European cold chain hacks

A request that this article be renamed to 2026 European refrigerator hacks is under discussion. Please do not move this article until the discussion is closed.

European cold chain hacks

Countries affected by the attacks.
Date	11 October and 2 November 2026
Location	Europe
Type	Cyberattack
Motive	Unkown
Target	Refrigerators and freezers
Outcome	Discard of vast stocks of spoiled goods
Property damage	€10 million+ (estimated)
Accused	Shahid Kaveh (Iran)

On 11 October 2026, an as yet unknown party hacked into the refrigeration controllers at up to 700 French supermarkets and set them to defrost mode overnight, causing their refrigerators to overheat. The cold chain disruption forced the French supermarkets to discard vast stocks of spoiled goods, resulting in losses estimated to total tens of millions of euros. The refrigeration controllers by Danfoss each ran a web server reachable over the public internet, many of them accessible using login credentials 'admin' as the username and the current date as the password.

On 2 November 2026, a similar cyberattack on refrigeration and freezer systems hit French supermarkets across Belgium, Luxembourg, Netherlands, Italy, Sweden, Estonia, Ireland, Portugal, Poland, Spain and Germany. Three blood banks of the national French Blood Establishment [fr] (EFS) were attacked, but it was thwarted before blood plasma could be damaged. Their refrigeration was supplied by Coolworld, who blamed the vulnerability on "a component supplied by a third-party".

On 9 November at the 2026 Paris G7 summit the French foreign minister Jean-Noël Barrot accused Iran of the attack, specifically the Islamic Revolutionary Guard Corps (IRGC) and the Shahid Kaveh cyberwarfare organization.

Background

In May 2026 industrial freezers in Israel were hacked, and in August 2026, a number of United States military base DeCA commissary freezers heated and spoiled food, which the US has investigated as possible cyberattacks.

Hacks

On the night of 11 October 2026, over 300 Intermarché and Netto stores, 80 Coopérative U, 80 Carrefour stores, around 30 Monoprix stores, several E.Leclerc stores, and others were struck in an large-scale cyberattack. The supermarkets' refrigeration systems were compromised and instructed to enter an unusual defrost cycle with their contents still inside. The hack went unnoticed as it did not activate alarms and many employees were not present at the time to stop it. Refrigerators overheated due to the continuous defrosting, with many climbing up to 50°C (122°F) after six hours. A supermarket in Normandy reported some of its refrigerators had reached 80 °C (176 °F). Furthermore, at some supermarkets, the intense heat caused refrigeration equipment to melt or even catch fire; water damage from fire sprinkler systems also occurred. Across France, whole aisles of refrigerated produce and frozen goods were ruined and had to be disposed of due to food safety concerns. An Intermarché supermarket in Issy-les-Moulineaux alone disposed of several tons of products. Various disruptions in the groceries sector occurred in neighboring Belgium, the Netherlands, and to some extent in the United States.

BFM TV initially reported that some locations could face losses in the tens of thousands; two outlets in Alsace alone reported a combined loss of €270,000. The total damage was estimated to have been tens of millions of euros.

On 2 November 2026, a similar cyberattack on refrigeration and freezer systems hit dozens of supermarkets across Belgium, Luxembourg, Netherlands, Sweden, Estonia, Ireland, and Portugal. ICA, one of the targets in Sweden, also used Danfoss controllers. A few German supermarkets like Edeka and CAP Markets were also affected. Blood plasma intended for transfusions at three Blood banks of the French Blood Establishment [fr] (EFS) in France was also targeted in an attempt to heat their refrigerators to 110 °C. However, staff were able to intervene after their monitoring system activated, preventing the blood plasma from being destroyed. The EFS' supplier of refrigeration was Coolworld, which stated the vulnerability concerned "a component supplied by a third-party".

Investigation and analyses

Prime Minister of France Sébastien Lecornu instructed the Agence nationale de la sécurité des systèmes d'information (ANSSI) to investigate the cyberattack and coordinate with other European countries to prevent further hacks. Supermarkets in France commonly outsource refrigeration to third-party companies and cannot manage security measures. Investigators identified AK‑SM800 and AK‑SC355 refrigerator regulator systems by Danish manufacturer Danfoss to be the attack surface. Other controllers found to be affected were Copeland XWEB and Dixell XWEB by Copeland. AK‑SC355 had reached end-of-life in 2016 and AK‑SM800 in May 2021, and were no longer supported with updates. Danfoss had previously advised replacing both of the deprecated models with new ones.

In 2025, cybersecurity firm Claroty's Team 82 had already found multiple vulnerabilities within Danfoss control systems: The refrigerator controllers had a publicly reachable web server with a login screen that could be accessed with the username 'admin' and a hidden "code of the day" function that allowed users to bypass the password by inputting the device's date in its place. Danfoss disclosed Claroty's findings on 24 March 2025 and began their own investigation. In August 2025, Danfoss issued a software release 4.3.1 to their AK‑SM800A series of models which patched the vulnerabilities. AK-SM800A models were unaffected by the hack, except those which had not been updated with R4.3.1.

Investigations in October found the same vulnerabilities within supermarkets throughout Europe, including Belgium, Germany, Luxembourg, the Netherlands, Portugal, Poland, and Spain. Chains in Belgium and the Netherlands reported various IT disruptions of websites, distribution centers, and other critical operations. In the U.S., the Dutch Ahold Delhaize chains Stop & Shop and Food Lion reported IT disruptions and took some systems offline, though not as comprehensively as France.

The Food Protection and Defense Institute of the University of Minnesota noted of legacy systems that "Many industrial control systems used in the food industry are quite old, highly customized, and were not designed with security in place or with the ability to be made secure through updating.". Ken Munro of Pen Test Partners speculated that the culprits could have been "kids messing around," due to ease of the exploit; state actors such as Iran and Russia also possess the capability, sabotage being a known standard method of operation.

On November 9, French Foreign Minister Jean-Noël Barrot accused Iran's Revolutionary Guard Corps of carrying out the hack and said the Iranian ambassador had been summoned to the Foreign Ministry. He also threatened to escalate EU sanctions against Iran.

Reactions

European Commissioner for Agriculture and Food Christophe Hansen commented generically on the attack, saying that "Food security requires more attention at all levels" and that the "exploitation of food has become a reality." Coopérative U CEO Dominique Schelcher described the cyberattack as "unprecedented", "unacceptable," and "extremely serious".

On 4 November, Richard Horne, from the National Cyber Security Centre (United Kingdom), part of GCHQ opined that this was just "the beginning" as AI was now able to find and abuse vulnerabilities in old technology.

On 5 November, the US Cybersecurity and Infrastructure Security Agency (CISA), the FBI, Health and Human Services, U.S. Department of Agriculture (USDA), and the Department of Transportation (DoT) warned about ongoing threats against cold chains.

References