The hackers who turned Europe's freezers into ovens

At about 4 a.m. on October 12, 2026, a delivery driver arrived at an Intermarché supermarket in Gradignan, near Bordeaux, France. It should have been another normal Monday morning. But the driver noticed something unusual. The supermarket's storeroom was flooded.

The temperature inside the cold room had risen to 50°C, triggering the automatic sprinkler system.

For the supermarket's owner, Charles Dezon, it was a disaster. He would eventually lose approximately €21,000 (₦31.6 million) worth of frozen food.

The problem was not caused by a power failure, as my Nigerian people would readily suspect. NEPA no take light. Neither was it caused by climate change or an ordinary refrigerator malfunction.

Someone, somewhere, had deliberately manipulated the supermarket's refrigeration system to produce excessive heat.

And they had done it remotely, through the internet.

The attack had apparently begun around 11 p.m. the previous night, while most people were asleep. By the time it was discovered, the damage had already been done.

What makes this story particularly interesting is that Dezon was not alone.

That same night, hundreds of supermarkets across France experienced similar attacks. Approximately 300 Intermarché and Netto stores were affected, alongside about 100 Coopérative U outlets, 80 Carrefour stores, 30 Monoprix stores and several E.Leclerc supermarkets.

At another Intermarché supermarket in La Haye, Normandy, temperatures reportedly reached 80°C in parts of the equipment, causing some components to melt.

In Haguenau, northeastern France, an Intermarché supermarket had to close temporarily while workers removed spoiled products.

Across the affected stores, workers arrived to discover that refrigerators and freezers which should have preserved food had instead overheated it.

Thousands of kilograms of meat, fish, vegetables, dairy products and other perishables had to be discarded.

The estimated losses ran into millions of euros.

In my previous article, I discussed how North Korean hackers stole approximately $6.34 billion (₦8.54 trillion) from Binance, the world's largest cryptocurrency exchange, on October 29, 2026.

I explained how the attackers used fake job interviews, malicious software and stolen credentials to infiltrate the company before executing the theft.

But while the world was still trying to understand how hackers could steal billions of dollars within minutes, another wave of cyberattacks was unfolding across Europe.

This time, the hackers were not stealing money. They were destroying food by manipulating refrigerators remotely.

And the story reveals a frightening weakness in the increasingly connected world we live in.

Let me explain how they did it.

Modern commercial refrigerators are not simply electrical appliances that you plug into a socket and switch on.

Many are connected to sophisticated computer systems that allow technicians to monitor temperatures, control cooling cycles and troubleshoot problems remotely.

A supermarket with dozens of refrigerators can have its entire refrigeration infrastructure monitored from a central location. A maintenance company can detect a problem, adjust a setting or restart equipment without physically visiting the store.

This is one of the benefits of what we call the Internet of Things, or IoT.

But there is a problem.

If the systems are not properly secured, someone who has no business accessing them may be able to take control.

Investigators discovered that many of the affected supermarkets used refrigeration management systems supplied by Danfoss, a Danish engineering company.

The systems included a feature that allows refrigerators and freezers to defrost automatically. This is necessary because ice can accumulate and reduce cooling efficiency.

Under normal circumstances, a defrost cycle lasts for a limited period before the system resumes cooling.

The hackers exploited weaknesses in the controllers to manipulate those settings.

In the French attacks, they reportedly raised the defrost temperature to 50°C and extended a normal one-hour cycle to eight hours.

Think about that for a moment.

A refrigerator that should maintain food at freezing temperatures was instructed to run an excessive heating cycle for eight hours.

The manipulated settings also delayed some alarms, giving the attackers more time to cause damage.

The frightening part is that the security weaknesses were not entirely new.

Danfoss had previously issued security advisories, including warnings in 2025, urging customers to update affected systems.

Some of the compromised equipment had reached the end of its supported lifespan and was no longer receiving security updates.

In other words, many of these systems were running software with known security weaknesses.

The attackers simply exploited them.

But the attacks did not end in France.

On November 2, 2026, another wave struck supermarkets and other businesses across Europe.

In Belgium, approximately 15 Carrefour supermarkets were affected. Dozens of Delhaize stores also experienced refrigeration problems, while Intermarché and five Spar outlets operated under the Colruyt Group reported similar incidents.

Even Ikea was not spared. Its store in Mons, Belgium, experienced a cyberattack affecting its refrigeration equipment.

At the De Laet & Van Haver butcher shop in Hove, near Antwerp, the owner, Luc De Laet, discovered that refrigerator temperatures had risen to approximately 18°C.

He estimated that €15,000 (₦22.6 million) worth of meat had been destroyed.

In neighbouring Luxembourg, four Delhaize stores were affected.

In Sweden, the supermarket chains ICA and Coop reported incidents.

At an ICA supermarket in Stockholm, the attack reportedly began around 2 a.m., but workers did not discover the problem until several hours later.

The freezers had reached 50°C.

Engla Ingwall, a sales manager at the store, described the situation to Reuters in three words: "Everything is destroyed."

At an ICA Kvantum supermarket in Sjöbo, southern Sweden, workers were photographed emptying freezers and loading spoiled food into shopping carts for disposal.

Swedish retailer ICA eventually reported problems at 23 stores. Coop reported disruptions at seven stores.

In Ireland, Musgrave, the company behind the SuperValu supermarket chain, confirmed that refrigeration systems at 13 stores had been affected. Chilled and frozen products were removed from sale as a precaution.

In Portugal, the Mosqueteiros Group reported incidents at seven Intermarché supermarkets. The company indicated that the cyberattack appeared to have targeted an external service provider responsible for managing refrigeration systems.

In Italy, at least four Coop supermarkets in Sicily, operated by the Radenza Group, were affected, alongside other reported incidents.

Giuseppe Spadaro, head of the Radenza Group, told the Italian news agency ANSA that the attack occurred at around 4 a.m. and targeted the remote-control systems managing frozen-food sections.

In Estonia, a Selver supermarket was targeted. The attackers accessed a computer controlling the refrigeration system and raised the temperature setting to 50°C.

Fortunately, the incident was detected and contained within minutes, preventing significant damage.

In Finland, smaller supermarkets belonging to the Kesko Group, popularly known through its K-store brands, reported unusual refrigeration temperatures. The company investigated possible interference through its network, although a cyberattack had not been conclusively established.

In the Netherlands, at least 17 businesses, mainly butcher shops and neighbourhood grocery stores, experienced refrigeration disruptions. Unlike the major supermarket chains, many of these were smaller businesses that could suffer considerable losses from a single incident.

And then came Germany.

At a Rewe supermarket in Raesfeld, hackers reportedly manipulated refrigeration settings, forcing the disposal of food.

Two CAP supermarkets in Wuppertal and Wetter-Volmarstein were also affected.

Edeka supermarkets in Reisbach, Bavaria, and Lilienthal, Lower Saxony, reported similar incidents.

At the Edeka store in Lilienthal, the owner told German media that the fresh-food counter had reached approximately 70°C, while the cold rooms reached 30°C.

An entire container of food had to be discarded.

The attacks also reached Denmark, the home country of Danfoss, one of the manufacturers whose refrigeration systems were affected.

According to Denmark's Agency for Public Security, five Danish businesses were targeted by cyberattacks on their refrigeration and freezing systems on November 2.

The affected businesses included a food manufacturer, a catering company and a biotechnology company. Authorities did not publicly identify the companies.

Fortunately, the businesses were able to regain control quickly, preventing major disruptions.

Denmark's Confederation of Industry subsequently warned companies relying on refrigeration and freezing equipment to pay particular attention to their systems.

Interestingly, two major Danish supermarket operators, Coop and Salling Group, said they had not experienced attempted attacks. This was a reminder that the wave was not limited to supermarkets.

Any business relying on connected refrigeration equipment could potentially be exposed.

In Romania, six stores belonging to the same, unnamed retail chain recorded unusual increases in their refrigeration temperatures during the same period.

The incidents occurred either simultaneously or within a short interval, raising suspicions of deliberate interference.

Romania's National Cyber Security Directorate became involved in examining the incidents, although the authorities had not confirmed that the temperature increases were caused by hackers.

The name of the supermarket chain and the locations of the six stores were not publicly disclosed.

And then there was the United Kingdom.

On November 3, the Association of Independent Meat Suppliers confirmed that three British meat suppliers had been affected by attacks involving refrigeration control systems.

The attackers had exploited vulnerable Copeland XWEB controllers, another type of system used to manage commercial refrigeration.

At some affected facilities, the systems were manipulated to initiate repeated defrost cycles.

One British meat industry report described a refrigeration unit reaching 100°C.

Fortunately, the affected units at the facilities covered by the association's statement were empty, and no meat was lost.

Imagine what could have happened if the units had been filled with products awaiting distribution.

These attacks affected different types of businesses, from multinational supermarket chains to independent butcheries, meat-processing companies and other businesses requiring cold storage.

By early November, reports of confirmed or suspected related incidents had emerged from France, Belgium, Luxembourg, Sweden, Ireland, Portugal, Italy, Estonia, Finland, the Netherlands, Germany, Denmark, Romania and the United Kingdom.

That is 14 European countries, although not every reported case had been conclusively established as a cyberattack or linked to the same perpetrators.

What began as an unusual incident in French supermarkets had become an international cybersecurity problem.

But there was an even more disturbing development.

On November 2, three cold-storage facilities belonging to France's national blood service, Établissement Français du Sang, were affected by a cyberattack involving a refrigeration equipment provider.

These facilities were not storing vegetables, fish or meat.

They were storing blood products and medical samples.

The attackers manipulated temperature and defrost settings to dangerously high levels.

Fortunately, the organization's monitoring and alarm systems detected the abnormalities early enough for employees to intervene.

No blood products or samples were lost, and no health consequences were identified.

But imagine what could have happened if the alarms had failed.

A successful attack on cold-storage facilities containing blood products, vaccines or other essential medical supplies could have consequences far beyond financial losses.

This is why cybersecurity is no longer simply a matter of protecting computers, passwords and bank accounts.

It has become a matter of protecting lives.

Now, here is another interesting part of the story.

On October 12, France's national cybersecurity response team, CERT-FR, issued an emergency advisory warning about compromised refrigeration controllers.

The affected systems included the Danfoss AK-SM and AK-SC series, as well as Copeland and Dixell XWEB products.

The agency warned that exposing equipment management interfaces directly to the public internet was contrary to good cybersecurity practice.

It recommended removing vulnerable systems from public internet access, updating supported firmware, changing default passwords and restricting remote access through secure networks.

The agency also warned that simply restoring obsolete equipment to factory settings would not solve the problem.

Why?

Because the underlying security vulnerabilities would still exist, and the systems could be compromised again.

Cybersecurity researchers at Censys subsequently investigated how many of these refrigeration controllers were exposed to the internet.

Their findings are revealing.

On October 9, they had identified approximately 6,695 internet-exposed refrigeration controllers worldwide across two affected product families.

By November 5, that number had declined to 3,124.

That represents a 53% reduction in less than a month.

It is important to understand that exposure does not necessarily mean a device has been hacked. However, an exposed management interface creates an unnecessary opportunity for attackers.

And there was evidence of suspicious activity even before the second wave.

Cybersecurity researchers at Lupovis reported more than 276 attempts to probe Danfoss refrigeration controllers between October 20 and October 30.

The activity came from 91 suspected threat sources and peaked around October 26.

The researchers observed attempts involving default passwords and known vulnerabilities.

Some of the infrastructure used in the suspicious activity had previously been associated with Russian cybercriminal groups.

But investigators have not established who was responsible for the refrigerator attacks. Neither has it been confirmed that the two waves were carried out by the same group.

And no group has publicly claimed responsibility.

Now, there is something about these incidents that I find particularly troubling.

There were no widely reported ransom demands.

The attackers were not asking the supermarkets to pay money before restoring their systems.

They simply interfered with equipment and caused enormous damage.

That is a different kind of threat.

You do not need to steal money from someone's bank account to inflict serious financial losses.

Sometimes, all you need is access to the computer controlling their refrigerator.

And this brings me to what I consider one of the dark sides of artificial intelligence.

As someone who works on AI enablement, I am constantly exploring how artificial intelligence can help individuals, businesses and institutions become more productive.

But we must also recognize that the technology is empowering people with malicious intentions.

There is no confirmed evidence that AI was used in these particular refrigerator attacks. In fact, cybersecurity experts have pointed out that the vulnerabilities exploited were already known and did not require AI.

However, AI is increasingly capable of helping criminals research vulnerabilities, write malicious code, automate reconnaissance and carry out some stages of cyberattacks at scale.

Tasks that previously required extensive technical knowledge can now be completed faster with AI assistance.

And that is something we must not ignore.

The same technology that helps a small business accomplish what previously required a team of professionals can also help malicious actors expand their capabilities.

It is one of the dark sides of AI: it can enable bad actors to do harm at a scale that would previously have been difficult or expensive.

We are connecting more devices to the internet at the same time that the tools for discovering and exploiting their weaknesses are becoming more accessible.

Today, it is refrigerators in European supermarkets.

Tomorrow, it could be smart electricity meters, automated gates, security cameras, medical equipment, water treatment facilities or other critical infrastructure.

And this should concern every Nigerian business owner.

Many of us are increasingly installing internet-connected CCTV cameras, solar inverters, smart locks, automated gates, smart televisions and other devices.

But how many of us know whether these systems are secure?

How many are still using the passwords supplied by the technician who installed them?

How many have never received a software update?

And how many organizations know whether their devices can be accessed directly through the internet?

The problem is that we often spend considerable money acquiring technology and almost nothing maintaining its security.

You can spend millions of naira installing CCTV cameras throughout your office or home, only to leave the default administrator password unchanged.

You can install a sophisticated smart-home system and give your Wi-Fi password to practically everyone who visits.

You can purchase an expensive internet-connected device and never update its operating system.

These are not minor issues.

They are security vulnerabilities.

If you own a smart home, there are a few things you must take seriously.

First, keep the operating systems and firmware of your connected devices updated. Where automatic updates are available, enable them. If a device is no longer supported by its manufacturer, consider replacing it.

Second, protect your Wi-Fi password. Use a strong, unique password and modern encryption such as WPA2-AES or WPA3.

Third, stop indiscriminately sharing your phone's hotspot or home Wi-Fi with people.

I know we like to help people with internet access, but you need to understand that every device connecting to your network introduces a potential security risk.

Not everyone who connects to your network has malicious intentions, but their devices may already be compromised.

If visitors need internet access, create a separate, properly isolated guest network rather than allowing them to connect to the same network used by your computers and smart-home devices.

And please, do not forget your router.

Many people update their phones and laptops regularly but have never updated the firmware of the router connecting everything in their homes.

For organizations, the responsibility is even greater.

Your cybersecurity policy must cover every internet-connected device, not just laptops and servers.

Your IT team should have a complete inventory of connected equipment, understand how each device communicates, know who has access and ensure that security updates are applied.

You must also pay attention to third-party service providers.

If a company remotely maintains your refrigeration system, CCTV cameras, building management system or other equipment, you need to understand how that company accesses your infrastructure and what security measures protect that connection.

The compromise of a service provider can become a compromise of your organization.

The European refrigeration attacks have demonstrated this.

What fascinates me most about these incidents is how ordinary the targets were.

We are not talking about nuclear weapons, military systems or sophisticated banking platforms.

We are talking about refrigerators.

Equipment that most of us have used throughout our lives without thinking about cybersecurity.

Yet, through the internet, criminals were able to turn them into instruments of economic destruction.

In my previous article about the Binance hack, I argued that an organization's next major cybersecurity breach could begin with something as ordinary as an employee accepting a job interview.

These refrigeration attacks reinforce that argument.

Your next major security incident may not begin with someone hacking your bank account or stealing your password.

It may begin with someone gaining unauthorized access to a device you never considered important enough to protect.

The lesson is simple.

As we make our homes, businesses and public infrastructure smarter, we must also make them more secure.

Because the more connected our world becomes, the more opportunities we create for people who want to do harm.

And sometimes, the difference between a normal working day and millions of euros in losses is nothing more than an unpatched refrigerator.

---

Vincent Dania is an adjunct instructor at University of the People and the CEO of hyrax.ng - The AI Enablement Company.