On the night between Sunday, November 1 and Monday, November 2, someone broke into the systems controlling supermarket refrigeration units across at least seven European countries and turned them into ovens: freezers reaching temperatures of up to 50°C, spoiled stock, empty shelves by the time the doors opened.
Belgium, Sweden, the Netherlands, Luxembourg, Ireland, Finland, Estonia. It was a repeat of the attack that had hit hundreds of French supermarkets on October 12, from Intermarché to Leclerc. No one has claimed responsibility. And, at least publicly, no one has demanded money.
That’s the crux of it. For twenty years we’ve grown used to hackers who want something: passwords, data, a cryptocurrency ransom. This time nothing was taken. Something was simply broken. From theft to sabotage, from computers to physical goods — this is the new frontier, and it runs straight through the frozen food aisle.
How a fridge becomes an oven
No virus. Apparently, not even malicious code.
Supermarket refrigeration units are run by control panels connected to the internet, so that maintenance companies can manage them remotely: an alarm on a Sunday evening can be fixed from a phone, without anyone having to leave home.
Whoever carried out the attack went through that very channel and used the standard controls, just like any technician would. They triggered the defrost function — the brief nightly cycle that warms the coils to melt ice buildup — and let it run for hours, with the thermostat set to 50°C.
In France, the Paris public prosecutor’s office also mentioned the risk of fires starting.
Most of the control units involved are made by the Danish company Danfoss, one of the world’s refrigeration giants, and the firm has confirmed that its products were implicated this time as well. French authorities also flagged devices from two other brands.
As Danfoss explained after the French attacks, most of the affected units are older models, no longer in production, and without security updates since 2021. After the first attack, Shodan — a sort of search engine for internet-connected devices — counted more than 4,500 Danfoss units reachable from the open internet.
On Sunday night, someone went through the list.
Once the fridge was the door — now it’s the target
This isn’t the first time trouble has come from the refrigeration section. In 2013, the thieves who stole the data of 40 million credit card customers from Target, the American retail giant, got in using credentials stolen from a small Pennsylvania company that handled refrigeration and air conditioning.
A few years later, a casino had its list of top-spending clients siphoned off through a connected thermometer in the lobby’s aquarium. Back then, the device was merely a side door — the real heist happened elsewhere.
Today, the door and the target are one and the same. There’s no need to reach a database: all it takes is letting the goods rot.
One Belgian supermarket alone estimates €100,000 worth of discarded products, while one in Alsace lost over €200,000. In the United States, the Pentagon is investigating, as a possible cyberattack, malfunctions that caused freezers at at least six military base supermarkets to overheat in late August.
No link to the European incidents has been established, but American investigators are working with their French counterparts.
Who did it? No one knows — and that’s what’s unsettling
An attack with no ransom is an attack with no calling card. Every lead remains open: a foreign power, a group of activists, simple digital vandals.
In mid-October, one security expert reasoned that a state actor wouldn’t have stopped at just part of France’s supermarket network, given how many countries are full of connected fridges. Perhaps, he suggested, it was just kids having fun.
Three weeks later, the other countries were hit. That proves nothing about who’s behind it. But it proves the method works — and that someone is using it.
And artificial intelligence is driving the cost down
Until now, this kind of attack required patience and skill: finding a forgotten control unit online, figuring out how to operate it, repeating the trick across hundreds of stores in a single night. It’s exactly the kind of work artificial intelligence excels at.
In October, two extremely serious flaws in the language that powers seven out of ten websites were discovered with AI’s help. A year ago, Anthropic — one of the companies developing these systems — revealed it had blocked an espionage campaign attributed to a group linked to the Chinese state, in which AI carried out up to 90 percent of the work on its own, leaving humans to make only the key decisions.
The next step is subtler still. Once temperature regulation is handled entirely by a self-deciding system, there will be no need to even seize control of it: all it will take is lying to it. A rigged sensor reporting “too cold,” and the machine will heat the unit, convinced it’s simply doing its job.
And here at home?
Italy, for now, doesn’t appear on the list. But these are systems sold across all of Europe, and a small country is not an invisible one: to a program scanning the internet, a control unit in Serravalle counts the same as one in Stockholm.
The supermarket down the street, the butcher’s cold room, the ice cream shop’s display case, the pharmacy fridge, the hotel boiler, the warehouse gate: how many of these are now controlled by an app, still using the password left behind by the technician on installation day? No one knows.
Dozens of European supermarkets found out the hard way, overnight.
The good news is that protecting yourself costs far less than a freezer’s worth of spoiled stock. Just three questions for whoever maintains your systems: which devices are connected to the internet, who can access them and with what password, and when they were last updated.
If the answer to that last question is “they can no longer be updated,” there’s only one fix: disconnect them from the open network.
A fridge that can’t be controlled from the couch is a little less convenient. But it’s still a fridge.
Anyone who wants to know what parts of their company are visible from the internet — before someone else finds out first — can write to us at strategic.sm.
Strategic.sm Observatory
