Supermarket Freezers Hijacked, Set to 122°F in Seven European Countries
What Happened — On 2 November 2026, retailers in Belgium, Luxembourg, Sweden, Ireland, Estonia, the Netherlands and Finland reported that remotely‑controlled refrigeration units suddenly entered defrost mode or were set to 50 °C (122 °F). The incidents forced stores to pull chilled and frozen products from shelves, resulting in food waste estimated at €15 000‑€100 000 per outlet. While a French‑wide attack was documented in October, the cause of each malfunction remains unconfirmed; however, multiple sources (AP, Reuters, BBC) attribute the outages to a coordinated cyber‑operation targeting the IoT control interfaces of the refrigeration systems supplied by third‑party vendors such as Kitman Coldtech.
Why It Matters for Trust & Control Assurance — The episode highlights a control‑objective gap in securing remote access to critical operational technology, underscoring the need for continuous evidence‑driven mapping of OT device controls across frameworks.
Who Is Affected — Large‑scale grocery chains and their refrigeration equipment suppliers across Europe.
Recommended Actions
- Conduct an immediate audit of remote‑access configurations on all IoT‑enabled refrigeration units.
- Verify that vendor‑provided firmware is up‑to‑date and that default credentials have been removed.
- Deploy continuous monitoring for anomalous command sequences on OT devices and integrate the findings into your audit‑readiness evidence base.
Technical Notes
- Attack vector: presumed exploitation of insecure remote‑management interfaces (likely default or weak credentials, lack of network segmentation).
- No publicly disclosed CVE; the vulnerability appears to be a configuration/implementation weakness in the refrigeration control software.
- Data types: operational control commands; no customer‑data breach reported.