Cyberattacks in Europe: What the Supermarket Fridge Hack Says About the Systems Nobody Watches

In October and November 2026, attackers reached into hundreds of European supermarkets and quietly switched their fridges and freezers to defrost mode overnight. No ransomware note, no stolen database. Just spoiled food, closed aisles and, in a second wave, blood banks watching the temperature of their cold rooms climb. The entry points were old refrigeration controllers, default passwords and a third-party contractor’s remote access: the systems nobody watches.

That is what makes this the most instructive cyberattack of the year for ordinary companies. It required no exotic technique, and every ingredient it used exists, in some form, in most organisations. This article looks at what happened, why it fits the broader pattern of attacks on Europe in 2026, and what a company of normal size and budget can actually do about it.

As usual on this blog, this is practical guidance from an engineering perspective, not legal advice.

What happened, briefly

On the night of 11 October, refrigeration controllers in up to 700 French supermarkets, including hundreds of Intermarché and Netto stores and dozens of Coopérative U, Carrefour and Monoprix locations, were switched to defrost mode, overheating fridges and spoiling stock. On 2 November a second wave hit stores across Belgium, Luxembourg, the Netherlands, Italy, Sweden, Estonia, Ireland, Portugal, Poland, Spain and Germany: dozens of Ahold Delhaize supermarkets in Belgium and Luxembourg, 15 Carrefour stores in Belgium, even an IKEA in Mons, as The Hacker News documented.

The same wave reached beyond retail. Three French blood banks detected temperature spikes in their cold rooms after a refrigeration equipment provider of the French Blood Establishment was compromised; monitoring alarms caught the anomalies before any blood products were lost, per Help Net Security. On 9 November, France formally accused Iran’s Revolutionary Guard Corps of being behind the attacks and summoned the Iranian ambassador. Attribution in these cases is a political act as much as a technical finding, but the geopolitical reading matters: European companies are now targets in conflicts they are not party to.

The anatomy: nothing here was sophisticated

Strip away the headlines and the attack decomposes into three mundane ingredients.

Forgotten connected equipment. Most of the units hit in France were older controller models that the manufacturer no longer updates. They had been running for years, doing their job, invisible to whoever thinks about security, because a fridge controller is nobody’s system. Until it is everybody’s problem.

Trivial access. The Dutch systems that were hit were not on a secure network and still used factory default passwords. Security researchers had observed authentication attempts against these controller models since 20 October, probing exactly for that. The manufacturer’s advice after the first wave was almost embarrassing in its simplicity: disconnect the units from the internet and reconnect them only through a secure network.

A third party in the middle. In many of the affected chains, refrigeration is installed and operated by an external contractor with its own remote access. The blood banks were not attacked at all; their equipment provider was. The victim and the point of entry were different companies, which is precisely the pattern we described in our article on surviving supplier failure, now with intent behind it instead of accident.

Why this fits the 2026 pattern

The fridge hack is colourful, but the statistics behind it describe a broad shift. According to Black Kite’s 2026 European Cyber Risk Report, publicly disclosed ransomware attacks in Europe rose 55% in the first four months of 2026 compared with a year earlier, with third-party suppliers becoming a primary entry point and manufacturing the most-hit sector for the fourth consecutive year. Germany, the UK, France, Italy and Spain concentrate 70% of incidents.

Two numbers in that research deserve the attention of every mid-size company. First, 73% of ransomware attacks in Europe and North America since 2023 hit mid-market companies, not corporations; the median victim has around US$ 43 million in annual revenue. Second, the attacks increasingly arrive through the supply chain: ENISA’s EU threat landscape report cites a single ransomware attack on a Swedish IT supplier that affected around 200 municipalities and regional authorities at once.

The comfortable idea that “we are too small and too boring to be a target” did not survive 2026. Mid-size companies are the preferred target now, exactly because they run valuable operations on thinner security budgets, and because access to one supplier opens doors to all its clients.

What a normal company can actually do

None of what follows requires a security operations centre. It requires engineering discipline applied to unglamorous places.

1. Inventory everything that is connected, not just the IT. Refrigeration, HVAC, access gates, cameras, printers, industrial controllers, building automation. You cannot defend equipment you do not know is online. In our assessments, the list of internet-reachable devices a company actually has is reliably longer than the list anyone expected.

2. Take off the internet what does not need to be on it. Most operational equipment needs a network, not the public internet. Segment it: a compromised fridge controller on a flat network is a foothold; on a segregated one, it is an isolated incident.

3. Kill default credentials and name every remote access. Every device password changed from factory default, every supplier’s remote access known, scoped to what that supplier maintains, protected by multi-factor authentication, and revocable in minutes. If nobody can say who can reach your equipment from outside, that is the finding.

4. Treat suppliers as part of your attack surface. The contractor who operates your refrigeration, your building systems or your machines is an extension of your network. Ask them the same questions you would ask yourself: how do you access our equipment, who exactly has that access, what happens when your own systems are compromised. Put the answers in the contract.

5. Make end-of-support equipment a conscious decision. Controllers that no longer receive updates do not have to be replaced tomorrow, but someone has to decide, in writing, whether each one gets upgraded, isolated or retired. The dangerous state is the default one: unsupported, connected and forgotten.

6. Monitor the physical values, not just the network. The blood banks lost nothing because temperature alarms fired and people reacted. Simple threshold monitoring on temperature, pressure or state, independent of the controller itself, turns sabotage into an incident instead of a loss.

7. Rehearse the ugly night. What saved the supermarkets that got off lightly was people disconnecting units from the network in the middle of the night. Does your team know what to unplug, in which order, at 3 a.m., without breaking something worse? A one-page runbook per critical system answers that, and NIS2 expects you to have the reporting side ready as well: we covered those obligations in our article on NIS2 and legacy systems.

The real lesson: maintenance is security

Notice what the list above is. It is not a shopping list of security products. It is inventory, documentation, segmentation, credential hygiene, supplier management and monitoring: in one word, maintenance. The attacks of 2026 did not defeat strong defences; they walked through doors that had been standing open for years in systems nobody was assigned to watch.

That is the work Dink does every day. Taking responsibility for the systems nobody wants to own means exactly this: knowing what exists, what is exposed, who has access and what happens when something misbehaves. And it is where a technology assessment usually starts: not with a penetration test, but with the honest map of forgotten systems, supplier accesses and end-of-support equipment that most companies have never drawn.

Frequently asked questions

What happened in the European supermarket cyberattacks of 2026?
In October and November 2026, attackers remotely switched refrigeration systems to defrost mode in hundreds of supermarkets, first in France and then across at least eleven European countries, spoiling stock and disrupting stores. French blood banks were also affected through a compromised refrigeration supplier. The attacks exploited old controllers, default passwords and third-party remote access.

Who was behind the attacks?
France formally accused Iran’s Revolutionary Guard Corps on 9 November 2026 and summoned the Iranian ambassador; Microsoft had earlier pointed to Iran as the likely actor in the October incident. As with most state-linked attributions, independent technical confirmation is limited, and companies should plan for the technique rather than the actor.

My company is mid-sized. Are we really a target?
Statistically, you are the main target: 73% of ransomware attacks in Europe and North America since 2023 hit mid-market companies, and attackers increasingly reach victims through their suppliers rather than head-on. Being small reduces your visibility, not your exposure.

What is the first practical step to protect our company?
An inventory of everything connected to a network, including operational equipment such as refrigeration, HVAC, cameras and industrial controllers, together with the list of suppliers that hold remote access. Every measure that matters, segmentation, credentials, monitoring, response, depends on that map existing.

Does NIS2 apply to incidents like these?
For entities in scope, yes: NIS2 requires risk management covering supply chain security and rapid incident reporting, with an early warning within 24 hours of becoming aware of a significant incident. Even companies outside its direct scope are increasingly asked by in-scope clients to demonstrate the same discipline.

Not sure what in your operation is connected, exposed or quietly out of support? That map is the first deliverable of a fixed-scope technology assessment, or get in touch.