Hackers who drove supermarket freezers across Europe up to 50°C on Monday could have gotten in through ageing control systems left reachable online, analysts say, warning that the aim of the cyberattacks seems to be to show just how easily food supply can be hit.
Stores in at least six countries, including Sweden, Finland, Belgium, Luxembourg, Ireland and Estonia, found fridges and freezers heated overnight, forcing them to throw out mounds of food.
The attacks followed a first wave in France in mid-October that hit between about 350 and 700 stores. Separately, in the US, the Pentagon is treating freezer failures at military bases in August as a suspected hack, Reuters reported on October 29.
The controllers behind these fridges were built to be adjusted by a technician standing in the store. But many have since been put online, often running old software protected by weak passwords, which makes them cheap to break into and hard to trace.
What is being hacked?
A chiller and freezer in a supermarket runs on a controller, a small computer that keeps the temperature where staff set it, and a management system links those controllers across the store.
{{/usCountry}}A chiller and freezer in a supermarket runs on a controller, a small computer that keeps the temperature where staff set it, and a management system links those controllers across the store.
{{/usCountry}}Bill Moore, chief executive of the industrial cybersecurity firm Xona Systems, told Reuters these controllers were conceived as isolated units that a technician would service in person. But retailers have increasingly connected them to the internet to monitor and manage them remotely.
Many of the affected units in the two Europe cyberattacks ran on controllers from Danfoss, a Danish company. A Danfoss spokesperson told Bloomberg the November incidents involved its products, as the French ones had. Additionally, rival chains often buy from the same supplier, so one ageing product line can leave all of them exposed at once.
Also read: Cyberattack targets refrigerators at French supermarkets: Why nothing is un-hackable
How do hackers get in?
Most supermarket refrigeration systems in the West are run from a web page. "You connect to it with a password and you then have the possibility to choose what the temperature in the fridge is," Kevin Tellier, a cybersecurity engineer at the French firm Synacktiv, told AFP.
These pages were meant to stay on a store’s closed internal network, but many ended up reachable from the open internet, where scanning services list them for anyone to find.
Daniel dos Santos, vice-president of research at Forescout Technologies, told Bloomberg that nearly 5,000 Danfoss systems were still exposed online in the week before November 2. Christiaan Beek, vice-president of intelligence at the cybersecurity firm Rapid7, counted nearly 1,000 still online after the latest attacks became public.
Vincent Strubel, head of France's National Cybersecurity Agency, blamed October's attack on “basic security shortcomings” and singled out fridges left exposed to the internet "without any particular security and with weak passwords".
Hackers can also use flaws in old software. Makers fix such flaws with updates called patches, and Danfoss said most of the French systems that failed were older models that no longer received them.
Once inside, the attackers heated the units. Freezers in Sweden and Estonia were set to 50°C, and some French units caught fire.
Could AI be involved?
Katrien Eggers, spokesperson for Belgium's Centre for Cybersecurity, told Reuters the growing number of incidents worried her, in part due to artificial intelligence. "All IT systems are potentially vulnerable, and AI can now be used to successfully exploit these weaknesses — especially by sophisticated actors," she said.
Investigators have not said whether AI played any part in either wave. Mandiant, Google’s incident-response unit, wrote in a review report published earlier this year, that it did not “consider 2025 to be the year where breaches were the direct result of AI”.
But security researchers say it makes every step of an attack like this cheaper and faster.
A hacker who wants to heat supermarket freezers has to find control pages left open on the internet, get past the login, often through a flaw in old software, and then repeat the task at store after store.
Google’s threat intelligence team wrote on March 5, in its annual review of zero-day attacks (those that exploit flaws the maker has not yet found), that it expected attackers to use AI to “automate and scale attacks by accelerating reconnaissance, vulnerability discovery, and exploit development”. The Mandiant report also found that “exploitation is routinely occurring before a patch is even released”, and estimated that attacks were coming, on average, about a week before the fix.
Owners of controllers that have stopped receiving patches, like most of the French systems Danfoss described, have no fix to wait for at all.
In November 2025, Anthropic, which makes the Claude AI models, said it had caught a group it assessed "with high confidence" was Chinese and state-sponsored using its Claude Code tool to attempt break-ins at about 30 organisations. A few succeeded. The attackers got past the tool's safeguards by splitting the job into small, innocent-looking tasks and posing as a legitimate security firm. Anthropic said AI did 80-90% of the work, though the model also made mistakes, at times inventing login credentials.
Why target fridges?
The hackers have not sought money so far – a pattern that experts find troubling.
Tom Hegel, a researcher at the cybersecurity firm SentinelOne, told Reuters such attacks are usually linked to extortion, political motives or state operations, and the lack of financial demands in recent cases points to sabotage. Supermarkets make an easy target, he said, since "retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear".
Forescout’s dos Santos sees the attacks as a warning. "It's very likely someone sending a message to society – we can mess up your food supply," he said.
Rapid7's Beek agreed: “That's the big message the hackers are sending: whatever you try, whatever you do, there are still ways to disrupt society.”
Christophe Hansen, the EU's agriculture commissioner, called the incidents "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it".
Luc De Laet, who owns the Belgian butchery chain De Laet & Van Haver, was woken at 3.30am and found the fridges at his store south of Antwerp turned up to 18°C, with about €15,000 of meat ruined. "I only have two words for them: wake up, please, because there's something going on," he told Reuters.
Also read: 'I was paralysed by options': Woman compares US supermarkets with London, internet relates
Who is behind them?
The attacks have remained unclaimed, and it isn't yet known who was behind the November 2 incidents or whether they were linked to the France attacks from October. Forescout has counted more than 20 confirmed attacks on refrigeration systems this year, many linked to pro-Russian hacktivist groups, though no group has claimed the latest.
Cold storage has been hit before. Danfoss has said that in 2022, hackers targeted or broke into supermarkets in Russia and Israel that were using obsolete versions of its controllers.
In December 2025, US federal prosecutors in Los Angeles accused a Ukrainian woman of being part of a hacker group that knocked out the refrigeration at a meatpacking facility in 2024, ruining more than 900kg of meat.
European authorities have grown more worried about hybrid threats to infrastructure since Russia's 2022 invasion of Ukraine, and Moscow has repeatedly denied involvement in sabotage or hybrid warfare.
An attacker who logs into an exposed control panel "leaves almost nothing behind", Hegel said, adding: “A teenager and an intelligence service would look much the same from the defender's side.”
“It is not known who is behind this attack, and it may never be determined," Eggers said.
Why are these systems still online?
Many retailers took vulnerable Danfoss systems offline after France. Others may not know theirs are exposed, dos Santos said, or have decided that replacing systems that cannot be patched would cost more than an attack might. "There are likely business needs why these systems are online and those likely haven't changed since the attacks in France," he said.
Beek likened the old devices to space junk: “We have a lot of internet junk floating around — older devices that we're not really aware of.”
Danfoss has told operators to keep its devices away from "direct internet exposure", change default passwords and keep software "fully updated". Kit that can no longer be patched needs replacing or cutting off from outside networks. From December 2027, the EU's Cyber Resilience Act will require manufacturers to handle security flaws across their products' lifetimes.
Could a fridge at home be hacked?
In theory, yes, if it is connected to the internet, directly or through an app, cloud service or home network.
In 2015, researchers at a hacking conference in Las Vegas showed how a Samsung smart refrigerator could be compromised, letting them intercept some of the internet traffic passing through it. Attackers are usually more interested in stealing data, disrupting services or using a connected device as a way into a larger network. Routers account for more than three-quarters of all attacks on connected devices, according to security-industry data cited by Reuters.
Cybersecurity experts generally recommend changing default passwords, enabling two-factor authentication where available and installing software updates regularly. Devices that no longer receive security updates are best removed or replaced, and the fewer devices connected to the internet, the fewer ways in for an attacker.