The device at the center of these attacks is easy to miss on an IT asset list. It's a small controller that lets a refrigeration technician check temperatures, adjust defrost cycles and receive alarms without driving to the store. Many were installed years ago, are maintained by an outside contractor and have done their job quietly ever since. The businesses that were hit used this equipment the way much of the sector does, which is why the lessons apply well beyond them. The weaknesses that were exploited are well understood, and so are most of the fixes. They work best when the store, its IT team and the refrigeration supplier agree on who does what.

What happened

11 to 12 October 2026: France

During the night of 11 to 12 October 2026, attackers accessed refrigeration controllers in French supermarkets and changed their settings. Reported changes included forced defrost cycles with setpoints of around 50°C. At stores of the Les Mousquetaires group (Intermarché and Netto), refrigeration units ran at 50°C for six hours, Reuters reported on 12 October.

On 12 October, Prime Minister Sébastien Lecornu asked ANSSI to take up the matter, and CERT-FR, the incident response team within ANSSI, published alert CERTFR-2026-ALE-012 with recommendations, which it updated on 13 and 16 October. The cybercrime section of the Paris prosecutor's office opened an investigation.

Finance Minister Roland Lescure told Parliament on 13 October that about 700 of France's roughly 10,000 supermarkets had been affected (AP, 13 October 2026). Stores of Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc were among them, and figures per chain differ between reports. Les Mousquetaires gave a preliminary estimate of "several million euros" in losses for its stores (IBTimes UK, 13 October 2026).

1 to 2 November 2026: across Europe

The second wave began during the night of 1 to 2 November 2026 and hit stores and food businesses in at least nine European countries (Toute l'Europe, 3 November 2026). The table shows what authorities, companies and national media had reported by 6 November 2026, including related cases outside retail. Many are early counts and may change.

Losses are reported store by store, from tens of thousands of euros at individual stores in Belgium to more than €360,000 at one store in Germany, according to its owner, and about SEK 3 million at one Swedish warehouse (VRT, 3 November 2026; dpa, 3 November 2026; SVT, 3 November 2026). No overall estimate has been published.

In Estonia, the attack on one Selver store was handled in about ten minutes, and Selver said its partner had spotted it quickly (ERR, 2 November 2026).

How authorities have responded

At EU level, Christophe Hansen, European Commissioner for Agriculture and Food, called the second wave "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it" (2 November 2026). On 3 November, the European Commission met with Europol and ENISA, and the incidents were discussed in EU-CyCLONe, the network of national cyber crisis management authorities. On 4 November, ENISA, the Commission, Europol's European Cybercrime Centre, the CSIRTs Network and EU-CyCLONe issued a joint statement advising organizations to "take immediate action to mitigate exposure in the affected systems." It also recalled that manufacturers have had to report severe incidents and actively exploited vulnerabilities under the CRA since 11 September 2026.

National cybersecurity agencies in Sweden, the Netherlands and Italy published or updated their guidance between 2 and 4 November. In Italy, the government said after a meeting at Palazzo Chigi on 3 November that, based on initial checks, the impact in the country was very limited for now ("fortemente limitato") and that no risk to public health from thawing had been found.

On 5 November, Italy's National Cybersecurity Agency (ACN) met large retail and food companies and proposed an information sharing and analysis center (ISAC) for the food sector (Cyber Security 360, 6 November 2026). The same day, the US Cybersecurity and Infrastructure Security Agency (CISA), the FBI and three other US agencies published joint guidance on ongoing activity against industrial refrigeration and cold chain monitoring systems worldwide. Its recommendations largely match the European ones. On 6 November, the European retail association EuroCommerce called an emergency meeting of its members (ECO, 6 November 2026).

On 3 November, two pro-Russian hacker groups, NoName057(16) and Z-Pentest, claimed responsibility in a video posted on Telegram. The claim names no stores, methods or timing, and no government or agency has confirmed it so far. Germany's BSI said it had no evidence supporting the claims and could not rule out copycats (CORRECTIV, 5 November 2026). An ACN official told Il Post it was still too early to say what had actually happened, because the method of intrusion had not been reconstructed (Il Post, 6 November 2026). The Kremlin called suggestions of Russian involvement "absurd" (The Moscow Times, 5 November 2026). The Centre for Cybersecurity Belgium had told The Record that "it may never be possible to identify them."

How the attackers got in

The devices involved are remote management units for commercial refrigeration. They connect a store's cold rooms, freezers and display cabinets to a web interface, so a technician can monitor temperatures, change setpoints and schedule defrost cycles from a distance. CERT-FR's alert names controllers from Copeland (XWEB), Danfoss (AK-SC and AK-SM series) and Dixell (XWEB).

According to ANSSI, the attacks didn't require advanced techniques. Its director general, Vincent Strubel, told the French Senate on 21 October 2026 that "elementary security flaws" (des défauts de sécurisation élémentaire) had been exploited: equipment exposed to the internet, administered without protection and secured with weak passwords. He did not point to previously published vulnerabilities as the cause. The BSI in Germany also describes the attacks as untargeted and opportunistic (CORRECTIV, 5 November 2026).

Many of the affected devices were older. Danfoss said the affected units were running outdated firmware, and Copeland confirmed a vulnerability in discontinued, end-of-life controllers. One of the models named in reports reached its end of life on 31 October 2016, according to the manufacturer's documentation. CERT-FR warns that keeping an end-of-life device connected to the internet exposes it to "a very high probability of compromise." Security researchers had also published vulnerabilities in some of these controllers in 2025 and 2026, and fixes exist for supported models. No authority has confirmed that any of them was used in these attacks.

Responsibility for these devices is often shared. The store or chain owns them, a refrigeration contractor installs and maintains them, and the manufacturer supplies the firmware. In Portugal, the National Cybersecurity Centre (CNCS) said the presumed cause was unauthorized access to a remote temperature controller under a supplier's responsibility (Lusa, 3 November 2026). When responsibility is split three ways, simple questions can go unanswered: who changes the default password, who decides whether a device needs to be online at all, and who hears about a security update.

Exposure falls quickly once owners act. The internet scanning company Censys counted 2,991 internet-facing hosts with one manufacturer's controllers on 11 October 2026, 1,825 of them in France. By 14 October, the French figure had dropped to 537 (Infosecurity Magazine, 15 October 2026). In Finland, the national cybersecurity center NCSC-FI said on 2 November that only a few exposed devices remained visible after owners had been contacted.

Which EU rules apply

Several EU laws are relevant. Which ones apply to a business depends on what it does in the food chain, its size and where it operates.

Food law: why affected food is discarded

EU food law prohibits placing unsafe food on the market, which includes holding it for sale (Regulation (EC) No 178/2002, Articles 3(8) and 14), and sets out when food that doesn't meet food safety requirements has to be withdrawn (Article 19). The hygiene rules add that "the cold chain is not to be interrupted" and allow limited periods outside temperature control only where this does not result in a risk to health (Regulation (EC) No 852/2004, Annex II, Chapter IX). When chilled or frozen food has been outside its temperature range for too long, a store can often no longer show that it is safe, so it comes off the shelves. As ACN puts it, restoring the temperature does not by itself show that storage conditions were maintained. That is where most of the reported losses come from.

NIS2: food retail is generally out of scope

NIS2 lists food businesses in Annex II "which are engaged in wholesale distribution and industrial production and processing." Retail sales to consumers aren't on that list. Medium-sized and large businesses in those activities are in scope, in most cases as important entities. Read more in What is NIS2? The EU cybersecurity directive, and what it means for your organization.

Three qualifications matter:

• Critical entities. Businesses identified as critical entities under the Critical Entities Resilience (CER) Directive fall under NIS2 regardless of size, as essential entities (NIS2 Articles 2(3) and 3(1)(f)). In the food sector, the CER Directive covers businesses "engaged exclusively in logistics and wholesale distribution and large scale industrial production and processing." Retail isn't listed. Member States had to identify their critical entities by 17 July 2026.

• National rules can go further. NIS2 sets a minimum. In Germany, operators of critical facilities are particularly important entities under the BSI Act (§ 28(1) BSIG). The critical facility rules for food trade, currently set out in the BSI-KritisV, cover facilities for placing food on the market, which can include retail sales outlets, above a threshold of 434,500 metric tons a year. Only large operations reach it.

• Groups. A retail group can include companies that are in scope, such as a wholesale distribution company.

For entities in scope, the attacks touch two requirements most directly: risk management measures that include supply chain security (Article 21(2)(d)), and incident reporting, with an early warning within 24 hours and a notification within 72 hours of becoming aware of a significant incident, followed by a final report within one month of the notification (Article 23). For an overview, see NIS2 Requirements: Key Pillars & Compliance Checklist.

Refrigeration service providers: possibly managed service providers

NIS2 defines a managed service provider as "an entity that provides services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or any other network and information systems, via assistance or active administration carried out either on customers' premises or remotely" (Article 6(39)). A networked controller that processes digital data can count as a network and information system (Article 6(1)(b)). A company that remotely manages such controllers for its customers may therefore meet the definition, and managed service providers that are medium-sized or larger are in scope. We haven't found guidance from any authority on whether refrigeration or building control maintenance companies qualify, so this is a case-by-case question under national law.

Cyber Resilience Act: what manufacturers must report

Since 11 September 2026, manufacturers of products with digital elements have had to report actively exploited vulnerabilities and severe incidents affecting the security of their products (CRA Article 14). Reports go to the CSIRT designated as coordinator and to ENISA, through ENISA's single reporting platform: an early warning within 24 hours, a notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available (vulnerabilities) or one month after the notification (incidents). Manufacturers must also inform affected users.

This applies to products already on the market (Article 69(3)), but not retroactively to exploitation known before 11 September 2026. The CRA's main requirements, including security updates during the support period, apply from 11 December 2027, and only to products placed on the market from then on or substantially modified after that date (Article 69(2)). For controllers already installed in stores, the CRA doesn't create a new obligation to patch. If you use these devices, make sure manufacturers and installers know whom to contact when they issue a security notice.

What to check now

National authorities have published practical advice, including CERT-FR in France, ACN in Italy, NCSC-NL in the Netherlands and NCSC Sweden. Their recommendations overlap, and together they come down to seven checks. They apply whether or not a business falls under NIS2. Give each check a named owner and keep evidence that it was done.

1. Find every connected device. List the refrigeration controllers, building management systems and other equipment that can be reached remotely, site by site: model, firmware version, support status, who installed it and who maintains it. Evidence: an up-to-date inventory.

2. Take management interfaces off the public internet. Restore remote access only through a secure VPN or a protected network, as CERT-FR and ACN recommend. ACN also calls for multi-factor authentication on remote access, and both agencies accept restricting access to trusted IP addresses only as a temporary measure. Keep refrigeration and other operational systems separate from office and guest networks. Evidence: the network configuration and a check of what is visible from outside.

3. Agree how suppliers connect. Ask your refrigeration contractor how they access each site, with which accounts and from where, and who is informed when they do. Write the rules into the service agreement. ACN advises limiting supplier access to authorized resources and time windows, logging the activity and revoking access when the job is done. Evidence: the supplier's answers and the contract clause. More on the wider process in What Is Supplier Risk Management? A Practical Guide.

4. Replace default and shared passwords. Change factory credentials, give each technician an individual account where the device allows it, and use the strictest security setting the manufacturer offers. Evidence: a dated record of the change.

5. Check the configuration, not only the access. Compare setpoints, defrost schedules and alarm thresholds with the approved configuration. CERT-FR notes that a factory reset alone isn't enough. Make sure temperature alarms reach someone who can act outside opening hours. Evidence: the approved configuration and the result of the comparison.

6. Update or replace. Install current firmware on supported devices. For end-of-life devices, plan a replacement and keep them off the internet until then. Evidence: firmware versions and a replacement plan.

7. Prepare the incident routine. Decide who calls whom, how to take a device offline safely, which logs to keep, when food must come off sale and which authority to notify. ACN asks businesses in Italy to preserve logs and configurations and to report anomalous access and other indicators of compromise through CSIRT Italia; elsewhere, the national CSIRT is the contact. Evidence: a written routine and a contact list.

The original guidance: CERT-FR alert CERTFR-2026-ALE-012 (French), ACN bulletin BL01/261013/CSIRT-ITA (Italian), NCSC-NL (Dutch) and NCSC Sweden (Swedish).

How Formalize helps

Formalize is a compliance and risk management platform. It doesn't monitor devices or detect attacks; that stays with your network security tools and your refrigeration contractor. Formalize helps with the part that tends to slip once the news moves on: making sure every check has an owner, a deadline and evidence, across all sites and suppliers.

• An inventory of connected equipment. Record refrigeration controllers and other connected devices as assets, linked to the sites, processes and suppliers that depend on them.

• Supplier access you can follow up on. With Third-Party Management, send questionnaires to refrigeration and maintenance contractors, collect their answers and evidence, track agreed service levels and schedule yearly re-evaluations.

• The authorities' checks as controls. Turn the seven checks into controls and tasks with owners, reminders and escalation, and keep the evidence in one place.

• Risk assessment. Assess the risk of connected equipment with inherent and residual scoring, linked to the assets and suppliers involved.

• Incident handling. Record incidents, follow a reporting workflow and track deadlines, including those under NIS2.

• Internal audits. Use the Audit module to verify that the measures are in place, with findings that have an owner, a target date and independent sign-off.

• NIS2, where it applies. For entities in scope, the NIS2 Compliance Blueprint and our national Blueprints map these steps to the applicable requirements.

This article reflects publicly available information as of 6 November 2026. Investigations are ongoing and figures may change. It is general information, not legal advice. For your specific situation, check the national rules that apply to you or consult a legal advisor.