Cybercriminals are no longer only targeting data, banks, or government agencies. Now, the refrigeration systems of supermarkets are also becoming targets, with visible consequences for food products.
On Monday, November 2, 2026, several Swedish stores awoke to find their refrigerators and freezers had abnormally risen in temperature. Some equipment was reportedly set to 50 degrees Celsius, resulting in the destruction of goods.
The incident recalls a large-scale cyberattack that occurred in France three weeks earlier, where several hundred supermarkets had their refrigeration systems manipulated remotely.
From France to Sweden, and even to U.S. military installations under investigation, a question is starting to concern experts: Are food preservation infrastructures now a new target for international cyberattacks?
Sweden: Freezers Turned into Heat Sources
The alert was issued in the morning of November 2 in several Swedish stores.
In Sjöbo, in the south of the country, staff at an ICA supermarket discovered that the refrigeration systems were no longer operating normally. Store officials reported that the settings had been altered and some freezers displayed a positive temperature of 50 °C.
The store manager told Swedish television TV4 that teams could no longer adjust the temperatures. The systems were generating heat instead of keeping foods cold.
Food products worth several hundred thousand Swedish krona were reportedly lost.
The store had to temporarily halt operations to allow staff to empty the units and assess the damage.
Other ICA establishments, including in Tomelilla and on the island of Öland, also reported incidents.
The Coop chain confirmed that six of its stores in central Sweden faced similar issues.
ICA acknowledged an incident affecting a limited number of stores, but the exact technical causes are still to be determined. The possibility of a cyberattack is being considered by officials from some establishments.
France: Hundreds of Supermarkets Affected Overnight
To understand what happened in Sweden, we must go back to the night of October 11-12, 2026.
That evening, an unusually large cyberattack struck the refrigeration systems of numerous French supermarkets.
The brands Intermarché, Netto, Carrefour, Coopérative U, E.Leclerc, and Monoprix were among the affected businesses.
The mechanism is particularly destructive: hackers remotely access temperature control devices, then alter their functioning.
In several establishments, temperatures reached 50 °C, far exceeding levels necessary for food preservation.
Defrosting systems, normally used for short periods, were activated or prolonged abnormally.
As a result, entire aisles of fresh and frozen products became unsellable.
Some stores had to discard several tons of goods. In others, equipment overheated to the point of causing fires.
According to an analysis released on October 28 by the Luxembourg Institute of Science and Technology, French authorities reported approximately 700 affected stores.
The national economic damage amounts to millions of euros, without a final consolidated assessment being available.
Danfoss and Dixell: Refrigeration Technologies Under Scrutiny
Initial French investigations identified weaknesses affecting refrigeration management systems marketed by the Danish company Danfoss.
These connected devices allow professionals to monitor and control their facilities remotely.
However, some older versions had known security vulnerabilities.
Danfoss stated it had previously recommended updates and the replacement of obsolete equipment.
On October 13, a second wave of attacks also targeted installations using Dixell equipment, showing that incidents were not limited to a single manufacturer.
In a retail establishment in southwestern France, a specialist noted that temperature settings had been altered to extreme values, reaching up to 150 °C for freezing settings.
This value corresponds to a reported software setting and not necessarily to the temperature actually reached by the food or equipment.
The proliferation of affected devices reveals a more general vulnerability: some connected industrial equipment remains exposed to the Internet without adequate protections.
Reported Incidents in Several European Countries
The French situation could transcend national borders.
According to Reuters, a cybersecurity expert also reported incidents in Spain, Portugal, Poland, Germany, and Belgium.
However, these reports should be distinguished from officially confirmed attacks: the number of affected installations and the specific circumstances have not been established for each of these countries.
Sweden is now added to the list of territories facing similar disruptions to their refrigeration systems.
The recurrence of these events is drawing attention from specialists to a common weakness in connected commercial infrastructures.
At this stage, no public evidence allows us to assert that the Swedish and French incidents were perpetrated by the same actors.
In the United States, the Pentagon is investigating suspicious incidents
Concerns extend beyond European retail networks.
On October 29, Reuters revealed that the U.S. Department of Defense was investigating incidents affecting refrigeration equipment at several military installations.
At least six U.S. bases were reported to have experienced malfunctions occurring in August.
In one of the cases examined, settings were reported to have been changed to defrost mode, leading to the spoilage of food products.
The U.S. Cyber Command and investigative services from the military are participating in the investigations.
U.S. authorities are also exchanging information with their French counterparts.
However, this does not yet constitute proof of an established coordinated international campaign. But the similarity of incidents justifies examining potential technical or operational links.
Why Are Hackers Targeting Freezers?
Unlike traditional cyberattacks, which often aim to steal data or obtain a ransom, the operations observed in French supermarkets seem primarily aimed at disrupting the physical operation of the equipment.
Their effectiveness relies on a simple principle: cause the destruction of goods without needing to physically enter the buildings.
A prolonged break in the cold chain can render considerable quantities of meat, fish, dairy products, or frozen goods unfit for consumption.
Therefore, the impacts extend far beyond the cost of technological repairs.
They include stock losses, logistical disruptions, temporary closures, restart costs, and health risks.
Thus, attacking a computer system becomes an act of sabotage with direct material consequences.
Who Is Behind These Operations?
This remains one of the main uncertainties in this matter.
In the French case, no public claim has clearly identified a responsible group in the initial investigations.
Authorities are particularly looking for traces left in the systems, potential malicious connections, and the means used to take control of the equipment.
Several hypotheses remain open regarding motivations: sabotage, economic disruption, demonstration of technical capabilities, or coordinated action.
However, none can be considered a definitive explanation without additional evidence.
The fact that some operations were conducted without ransom demands distinguishes these events from many cyberattacks targeting businesses.
A New Threat to Food Security?
These incidents highlight how the digitization of infrastructures can expose essential activities to new risks.
Supermarkets today use connected systems to optimize their energy consumption, remotely control installations, and automate the management of their equipment.
These technologies provide significant economic advantages, but their compromise can also cause immediate damages in the physical world.
The question now transcends the security of just retail chains.
Cold storage warehouses, food processing units, logistics platforms, and storage facilities may have comparable vulnerabilities when using inadequately protected connected equipment.
In response to this threat, specialists particularly recommend updating industrial software, limiting remote access, segregating technical networks, and establishing independent alert systems.
A Series of Attacks Calling for an International Response
In less than a month, incidents affecting refrigeration systems have revealed a new category of risks for businesses and food infrastructures.
The French events demonstrated that a cyberattack could lead to the destruction of goods in several hundred stores within hours.
The Swedish incidents of November 2 show that this phenomenon is not limited to France.
As for the U.S. investigations, they underscore the attention now given to these vulnerabilities in particularly sensitive environments.
The identity of the perpetrators, their motivations, and the existence of possible connections between the operations remain to be determined.
One thing is, however, established: when a connected industrial equipment becomes vulnerable, the cybersecurity risk can quickly escalate into an economic, logistical, and food crisis.
