In October and early November 2026, European supermarkets faced a series of cyber incidents whose consequences proved highly tangible for both ordinary shoppers and retail companies. Interference with refrigeration equipment led to rising temperatures in freezers and refrigerated display cases, spoilage of products, and temporary disruptions to store operations. Over three weeks, similar incidents were recorded in France, Belgium, Germany, Sweden, Finland, Italy, and several other European countries. At the same time, reports emerged about the possible involvement of pro-Russian hacker groups.
The first major incident occurred in France on the night of 11–12 October. According to French authorities and local media reports, the disruptions affected around 700 retail outlets. Among the victims were stores belonging to Intermarché, Coopérative U, Carrefour, and other retail chains. Attackers who gained remote access to refrigeration control systems altered their operating parameters. As a result, some units switched to defrost mode, and temperatures in certain rooms rose to approximately +50 °C, forcing stores to dispose of large volumes of meat, dairy products, and frozen goods.
One of the most striking cases took place in the Bordeaux area, where the temperature in a cold room at an Intermarché store reached exactly +50 °C, and the resulting problems triggered the fire suppression system. The cost of the destroyed products at this location amounted to about €21,000. The following day, reports appeared of interference with equipment from another manufacturer, Dixell; in particular, some E.Leclerc outlets were affected. French specialists confirmed cases of cyber intrusion into the relevant systems.
On 12 October, the French national computer emergency response team CERT-FR published a special alert (CERTFR-2026-ALE-012) listing the systems that had been compromised: Danfoss AK-SM, Danfoss AK-SC, Copeland XWEB, and Dixell XWEB. The agency recommended that equipment owners check their settings, restrict remote access, and avoid connecting controllers directly to the internet.
On the night of 1–2 November, similar incidents were recorded in several European countries. In Belgium, problems arose at Delhaize, Carrefour, Intermarché, and Spar stores, as well as at one IKEA store in Mons. According to published data, several dozen Delhaize outlets were affected, mostly in Belgium. Carrefour reported issues in 15 of its more than 700 Belgian stores, while Spar reported problems at five locations. In some cases, owners had to completely empty refrigerated display cases of products.
In Sweden, the incidents affected the Coop and ICA chains. Coop confirmed unauthorized interference with the refrigeration equipment of several stores; different reports mentioned six or seven outlets out of roughly 800. ICA also reported problems with refrigeration and freezing units in certain stores, noting that some of the equipment was operating outside the central corporate network.
In Germany, on 2–3 November, cases of interference with refrigeration systems were identified at CAP, REWE, and EDEKA stores. According to the German broadcaster ARD, outlets in Wuppertal, Wetter-Volmarstein, Raesfeld, Lilienthal, and Reisbach were affected. In some stores, refrigeration units were switched to heating mode. At one EDEKA supermarket in Lilienthal, the temperature in the sales area reached approximately +70 °C, while in the cold rooms it was around +30 °C, necessitating the disposal of an entire container of products. In Bavaria, police launched an investigation after an incident at an EDEKA store in Reisbach.
In Finland, unusual temperature changes were detected in several small stores belonging to the Kesko group. Company representatives said the causes were being established and that the possibility of unauthorized network access was being considered as one of the versions. In Italy, reports of similar incidents came from Sicily. According to the AFP agency, at least four Coop stores managed by the Radenza group experienced disruptions to their refrigeration systems — three in Catania and one in Palermo. Company representative Giuseppe Spadaro reported interference with the remote control system of the refrigeration units.
The technical side of these incidents is linked to the characteristics of modern retail equipment. In large stores, refrigeration units are integrated into remote monitoring systems that allow staff and service organizations to regulate temperature, set defrost cycles, track malfunctions, and control energy consumption. Special industrial controllers are used for this purpose; many of them are connected to the internet. If such devices have weak protection, default passwords, or outdated software, outsiders can alter their operating parameters.
Research by the technology company Forescout, which specializes in cybersecurity and network security management, provides an indication of the potential scale of the problem. Its specialists discovered 12,976 internet-accessible refrigeration control services on 6,017 public IP addresses in 99 countries. Of the identified services, 7,075 belonged to Copeland and Dixell XWEB systems, and another 4,697 to Danfoss StoreView. According to the study, about 80% of the discovered Danfoss services were running software versions older than those containing fixes for known vulnerabilities. However, these figures reflect only the number of externally accessible systems, not the number of confirmed breaches.
Researchers pay particular attention to equipment that no longer receives security updates. In some cases, retail companies continue to use controllers whose technical support ended several years ago. An additional problem is the distribution of responsibility among store owners, equipment manufacturers, and third-party service companies. As a result, systems can remain accessible from the internet for years without proper oversight.
A possible Russian connection became a subject of discussion after the publication of research findings by the British cybersecurity company Lupovis, which specializes in proactive defense and deception technologies. Its CEO, Xavier Bellekens, reported that between 20 and 30 October specialists recorded 256 attempts to interact with honeypot controllers imitating Danfoss AK-SM devices. The activity came from 91 sources. Special decoy systems that mimic real industrial equipment were used for observation. According to Bellekens, some of the attempts originated from network infrastructure previously used by Russian cyber operators. Researchers also noted the use of default credentials published in the manufacturer’s documentation.
The timeline of these events is of interest for further investigation. Suspicious activity was recorded up to 30 October, while a new wave of incidents in European stores began on the night of 2 November. However, specialists have not yet established that the attempts to access the honeypot systems and the actual interference with refrigeration equipment were carried out by the same group. The use of infrastructure previously linked to Russian operations does not yet prove the direct involvement of Russian state structures.
An additional reason for attention appeared on 4 November. The Italian news agency ANSA and the Rai television channel reported that two pro-Russian hacker groups, NoName057(16) and Z-Pentest, claimed joint responsibility for the attacks on European refrigeration systems. In their published statement, they asserted that the participants had used the built-in management mechanisms of Danfoss and Dixell equipment without resorting to special malware. The groups also claimed the ability to affect water supply facilities, energy infrastructure, industrial enterprises, and food storage sites.
The hacker group NoName057(16) has been known since 2022 and previously claimed attacks on government and commercial internet resources in European countries. Z-Pentest has also appeared in materials from Western agencies concerning the activities of pro-Russian hacktivist groups. U.S. agencies CISA, the FBI, and the NSA have previously warned about the activity of such groups against industrial control systems and civilian infrastructure.
The consequences of the incidents also affected the healthcare sector. On 4 November, Reuters reported a cyber incident that occurred on 2 November at three regional facilities of the French Blood Service (Établissement Français du Sang, EFS). Temperature control and defrost parameters were altered in rooms where blood and plasma supplies were stored. The monitoring system promptly detected the deviations, after which staff moved the materials to other refrigeration units. According to the French Ministry of Health, medical stocks were not damaged and the situation remained under control. Nevertheless, the precedent demonstrated that similar technical vulnerabilities can affect facilities on which the operation of medical institutions depends.
European institutions also reacted to the events. EU Commissioner for Agriculture and Food Christophe Hansen described such actions as a deliberate attempt to disrupt the food supply chain and undermine consumer confidence. Belgian and French law enforcement agencies are conducting investigations, while national cybersecurity centers are recommending that companies restrict remote access to industrial systems.
At the same time, the incidents have raised several practical questions for European authorities and businesses. Who should be responsible for protecting equipment if its manufacturer has stopped releasing updates while the retail chain continues to use outdated controllers? Why, after the CERT-FR warning of 12 October, did similar systems remain externally accessible in other countries? Are the current requirements of the European NIS2 directive sufficient to protect the entire food chain, including stores, warehouses, and service organizations?
As of today, numerous cases of interference with the refrigeration equipment of European retail companies have been confirmed, researchers have identified thousands of potentially vulnerable internet-accessible systems, and two pro-Russian hacker groups have publicly claimed responsibility for the attacks. However, the question of the actual organizers and possible state coordination remains open.
