After France, several dozen European supermarkets were victims on Monday of a cyberattack targeting their refrigeration installations. The cause is sometimes old equipment, which no longer benefits from security updates, but also a lack of anticipation. The hackers were able to exploit basic flaws, without resorting to particularly sophisticated techniques.

Published on: 02/11/2026 - 21:10

Same modus operandi as the attack in France. Several dozen Belgian, Luxembourg, Swedish and Estonian stores were in turn victims between the evening of Sunday November 1 and the morning of Monday November 2 of an “unprecedented” cyberattack targeting their refrigeration installations.

In Estonia, where at least one supermarket was attacked by hackers who raised the temperature of refrigeration units to 50°C, the devices were older models delivered by Danfoss, similar to those targeted in the attack in France, Jann Mutso, director of Kitman Coldtech, an Estonian manufacturer and distributor of connected refrigeration systems, told public broadcaster ERR. “The ‘signature’ is the same, but I can’t say more,” he said.

In Sweden, where stores in the Ica chain have encountered refrigeration problems, group spokeswoman Helena Johansson said the affected stores were all connected to an external refrigeration control system provided by Danish manufacturer Danfoss.

Following the attack in France, Danfoss explained to AFP that most of the affected equipment was old products, which "no longer receive software or security updates".

The European Commissioner for Agriculture and Food, Christophe Hansen, then declared that “food security requires more attention at all levels”. “Aiming for food” is now “a reality”.

No one has yet claimed responsibility for these attacks.

• Old equipment

Long isolated from the internet, industrial equipment such as refrigeration units are now connected to allow their remote supervision and control, explains Antoine Hautin, general secretary of Almond, a cybersecurity consultancy.

The objective for hackers here is to act on physical equipment through a computer system.

“This is equipment that allows you to regulate the temperature of several refrigerators. Most of the time, it is a web interface. You connect to it with a password and you have the possibility of choosing the temperature that will be applied to the refrigerator,” explains Kévin Tellier, cybersecurity engineer at Synacktiv.

These interfaces "are normally in a closed network" and "are not intended to be accessible from the internet." However, a certain number of them were exposed “to anyone with some knowledge”, he adds.

Without appropriate protections, “any factory, any equipment” connected, whether in automobiles, energy, transport, can be exposed to similar scenarios, estimates Olivier Daloy, cyber expert at Zscaler.

According to a cyber expert who requested anonymity, industrial infrastructures are vulnerable because they combine computer systems (IT) with physical equipment (OT), some of which is old.

In Sweden, six of the Coop chain's approximately 800 stores were victims of Monday's cyberattack. Spokesman Carlos Cancino told AFP that Coop did not know who was behind the attack, but noted that the six affected stores were connected to a 4G mobile network, not the updated 5G system, making them "more exposed" to hackers.

• “Elementary security defects”

However, by penetrating computer networks, hackers can reach the systems that directly control this equipment and cause disruptions in the real world.

Two scenarios are notably possible, notes Olivier Daloy: the exploitation of a technical vulnerability or the use of compromised identifiers allowing connection to the equipment.

In France, the October cyberattack was made possible because of "basic security flaws", according to the director of the National Information Systems Security Agency (Anssi), Vincent Strubel.

Also read: Hacking of the Binance cryptocurrency platform: the FBI accuses North Korea

Starting with “the direct exposure on the internet of refrigeration equipment and their administration without particular security, weak passwords”, he noted.

Behind this attack, “it could be anyone”. Not being "extremely sophisticated, we cannot determine whether the author has significant means or not", notes Kévin Tellier.

France Info notes that the connected fridges attacked in France appeared in online directories. All you had to do was guess the password to hack them. “There is no need to be an experienced cyberattacker,” explains the information site.

• A lack of anticipation

According to many experts, these attacks reveal a lack of anticipation. This equipment is not designed to deal with the particularly rapid evolution of cyber threats.

On BFM, Benoît Grünemwald, director of public affairs at Eset, a company specializing in cybersecurity, calls on supermarkets to draw inspiration from critical sectors of activity where “good practices have existed for a very long time and where cyber maturity is extremely high”. In other words, major retail players, but also companies using connected devices, must acquire “digital” and cyber security know-how.

Also readBillions of data on the run: how BrixHub & co put women in danger

Elevators, building heating systems, connected devices used by individuals (such as baby monitors)... all equipment likely to become targets for future attacks. The most alarmist experts are therefore calling for real awareness, on the part of brands, manufacturers, but also users.

With AFP and Reuters

Keywords associated with the article

The content you are trying to access does not exist or is no longer available.