarket fridge hacks in November 2026 makes the lesson sharper: the system that controls the cold chain should not be the system that proves it.
Overnight on 11–12 October 2026, attackers compromised refrigeration controllers at about 700 French supermarkets, according to the French government. They raised temperatures to around 50 °C, spoiled large quantities of food, and, French authorities said, caused fires. Losses were reported in the millions of euros, with at least one major chain estimating tens of millions in a single day. France’s cybersecurity agency, CERT-FR, said the affected systems included internet-exposed Danfoss AK-SM and AK-SC series controllers and Copeland and Dixell XWEB systems. Danfoss said most of the affected units were older, end-of-life models, and that some current controllers were running outdated firmware. Authorities and researchers also pointed to weak or default credentials on some internet-reachable interfaces.
We wrote after the October attacks about the difference between passive monitoring and control-connected refrigeration. The November wave makes that distinction even sharper.
Three weeks later, a second wave hit. Overnight on 1–2 November, the same pattern repeated in at least seven European countries, including Belgium, Luxembourg, Sweden, Ireland, Finland, Estonia and the Netherlands. Later reports also named Portugal and Italy. Dozens of stores were affected. Chains such as Delhaize, Carrefour, ICA, Coop and SuperValu reported freezers and chillers climbing as high as 50 °C, and food was discarded. The same night, temperature and defrost thresholds were raised at three French blood-service cold rooms storing plasma; monitoring and alarm systems detected the change quickly, and staff secured or transferred the products, with no reported spoilage. UK food suppliers, including meat processors, later reported related incidents. On 5 November, CISA, the FBI and other US agencies issued a joint advisory warning of ongoing threats to industrial refrigeration and cold-chain systems globally.
The technical method was straightforward. Attackers reached remote management interfaces on the controllers, took control, and forced prolonged defrost cycles or high-temperature setpoints. These were not sophisticated malware campaigns in the usual sense. They exploited devices that were reachable from the internet, poorly authenticated, and not kept current. After the October attacks, researchers who deployed honeypots of similar Danfoss interfaces observed continued probing in the following weeks, including exploitation attempts on 1 November, around the start of the second wave.
The shared failure mode
Both incidents turned on the same architectural choice: the systems used to control refrigeration were also the systems that could be reached and manipulated remotely. Once an attacker was inside the controller, they could change setpoints, alter alarm thresholds in some cases, and create physical damage. The monitoring path and the control path were effectively the same path.
This is the core lesson for cold-chain operators.
Why monitoring should be isolated from control
Cold-chain management/control systems (the controllers, setpoints, defrost logic, and remote access used by technicians) and cold-chain monitoring (independent temperature, humidity, power and condition data) serve different purposes and should have different trust boundaries.
When monitoring rides on the same network, credentials, firmware and remote-access path as control:
- Compromise of the controller can silence or falsify the monitoring data at the same time.
- An attacker who raises the temperature can also suppress the alarms that would have alerted staff.
- Recovery becomes harder because the same channel used for normal operations is the one under attack.
- Operators lose an independent source of truth for what the temperature actually was, when it changed, and whether the goods remained within specification.
Independent monitoring does not prevent an attacker from tampering with a poorly secured controller. It does, however, give operators a separate, harder-to-silence channel that can detect the temperature excursion quickly, generate alerts through a different path, and preserve an audit trail that the control system itself may no longer be trusted to provide. In the French blood-bank cases, rapid detection by monitoring and alarm systems prevented spoilage. In many supermarket cases, the first clear signal was spoiled product or a store employee noticing the problem.
Isolation does not require exotic technology. Practical measures include:
- Keeping refrigeration controllers off the public internet and restricting remote access to authenticated, time-limited, monitored channels (or eliminating continuous remote management where it is not essential).
- Running temperature and condition monitoring on a separate network segment, with separate credentials and a separate alerting path that does not share the controller’s management interface.
- Ensuring monitoring devices and platforms cannot be used to change setpoints or disable the refrigeration system itself.
- Maintaining local or out-of-band alarms that continue to function even if the primary controller or its remote link is compromised.
- Treating firmware currency, strong authentication and least-privilege access on controllers as non-negotiable hygiene, while accepting that some legacy equipment will remain difficult to fully secure.
These steps do not eliminate risk, but they stop a single compromise from both causing the temperature excursion and hiding the evidence of it.
What this means in practice
The October and November incidents demonstrate that cold-chain risk is no longer only about equipment failure or power loss. It now includes deliberate remote manipulation of the systems that keep product cold. Regulators are already treating this as a critical-infrastructure issue. Operators are increasingly expected to show not just that temperatures were recorded, but that the recording system was sufficiently independent to be trusted when the control system was not.
For operators running mixed fleets of older controllers, the pragmatic path is usually not a wholesale replacement. It is to add monitoring that sits alongside the existing control layer, uses its own connectivity and credentials, and continues to report even if the controller’s remote interface is taken offline or compromised. That separation is what turns a potential silent failure into a detectable event with a usable audit trail.
The two European waves are a clear signal. Controllers that are reachable, outdated and weakly authenticated will continue to be probed. The operators who fare best will be those who have already decided that the system that controls the cold chain and the system that proves the cold chain are not the same system.
ChillSense is built as observe-only monitoring: battery sensors and a Wi‑Fi hub that record temperature and raise alerts, without a path to change setpoints or disable refrigeration. If you want that separation in your own cold chain, book a short demo.
Sources
- AP News: Cyberattack hits 700 supermarkets in France (14 Oct 2026)
- CERT-FR alert CERTFR-2026-ALE-012 (12–13 Oct 2026)
- SecurityWeek: Attack widens to Copeland and Dixell controllers (14 Oct 2026)
- BBC: Shop freezers in seven European countries hit by cyber-attack (2 Nov 2026)
- Centre for Cybersecurity Belgium advisory (Nov 2026)
- The Guardian: Who is hacking Europe’s supermarket fridges and freezers? (2 Nov 2026)
- AFP: Fridge cyberattack hits supermarkets across Europe (3 Nov 2026)
- AP News: Cyberattack on French blood banks thwarted before damage (Nov 2026)
- The Guardian: Food suppliers in UK hit by cyber-attacks (3 Nov 2026)
- CISA, FBI, HHS, USDA and DOT joint advisory (5 Nov 2026)
- Sekoia: The Cold Chain on Fire — unpatched Danfoss controllers exploited (10 Nov 2026)
General information for food businesses, not legal or cyber-security advice. Facts about the October and November 2026 incidents checked against the sources above on 10 November 2026.