- A wave of coordinated cyberattacks has crippled the refrigeration and freezer systems of numerous supermarkets across Europe
- Blood Bank hit in France
- Governments have upgraded the levels of preparedness recommending minimum 72 hours of food supplies
Over the past several days, retail chains in Sweden, Luxembourg, Belgium, and Estonia have reported unexpected temperature rises in cooling units overnight.
Situation in France
This follows a major attack in France in October, which resulted in massive losses of chilled and frozen goods.
Most recently in Crossing the Line: A highly organized attack hit a Blood Bank
Warning signals on the HVAC units gave officials enough time to go in and move the blood and plasma samples to alternative cooling areas, saving the materials. But this was a highly organized attack, which went through a supplier of HVAC equipment and chillers and used that breach to knowingly go after the blood bank. This crosses a line between going after food stores and big-name brand companies that might be able to absorb it and now creating a life or death situation.
Situation in the United Kingdom
The impact is not confined to the continent; UK businesses have also been caught in the digital crosshairs. Reports indicate that meat processing firms and various retail outlets in Britain are grappling with the same vulnerability. Security experts are currently assessing whether these UK-based attacks originate from the same malicious actors responsible for the wider European incidents. The disruption to the UK food supply chain has prompted immediate engagement from national security agencies to bolster defences around industrial control systems. Experts believe the interconnected nature of modern logistics makes these facilities prime targets for disruption.
Retailers elsewhere have reacted with alarm:
In Sweden, the Coop chain confirmed that six stores were compromised, while ICA Gruppen acknowledged that a number of its locations faced similar incidents. Meanwhile, the Dutch retail giant Ahold Delhaize reported the issue to police, confirming that dozens of its supermarkets in Belgium and Luxembourg were targeted.
The technical sophistication required for these attacks has led to immediate, emergency efforts to isolate affected systems from the public internet.
Technicians have worked through the night to disconnect units, preventing further spoilage. In Ireland, 13 SuperValu supermarkets also reported that a cyber incident impacted their refrigeration systems, although the Musgrave Group noted that this was restricted to a specific type of controller.
Technical Vulnerabilities
Investigations suggest that the perpetrators are remotely overriding settings on thousands of internet-connected fridges and freezers. In the French case, hackers accessed controllers manufactured by the Danish firm Danfoss, pushing temperatures from optimal levels to over 50C. Alarm systems were disabled, and defrost programmes were extended, forcing supermarkets to discard large volumes of meat, dairy, and frozen products. While Danfoss had previously advised clients to install security updates, the sheer scale of the intrusion demonstrates how easily connected operational technology can be exploited.
Governmental Response
Public prosecutors in France have opened formal investigations, as damage has extended beyond food spoilage to include reported fires in some facilities. National cyber security agencies are now working in tandem to identify the perpetrators. The widespread nature of the attacks has shifted the focus from isolated incidents to a systemic threat, with governments and trade bodies urging businesses to audit their internet-facing cooling systems immediately.
As investigators dig deeper, the necessity for robust, air-gapped security protocols for industrial refrigeration has become clear. Companies are being urged to reassess their reliance on remotely accessible management software.
Rebecca Moody, Head of Data Research at Comparitech says that supermarkets may appeal to hackers because disruption to an essential part of everyday life can create widespread concern. Although no group has claimed responsibility for the recent attacks, shared software may have enabled incidents across multiple chains.
She advises retailers and suppliers to patch vulnerabilities, update systems, train staff to identify scams, back up data and prepare for worst-case scenarios.
“In a bid to help prevent these attacks, food and beverage companies (and the third-party software companies they work with) need to make sure basics are covered. Patch vulnerabilities as soon as they’re flagged, carry out regular software updates, ensure staff are trained to spot phishing emails, social engineering calls, etc., and make regular system and data backups. Having a worst-case-scenario plan in place is also essential.” Moody stated.
Nations encourage populations to be prepared for disruptions of utilities and distribution systems (Prepping)
There does seem to be a “modest” groundswell of prepping notions being issued by governments (progressive or conservative either one), the most aggressive of which is stemming from Europe.
The United Kingdom has launched the multi-year “Be Ready” campaign, advising at least 9 liters of water per person, shelf-stable food requiring no cooking, battery/wind-up radios, and cash. Tree days minimum (72) hours.
The European Union’s Preparedness Union Strategy sets a bloc-wide baseline standard for household self-sufficiency during hybrid warfare threats (72 hrs minimum).
The Nordic Block (Denmark, Norway, Sweden) Sweden updated its nationwide “In Case of Crisis or War” guidance (7-day standard) chronicle+1; Norway mandates 7 days; Denmark issued 72-hour directives including water and iodine tablets.
Japan’s formal guidance urging households to secure minimum 3-day (preferably 1-week) provisions of water, ready-to-eat food, and emergency sanitation packs.
Businesses are being warned that the threat is persistent, and extreme vigilance is required to protect both the food supply chain and overall operational integrity. The incident serves as a crucial warning that in our increasingly interconnected world, even the most basic infrastructure requires sophisticated, multi-layered protection against digital interference.
Hackers are getting far more sophisticated, and we are seeing the early signs of how serious AI-assisted hacking activities are. This could be the Black Swan event to watch for 2027.
Sources:
ITV | Independent | CERT.FR | Le Soir | Guardian | Aftonbladet | BBC | RTE | Cyber Security Intelligence
Courtesy of ARMADA Corporate Intelligence’s Flagship Report Monday November 01, 2026 Issue and Flagship Report Friday November 06, 2026 Issue