Refrigeration attacks across Europe and suspected incidents in the United States have exposed a route from remote computer access to physical destruction. During the night of October 11th, 2026, attackers manipulated refrigeration at around 700 French supermarkets, including Intermarché, Carrefour, and Coopérative U. They triggered abnormal defrost cycles of unlimited duration while disabling temperature alerts, forcing stores to discard food and causing fires at multiple sites.

A further wave on November 1st and November 2nd, 2026, affected more than 115 retailers across Europe. Sweden’s ICA reported 23 affected stores, Ireland’s SuperValu 13, and Dutch Ahold Delhaize at least 40. Over the same period, a cyberattack altered temperature setpoints on Coolworld-supplied refrigeration holding samples and frozen plasma for the French Blood Establishment (EFS), though no products were lost. Similar incidents also predate the supermarket attacks, with the Pentagon investigating freezer malfunctions that spoiled food at US military commissaries in August 2026 as a suspected cyberattack. On November 9th, France formally attributed the October campaign to Shahid Kaveh, a cyber unit of Iran’s Islamic Revolutionary Guard Corps (IRGC).

Claims, attribution, and intent

France’s attribution cites a bundle of indicators rather than a single technical link, with the Foreign Ministry declaring it will summon Iran’s ambassador and propose EU sanctions. Shahid Kaveh is associated with the CyberAv3ngers persona, which compromised internet-exposed Unitronics controllers at US water utilities in late 2023 using methods closely resembling the latest refrigeration attacks. Possible motives have been linked to France’s September 2026 deployment of troops and air-defense systems to Saudi Arabia’s Yanbu oil terminal. However, the attribution covers only the October campaign, and French officials have cautioned against linking every refrigeration incident to the group.

On November 3rd, Z-Pentest and NoName057(16) claimed responsibility for the attacks, though this was treated with caution by the cybersecurity industry and government officials alike, particularly due to NoName057(16) primarily being associated with distributed denial-of-service operations rather than industrial sabotage. However, Russia-linked interference with refrigeration is not without precedent as the US has alleged that the GRU-backed CyberArmyofRussia_Reborn, which has connections with both Z-Pentest and NoName057(16), manipulated controls at a Los Angeles meat processor in 2024. Nonetheless, precedent does not establish responsibility for these latest attacks.

The November wave remains unattributed, with Iranian involvement also suspected in the US incident. Assessed similarities in timing, infrastructure, and tradecraft between the two European waves suggest a single actor, yet the techniques are simple enough for opportunistic or copycat actors to reproduce. A state-directed campaign can impose civilian costs while avoiding overt military confrontation, but the distinction between state sabotage, hacktivism, and opportunism lies in intent, persistence, and coordination rather than in the techniques used or the damage caused.

The weak link in the cold chain

The targeted infrastructure was not simply individual refrigerators. CERT-FR identified Danfoss AK-SM and AK-SC system managers alongside Copeland/Dixell XWEB equipment. These systems supervise refrigeration across a site, allowing maintenance providers to adjust temperatures, defrost cycles, and alarms remotely. Access can therefore expose multiple cabinets without compromising a retailer’s central computer network. Early explanations focused on disclosed software flaws, including a date-derived access code in Danfoss’s AK-SM 800A that could bypass ordinary passwords, fixed in 2025. However, on October 21st, ANSSI’s director attributed the French incidents to exposed administration interfaces and weak passwords, rather than those publicized flaws. Sekoia later reported that reconnaissance began more than a week before the October attacks, while also recording a November 1st attempt to exploit an undisclosed vulnerability, suggesting the attacker’s toolkit may extend beyond weak passwords. Coolworld separately attributed its November incident to an unnamed component supplied by another company.

Danfoss confirmed that most of its affected controllers were either legacy models no longer receiving security updates or newer devices running outdated software. Equipment can keep refrigerating long after its digital protections have lapsed. Remote maintenance introduces a further blind spot. Contractors have been described as connecting controllers through cellular modems rather than a retailer’s managed network, providing convenient servicing access, but potentially leaving an internet connection outside normal security monitoring and equipment records. ICA’s account illustrates this, with all 23 affected Swedish stores having refrigeration equipment connected outside its centrally managed store network, while its central systems were unaffected.

Securing the corporate network therefore does not necessarily secure the equipment on which the business depends, creating an accountability gap in which a maintenance contract can be mistaken for assurance that someone is checking software support, passwords, and remote access. An equipment manufacturer can release a fix without ensuring it reaches every installation, while a retailer can commission servicing without knowing how the contractor connects.

Compounding pressures on food security

The French government has estimated damage from the October campaign at tens of millions of euros. One extrapolation, assuming average losses of €100,000 per store, put French losses at around €40 million, with individual stores reporting losses from €50,000 to €220,000. To counterbalance losses, stores may reduce promotions or raise prices, adding costs for populations already facing a charged political environment. During the October 17th demonstration in France, protesters across Paris, Lyon, and Marseille combined concerns over school conditions with anger about food, gasoline, and energy prices. Refrigeration disruption could reinforce those grievances. A household might lose access to its usual discounted products, pay more for alternatives, or travel farther to another store, all of which are costs not easily absorbed by those balancing food against rent, heating, and transport. If further incidents were to occur, a problem initially attributed to a supermarket could become part of wider criticism of corporate preparedness, regulatory oversight, or government competence.

Attacks on refrigeration infrastructure are likely to act less as a cause of food insecurity in their own right than as an additional strain on a food system whose capacity to absorb disruption is already under pressure. The current El Niño is one such factor. The climate pattern is likely to persist through early 2027 and is assessed by NOAA’s Climate Prediction Center to potentially be the strongest recorded since 1950. Although it has only a limited direct influence on European weather, disruption across major producing regions has historically tightened global supplies of commodities that Europe largely imports, with effects reaching retail prices after a lag of several months.

Ongoing conflicts are a second contributing factor. The effective closure of the Strait of Hormuz following the escalation of conflict involving Iran in February 2026 disrupted a significant share of global seaborne fertilizer trade, and although prices have since eased, fertilizer costs typically take up to six months to pass through to food prices. The World Bank’s October forecast anticipates that food commodity prices will rise by approximately 10% in 2026 and a further 7% in 2027, reflecting El Niño alongside conflict, fuel, and fertilizer pressures. These are global forecasts, not measurements of the attacks’ impact, but they indicate that further disruptions would fall on a system with less margin to absorb them.

The more immediate concern is therefore a sequence of pressures. Poor harvests and higher input costs can make replacement supplies more expensive, while weather disruption can delay their arrival. A cyber incident can then remove stock already in stores or interrupt distribution, and precautionary buying can accelerate depletion of what remains. Even where shortages remain temporary, higher costs and reduced access to affordable alternatives could deepen household frustration amid a period already marked by elevated heating and living costs.

Beyond the supermarket

On November 2nd, an incident involving Coolworld affected three storage sites used by EFS, with target settings reportedly changing from approximately -30°C to 110°C. These were programmed values, not confirmed product temperatures. EFS’s monitoring and alarm systems detected the changes, staff intervened, and plasma was moved to alternative storage, preventing any product loss, with no health consequences identified. This contrasts with the supermarket attacks, where disabled alerts allowed changes to go unnoticed overnight, and suggests that independent temperature monitoring was the key control separating a near miss from a loss. Simultaneous failures across multiple sites, however, could exhaust the spare storage and transport capacity relied on in this instance, forcing stock quarantine, redistribution, or postponement of treatment.

The exposure could extend beyond blood services, with plasma-derived medicines, vaccines, insulin, and other biologics dependent on similar cold-chain equipment, while smaller settings such as community pharmacies or nursing homes may lack equivalent round-the-clock monitoring. A joint advisory released by the US Cybersecurity and Infrastructure Security Agency on November 5th urged operators across industries, including healthcare, to harden refrigeration controllers, indicating that authorities view the activity as a cross-sector threat.

Closing thoughts

The refrigeration attacks show that physical disruption does not require sophisticated malware. Exposed interfaces, weak passwords, and unsupported controllers are enough to destroy stock across hundreds of sites, while also extending into other sectors relying on cold chains. France’s attribution of the October wave has turned a retail disruption into a diplomatic dispute, while the simplicity of the techniques means further incidents need not come from the same actor. For defenders, however, exposure matters more than attribution. Retailers and healthcare providers should treat refrigeration controllers as operational technology within their security scope, require contractors to disclose how they connect remotely, and maintain independent temperature alarms of the kind that protected EFS’s plasma. With El Niño, conflict, and rising food prices already narrowing the margin for disruption, further incidents are likely to carry consequences beyond the stores directly affected, making the security of these overlooked systems a question of resilience rather than routine maintenance.

Attacks like these cut across cyber, geopolitical and physical risk at once. If your team is working out what they mean for your current suppliers, contact us here and see how you can reach an answer you can act on.