What the European Supermarket Fridge Attacks Tell Us About Exposed OT

On October 12, 2026, attackers took control of refrigeration systems in French supermarkets overnight and pushed fridge and freezer temperatures to 50°C (122°F). France’s finance minister told parliament that about 700 of the country’s 10,000 supermarkets were affected. Stores threw out their stock, and several reported fires. On November 2, it happened again, this time across at least nine European countries.

The next day, the UK’s National Cyber Security Centre published its State of the Cyber Nation report, judging it highly likely that AI-powered malware will be used in a ransomware attack on UK critical infrastructure by 2028. Two different stories, one root problem: operational devices that can be reached from outside, running on systems that stopped getting updates years ago.

How the Attack Worked

Supermarket cold aisles are usually run by a central control panel that manages every fridge and freezer in the store. Those panels are reachable over the internet so maintenance companies can adjust them remotely.

What has been reported so far:

1. Attackers switched units to defrost mode overnight. Intermarché’s owner said fridges in about 150 of its stores ran at 50°C for six hours before staff arrived.
2. Most affected systems were past end of support. Danfoss, which supplied the refrigeration software, said the majority were older products that no longer received updates.
3. Researchers had already flagged the exposure. Claroty found that numerous controllers using the Danfoss system were directly reachable from the public internet. Danfoss and Copeland have since fixed those vulnerabilities.

What has not been confirmed: who did it and exactly how they got in. No one has claimed responsibility. There was also no ransom demand and no reported data theft, which experts called unusual. The goal appears to have been the physical damage itself.

The Second Wave

The November 2 incidents followed the same pattern. More than 100 stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden saw temperatures rise overnight, with AFP adding Finland, Italy and Portugal to the list. Affected businesses ranged from Ahold Delhaize, Colruyt, ICA and Coop to small butcher shops. Carrefour Belgium said 15 of its more than 700 stores were hit. Several retailers blamed a cyberattack, but not every incident in this wave has been confirmed as one, and investigators have not said whether the attacks share an attacker or a method.

EU agriculture commissioner Christophe Hansen called it “a deliberate attempt to disrupt our food supply chain.” He also said the bloc’s food security is not under threat for now. Both statements matter. This is a warning, not a crisis.

The pattern is not limited to Europe. About a dozen US military commissaries reported similar fridge failures in late August, and Minnesota and Michigan reported attacks on their water systems over the summer.

Why the Physical Effect Matters

Most cyber incidents end with stolen data or locked files. These ended with spoiled food and fires. A controller that changes a setpoint is taking an action in the physical world, and the same is true of a pump at a water utility, an RTU at a substation, or a PLC on a production line.

That is why the age of these systems matters so much. As one security executive told Fox News, OT facilities commonly run assets that are 15 to 20 years old, and operators avoid taking them offline to upgrade. The result is equipment that controls physical processes, is reachable remotely, and cannot be patched.

Where AI Changes the Timeline

The NCSC’s point is precise. Its chief executive, Richard Horne, says AI has not invented new ways to attack. The problem is “vulnerabilities that have been tolerated for far too long,” which can now be found and exploited at a scale that was not possible before. The report also says China is likely the best positioned to use AI against critical infrastructure.

For OT environments, this means the exposed controller that went unnoticed for five years will not stay unnoticed. Automated discovery shrinks the gap between “exposed” and “exploited.” We saw state actors work patiently inside telecom infrastructure in the Salt Typhoon campaign. AI makes that kind of reconnaissance cheaper for everyone.

From One Device to the Network

An exposed refrigeration controller is one compromised device. The question every OT team should ask is what happens next:

1. Can that device reach anything else? If one controller can talk to the rest of the store, the warehouse, or a central management server, one entry point becomes many.
2. Would the network show it? Remote-access sessions from unexpected sources, network scanning, protocols outside the device’s normal role, and traffic to unknown servers are all visible if someone is watching.
3. Does it stay a dead end? A compromised device that can only do its one job is a contained incident. A device with open paths into SCADA or core systems is the start of a much larger one.

This applies whether the device sits on a wired network, a carrier APN, or a private cellular network. Remote OT assets increasingly connect over cellular, which makes per-device identity and policy part of the same problem. We covered the same dynamic in the Poland energy sector attack, where the damage depended on what attackers could reach after the first device.

Actions to Take Now

1. Find every OT controller that can be reached from the internet. Run an external exposure scan and compare it against your asset inventory. Anything you didn’t know was reachable is your first priority.
2. Treat end-of-support devices as a known exposure. If a device can’t be patched, isolate it and limit what can reach it until it’s replaced.
3. List every cellular modem, remote gateway and vendor connection, and name an owner for each. Equipment a vendor installed years ago often still carries remote access that nobody has reviewed since.
4. Lock down how contractors reach your equipment. Remote maintenance should go through controlled, logged access, never a direct path from the internet to the device.
5. Give each device an identity and a defined role. You can only spot unusual behavior if you know what normal looks like for that specific device.
6. Alert on behavior outside that role. A refrigeration controller has no reason to scan the network or talk to an unknown server.
7. Plan for the physical outcome. Keep temperature, pressure or flow alarms that don’t depend on the same system an attacker could control.

The Real Lesson

None of the weaknesses behind these attacks are new. Exposed remote access, unpatched legacy controllers, and no visibility into what a device does once it’s compromised are problems OT teams already know about. What has changed is how fast they get found.

If a device can be reached from outside, assume someone will try. Platforms such as OneLayer give security teams identity and policy for every device on private cellular networks, so one compromised device can be spotted and contained before it reaches anything else. Book a demo of OneLayer Bridge to see how it works on your network.