Grocery stores across at least eight European countries woke up on Monday to a silent assault on their refrigeration systems. In Belgium, Luxembourg, Sweden, Ireland, Estonia, Finland, the Netherlands, and Portugal, hackers remotely manipulated cooling controllers, sending temperatures soaring to as high as 50°C in some cases and forcing retailers to discard tonnes of spoiled meat, dairy, and frozen goods. The scale of the disruption was big, with around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, alongside 15 Carrefour stores, 13 SuperValu outlets in Ireland, and seven Intermarché stores in Portugal.
One Delhaize branch alone estimated its losses at over €100,000, and industry wide costs are expected to run into the millions. The EU’s food and agriculture commissioner, Christophe Hansen, did not mince words, calling the incidents “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”.
A Known Vulnerability
What makes this attack so alarming is not its sophistication but its simplicity. The hackers did not need to breach sophisticated firewalls or deploy custom malware. They exploited well documented vulnerabilities in refrigeration controllers manufactured by the Danish firm Danfoss, specifically the AK-SM 800 and AK-SC 355 models, many of which are “legacy” products that no longer receive software or security updates and are often running outdated firmware. Researchers had warned about these flaws for months with the authentication bypass and command injection vulnerabilities were publicly identified in 2025, and demonstrations of how they could be chained for remote code execution were published well before the first attack.
Worse still, thousands of these controllers remain directly accessible via the open internet. A Reuters investigation using the Shodan search engine found at least 4,500 Danfoss interfaces still viewable online the day after the French attack. In the Netherlands, some affected systems were found to be using default passwords and connected to unsecured networks. As Ken Munro of Pen Test Partners put it, the attackers were “essentially pushing at an open door”.
From Nuisance to National Security Threat
The immediate effect is financial loss and consumer inconvenience, but the longer term implications are far more serious. Refrigeration is not a peripheral system but the backbone of the modern food supply chain. The ability to remotely manipulate temperatures across hundreds of stores in multiple countries demonstrates that critical civilian infrastructure remains dangerously exposed. The attacks follow a similar operation in France on 12 October, which affected as many as 700 supermarkets, caused fires, and inflicted tens of millions of euros in damage.
The fact that no group has claimed responsibility, and no ransom demand has been issued has puzzled investigators, suggesting the motive may not be financial but rather a demonstration of capability or a test of vulnerabilities. Authorities across Europe are increasingly concerned that such tactics could be used in a state sponsored hybrid warfare campaign, designed to sow chaos, erode public trust, and test the resilience of supply chains without firing a shot.
The American Exposure
The question now is whether this is the beginning of a broader campaign. The technical similarities between the French and European attacks suggest a coordinated actor or a copycat leveraging the same publicly known flaws. Crucially, the vulnerabilities are not confined to Europe. Danfoss markets its refrigeration monitoring and management systems in the United States, and Copeland, a US based manufacturer, sells similar controllers that manage grocery store display cases and walk in refrigerators. The Pentagon is already investigating whether cyberattacks caused freezer malfunctions at six US military commissaries in August, a development that shows how directly this threat translates to American soil.
If an adversary can remotely disable refrigeration in European supermarkets, the same techniques could be used against military supply depots, hospitals, and food distribution centres anywhere in the world. The EU has recognised the gravity of the moment, with Commissioner Hansen warning that the “exploitation of food” is now a “reality”. The attacks have exposed a gap between the physical security of food infrastructure and its digital vulnerability that has been left unaddressed for years.