EXPLAINED | Hacked Freezers: How Can a Cyberattack Spoil Your Food?

What happened to Europe’s supermarket freezers?

Supermarkets and other food shops in Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia reported refrigeration problems on November 2, 2026, in a suspected cyberattack. The disruption forced some retailers to remove chilled and frozen products from sale.

Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected. Ireland’s SuperValu said refrigeration equipment of a specific model at 13 stores was affected. Seven Coop shops in Sweden also reported problems.

An ICA store in Sjöbo, Sweden, said its refrigerators and freezers had been hacked and set to 50°C. That describes an altered setting; establishing the temperatures reached by individual food products requires separate measurements.

Investigators have not publicly established who was responsible or whether every incident had the same cause.

How can a hacker control a freezer?

By reaching the computer systems that tell refrigeration equipment what to do.

Large shops use controllers to manage cooling equipment, temperatures, alarms and operating schedules. Remote access allows technicians to monitor and maintain installations without visiting every store.

This is operational technology: digital systems that monitor or control physical equipment. Access to their controls can affect what a machine actually does.

France’s cybersecurity agency, CERT-FR, has documented compromised refrigeration controllers from Danfoss, Copeland and Dixell. Its alert warns against exposing management interfaces directly to the internet. That establishes a known security problem; it does not identify the entry point for every November incident.

Why would putting a freezer into defrost mode ruin food?

Defrosting is a normal maintenance function that removes accumulated ice. It is meant to happen under controlled conditions.

Stephan Moelans, chief executive of Belgian refrigeration specialist Sabcobel, said attackers switched affected units’ evaporators into defrost mode. An evaporator is the part of a refrigeration system that absorbs heat to provide cooling.

If the normal cycle is manipulated, a unit can spend too long warming instead of maintaining its required temperature. Food that depends on continuous refrigeration can then become unsuitable for sale.

The important point is that attackers can misuse an existing machine function. The damage does not require physically entering a shop.

Had supermarkets already been warned?

Yes. France experienced a major refrigeration attack in October, affecting hundreds of stores and forcing food to be discarded.

CERT-FR first issued its alert on October 12 and updated it on October 16. It identified multiple affected controller families and told operators to check their entire configuration, including defrost schedules.

Copeland’s subsequent guidance acknowledged a vulnerability in an older generation of XWEB EVO controllers that had reached the end of service. It urged customers to remove those units from the public internet and plan migration to supported equipment. It also said newer equipment should not be openly exposed online.

The incidents highlight a maintenance problem: equipment can remain mechanically useful after its software stops receiving security fixes.

Why can’t shops simply freeze the food again?

Because making food cold again does not establish that it stayed safe while it was warm.

The decision depends on the food, the temperature it reached and how long it remained there. Some partially thawed food can be safely refrozen under specified conditions; other food must be discarded.

The US Food and Drug Administration says appearance and smell alone cannot establish safety. Its guidance allows refreezing certain food that still contains ice crystals or remains sufficiently cold, while warning that inadequately refrigerated perishables can cause illness even after thorough cooking.

Retailers, therefore, need reliable temperature records and product-specific assessments. Restoring a freezer’s display to its normal reading does not reconstruct the conditions its contents experienced.

Have hackers disrupted physical systems elsewhere?

Yes. Electricity and water systems provide documented examples.

On December 23, 2015, attackers remotely operated controls at Ukrainian electricity distribution companies. A US Department of Energy report records outages affecting approximately 225,000 customers for between one and six hours. The attackers also interfered with operators’ ability to restore control.

In November 2023, the US Cybersecurity and Infrastructure Security Agency reported exploitation of a controller at a municipal water facility. The authority disconnected the affected system and switched to manual operations. CISA said there was no known risk to drinking water or the water supply.

These examples show both the potential disruption and the value of being able to operate safely when remote controls become untrustworthy.

How does this connect to India?

Indian food businesses depend on maintaining the cold chain, meaning temperature control through storage, transport and sale.

FSSAI’s food-business requirements specify receiving frozen food at −18°C or below and transferring it promptly into storage maintained at the required temperature. A shop needs confidence in those conditions regardless of what its connected dashboard reports.

India also has a documented example of digital disruption affecting an essential service. After the November 2022 AIIMS Delhi cyberattack, five servers hosting its e-Hospital application were affected. Most registration, appointment, admission and discharge functions returned after two weeks, according to a parliamentary answer. Operations and record-keeping continued manually.

The AIIMS case concerned hospital information systems. It does not establish that attackers remotely controlled medical equipment.

What can businesses do to prevent another freezer attack?

Protect remote access and ensure equipment can be monitored and restored securely.

CERT-FR recommends removing direct internet exposure, checking settings, updating supported systems and using protected access. It warns that resetting an obsolete, vulnerable controller without fixing its exposure can leave it open to another compromise.

Copeland’s guidance similarly recommends restricted remote connections, changed default passwords, configuration checks and replacement of unsupported systems. A protected connection can use a virtual private network, or VPN, which provides an encrypted route for authorised access.

For a food retailer, restoring the computer connection and establishing that stock is safe are separate tasks.

What happens next?

Retailers must restore reliable cooling, assess affected stock and determine how access was obtained. Investigators must establish whether the incidents across different countries are connected.

The unresolved questions include the exact equipment involved, whether earlier warnings were acted upon and how quickly alarms detected the changes.

For shoppers, the practical question is whether a store can account for what happened to its food during the disruption. Reopening the doors is only part of the recovery.