Cyberattacks on Freezers Hit Supermarkets Across Europe
European Supermarkets Hit by Coordinated Freezer Cyberattacks
Impact Scope
Affected Companies
Industries Affected
Geographic Impact
Related Entities(initial)
Organizations
Other
Full Report(when first published)
Executive Summary
A widespread and coordinated cyberattack has struck supermarket chains across at least seven European nations, targeting their internet-connected refrigeration systems. On November 2, 2026, retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands, and Sweden discovered that their freezer and refrigeration units had been remotely manipulated, with temperatures raised to as high as 50°C (122°F). This act of sabotage resulted in massive quantities of spoiled food. The attacks, which affected major chains such as Coop and ICA, appear to be a wider escalation of a near-identical incident that hit up to 700 supermarkets in France in October. The EU's food and agriculture commissioner has labeled it a deliberate attempt to disrupt the food supply chain, raising concerns about hybrid warfare targeting critical infrastructure.
Threat Overview
The attack targets a vulnerability in the growing convergence of IT and Operational Technology (OT) within the retail sector. Modern supermarkets use internet-connected Building Management Systems (BMS) to remotely monitor and control environmental systems, including refrigeration. The threat actor, who has not yet been publicly identified, is exploiting this connectivity to gain unauthorized access and issue malicious commands.
Attack Vector: The likely attack vector involves scanning the internet for exposed BMS or refrigeration control system interfaces that are not properly secured. Attackers could be using default credentials, exploiting known vulnerabilities in the BMS software, or using stolen credentials to gain access. Once logged in, they can manipulate the temperature setpoints of the connected units.
Affected Countries:
- Belgium
- Estonia
- Finland
- Ireland
- Luxembourg
- Netherlands
- Sweden
- France (in a previous, related attack)
Technical Analysis
This attack is a clear example of an OT/ICS attack with direct physical consequences. The attackers are leveraging IT-based intrusion methods to impact a physical process—in this case, refrigeration.
The TTPs likely involved map to the MITRE ATT&CK for ICS framework:
T0886 - Remote Services: Gaining initial access by exploiting internet-facing remote services of the BMS.T0885 - Valid Accounts: Using default, weak, or stolen credentials to log into the control system interface.T0829 - Manipulate View: Attackers may alter the view presented to operators to hide the temperature changes in real-time.T0831 - Manipulation of Control: The core of the attack, where the actor sends commands to alter the temperature setpoints of the refrigeration units.
Impact Assessment
The impact of these attacks is significant and multi-faceted:
- Financial Loss: The immediate impact is the direct financial loss from spoiled food, which is estimated to be in the tens of millions of euros from the French incident alone. There are also costs associated with cleanup and restocking.
- Supply Chain Disruption: As stated by the EU commissioner, this is a direct attack on the food supply chain. Widespread, repeated attacks could lead to food shortages and impact public confidence.
- Societal Disruption: These attacks demonstrate how cyber means can be used to create tangible, real-world disruption. While currently limited to food spoilage, similar attacks on other critical infrastructure could have more severe consequences.
- Reputational Damage: Affected supermarket chains face a loss of customer trust and potential regulatory scrutiny.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
/api/v1/setpointDetection & Response
- Network Monitoring: Continuously monitor for any internet-facing OT or BMS devices. Any such device should be considered a high-risk finding.
- Log Analysis: Ingest logs from BMS and control systems into a SIEM. Create alerts for unauthorized logins, changes to critical parameters like temperature setpoints, or logins occurring outside of maintenance windows.
- Behavioral Anomaly Detection: Use OT-aware security monitoring tools to baseline normal operational parameters. Alert on any deviation, such as a temperature rising above its expected range, even if the command appears to be from an authenticated user.
Mitigation
- Network Isolation: The most critical mitigation is to ensure that no part of the Building Management System or any other OT/ICS component is directly exposed to the public internet. Access should be restricted via a secure VPN with MFA.
- Credential Management: Change all default passwords on BMS, routers, and other control system components. Enforce strong, unique passwords for all user and administrative accounts.
- Network Segmentation: Segment the network to isolate control systems from the corporate IT network and other parts of the business. This prevents an attacker who compromises the IT network from easily pivoting to the OT environment.
- Patch Management: Regularly apply security patches to all BMS software, controllers, and underlying operating systems.
Timeline of Events
Article Updates
November 6, 2026
Attack extends to France's national blood service; Singapore's CSA issues advisory.
Update Sources:
MITRE ATT&CK Mitigations
Isolating ICS/OT networks from corporate IT networks and the internet is the most effective way to prevent remote unauthorized access.
If remote access is necessary, it should be strictly controlled through a firewall and a secure VPN with multi-factor authentication.
Changing default credentials and enforcing strong, unique passwords for all BMS accounts is a critical basic hygiene measure.
D3FEND Defensive Countermeasures
The primary cause of the supermarket freezer attacks is the exposure of Operational Technology (OT) systems, like Building Management Systems (BMS), to the public internet. The most critical defense is Network Isolation. Supermarket operators and other organizations with ICS environments must ensure that these sensitive control systems are never directly accessible from the internet. This can be accomplished by placing them behind firewalls and creating a segmented 'OT zone.' Any required remote access must be brokered through a secure gateway, such as a VPN with multi-factor authentication, originating from a trusted IT network. This single control would have prevented these attacks by removing the initial access vector that the threat actors exploited.
As a foundational security measure, organizations must perform Platform Hardening on all ICS and BMS components. This includes immediately changing all default usernames and passwords on controllers, routers, and management interfaces. Many OT devices ship with well-known default credentials (e.g., 'admin'/'admin') that attackers systematically scan for. Enforcing strong, unique passwords for every device and interface significantly raises the bar for attackers. Additionally, hardening involves disabling unused ports and services on these devices to minimize the attack surface. In the context of the supermarket attacks, even if a BMS was accidentally exposed, strong credentials would have provided a crucial layer of defense against unauthorized login.
Timeline of Events
A similar attack affects up to 700 supermarkets in France.
A second, wider wave of attacks hits supermarkets in seven other European countries.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.