The Supermarket Refrigeration Attacks: What Food Manufacturers Should Check Now

On the night of 11 to 12 October, staff arriving at supermarkets across France found fridges and freezers running hot. Carrefour, Monoprix, Intermarché, Netto and Coopérative U stores were affected, and some cabinets had reached around 50°C. Les Mousquetaires, which owns Intermarché and Netto, put its own count at about 180 stores and expects losses of several million euros (CNBC).

On 2 November a second wave reached supermarkets in Sweden, Belgium, Ireland and the Netherlands (ABC News/AP). Reports differ on the number of stores and countries, but the pattern is the same: refrigeration controllers switched into continuous heating and defrost cycles, overnight, when nobody was watching.

What the controllers had in common

France's national cyber emergency team, CERT-FR, issued an alert naming refrigeration controllers from Danfoss (AK-SC and AK-SM), Copeland and Dixell (XWEB) (CERT-FR alert CERTFR-2026-ALE-012). It made two points that matter to anyone running cold storage. Putting a controller's management interface on the internet goes against good practice. And a device that has reached the end of its supported life, left exposed without updates, is very likely to be compromised.

The investigation is still open, and no official source has yet said exactly how the attackers got in. What every advisory agrees on is the starting point: controllers that anyone on the internet could reach.

On 5 November, CISA and four other US agencies published a joint warning urging operators to harden refrigeration and cold-chain monitoring systems, and to stop exposing controller panels to the internet (CISA).

Is the UK affected?

Dr Richard Horne, head of the UK's National Cyber Security Centre, told BBC Radio 4's Today programme that there had been "a couple of instances where vulnerable technology has been exploited" in the UK food supply chain, and that the NCSC had alerted a handful of organisations (The Independent). He blamed years of underinvestment in operational technology: equipment kept beyond its intended life, not kept upgraded and not isolated from the internet (The National).

Why this matters to food manufacturers

The controllers in these attacks are not unique to supermarkets. The same families run cold stores, blast freezers, chillers and dispatch areas in food plants. They are often installed and maintained by a refrigeration contractor, who may have set up remote access years ago so they can monitor alarms without a site visit. That access is easy to forget, and it may not appear on your IT team's list of systems at all.

A cold store that drifts to 50°C overnight is not only an equipment problem. It is lost stock, a food safety incident and, for chilled and frozen product, a question your customers' technical teams will ask you to answer.

What to check this week

The CERT-FR and CISA guidance comes down to a few practical steps:

• Find out what is reachable. Ask your refrigeration and building-services contractors which controllers can be reached remotely, and how. Include any 4G or cellular modems they have fitted.
• Take controllers off the public internet. Remote access should go through a VPN or another protected connection, never a login page anyone can find. CERT-FR is clear that restricting access to a contractor's IP addresses is a stop-gap, not a fix.
• Check the settings. Look at defrost schedules and temperature set points for anything you didn't set.
• Update, or replace. Apply the manufacturer's firmware updates, change default passwords and use the strictest security setting available. A controller that has reached the end of its supported life will not be fixed by a reset. Plan to replace it.
• Watch for alarms out of hours. Make sure a high-temperature alarm at 2am reaches someone who can act on it.

How we can help

You can't fix what you can't see. We are offering food manufacturers a free exposure check of their internet-facing systems, using Skwiz, our agentic AI security tester. You tell us which internet addresses your business uses, you authorise the check in writing, and we look for controller and management interfaces that should not be public, as an attacker would. Then we talk you through what we find.

Find out about the free exposure check, or get in touch to arrange one.