Freezers at 50°C: The Cyberattack Nobody Claimed

Around November 2, 2026, supermarket chains in at least eight countries saw refrigeration systems heat up sharply. The countries included Belgium, France, Sweden, Ireland, the Netherlands, Finland, and Estonia. Some freezers rose to 50°C. Food was pulled from shelves and destroyed. Refrigerated trucks were rushed into service.

No ransom note. No data-theft claim. No group claimed responsibility.

Christoph Hansen, the European Commission’s agriculture commissioner, called it “food weaponized.” The Paris prosecutor’s office opened a case and assigned it to its cybercrime unit. It stated: “No claim of responsibility, no ransom letter, no presumption of a state actor.” Belgian prosecutors launched a criminal investigation but did not immediately name a suspect. Sweden’s National Cyber Security Centre said the motive and attacker were unknown and ruled out state-level attribution on existing evidence.

A spokesperson for Belgium’s cyber security center was more direct. The attacker’s identity, the spokesperson said, “may never be determined.”

The method was not complex.

Attackers did not rewrite temperature parameters. They sent a “forced defrost” command to refrigeration controllers. Defrosting is a normal function. It clears frost from the evaporator. When the command is triggered continuously and abnormally, the evaporator stays in heating mode. The freezer temperature climbs.

A Belgian refrigeration service provider confirmed the method: “forcing the evaporator to defrost continuously.” In Estonia, freezers at Selver stores rose to 50°C. The cold-chain service provider confirmed the same method.

Two conditions were enough: devices exposed on the public internet, and weak or default passwords.

Dutch national public radio reported that at least 17 businesses were affected, including butcher shops and small supermarkets. It said the root cause was large numbers of devices with default passwords exposed to the internet. France’s national cybersecurity agency said the root cause was a lack of basic security: “naked exposure” plus weak passwords. Device manufacturer Danfoss acknowledged that firmware for older models is no longer maintained. The company said it had repeatedly warned customers not to expose controllers directly to the public internet.

After France’s warning, many devices in the Netherlands were still not fixed. Finland’s National Cyber Security Centre had already mapped exposed Danfoss controllers in the country and notified their owners.

The official descriptions moved in a cautious gradient.

Belgian supermarket chain Delhaize first called it an “IT incident.” It declined to classify it as an attack. Its refrigeration service provider called it a “cyberattack” outright. That provider said older devices could only be isolated at the hardware level, that patching alone was ineffective, and that the network had been disconnected overnight. Carrefour Belgium confirmed a cyberattack on refrigeration equipment but said the impact was limited to 15 stores and was under control. Sweden’s Coop Sweden confirmed seven stores were hit and said it had isolated its systems. Sweden’s ICA Sweden used the term “suspected incident.” Ireland’s Musgrave Group called it a “cyber incident.” Thirteen stores were affected. Only specific models of refrigeration controllers were hit. Cold-chain products were removed from shelves.

About 40 Delhaize stores were affected. Refrigerated trucks were deployed. At least 17 businesses were affected in the Netherlands. A small number of K-food stores in Finland saw temperature anomalies. Estonia’s Selver confirmed cross-border attacks using the same method.

Who did it? Unknown.

Russian involvement was suspected by some analysts and media outlets, who said the method resembled Russian state-backed hacking. Russian officials denied the allegations. The technically unsophisticated nature of the attack makes attribution extremely difficult. The attack did not require a zero-day vulnerability or complex malware. It required scanning the public internet for refrigeration controllers, trying default passwords, and sending a legitimate command built into the device. Anyone could have done it.

Belgium’s cyber security center said the attacker’s identity may never be determined. Prosecutors in France and Belgium said they would not presume a state actor without solid evidence.

The main risk is how copyable the method is.

U.S. agencies including CISA and the FBI have issued a joint warning. The EU Agency for Cybersecurity has called for cross-border intelligence coordination and reporting of legacy IoT devices. These actions point to the same conclusion: weak passwords plus public exposure are the root cause. Pharmaceutical cold chains, cold storage, and food processing plants face similar risks.

The attackers did not use sophisticated methods. Because the approach is unsophisticated, it could become a “low-intensity disruption tool” that is widely copied. One internet-connected refrigeration controller and one forced-defrost command can create a food-inventory crisis.

The preventive measures are straightforward.

Take devices off the public internet. Never expose refrigeration controllers or management panels directly to the public internet. This was the fundamental reason the attack succeeded.

Change default passwords and weak passwords. If remote access is needed, route it through a VPN, firewall, or secure edge device, with strong authentication.

Segment the network. Put refrigeration systems and other OT devices on a separate VLAN from the corporate IT network. This prevents lateral movement from IT.

Build an asset inventory. Scan for and identify all internet-connected refrigeration controllers. Install security patches promptly. For older devices no longer supported by the manufacturer, plan to retire or hardware-isolate them. A factory reset alone does not eliminate the risk.

Strengthen monitoring. Check temperature, defrost cycles, and other settings for anomalies. Set up alerts. If a device may have been compromised, disconnect it from external networks immediately.

A Belgian refrigeration service provider put it plainly: older devices can only be hardware-isolated. Patching alone is ineffective.

Three official statements define the incident. The European Commission says “food weaponized” is now a reality. The head of France’s cybersecurity agency says the root cause is a lack of basic security. Belgium’s cyber security center says the attacker’s identity may never be determined.

The outline is simple: one internet-exposed refrigeration controller, one default password, one forced-defrost command, and supermarket freezers heating up in eight countries. No ransom note. No claim of responsibility. No state attribution.

The next thing to heat up may be more than a freezer.