When Someone Switches Off the Refrigeration at Night, Who Warns You?

In October, roughly 700 French supermarkets stopped cooling. In November the attack repeated in eight more countries. The attacker took over the refrigeration controller and silenced the alarm with it. Stores found out in the morning.

Jozef Krivaček · 06/11/2026 · 6 min read

On the night of 11 to 12 October 2026, roughly 700 supermarkets in France stopped cooling. Three weeks later the same thing happened in more than 100 stores across eight other countries. In both cases the attacker took control of the refrigeration controller, switched the evaporators into defrost mode and left them there all night. Staff found spoiled goods when they opened in the morning.

This is not a one-off. The same method works anywhere refrigeration is reachable from the internet. Today that is almost everywhere.

What happened

First wave, France, night of 11 to 12 October. According to AP, around 700 of the country's roughly 10,000 supermarkets were hit. Affected chains included Intermarché, Netto, Coopérative U and E.Leclerc. Groupement Mousquetaires reported 300 of its own stores. E.Leclerc confirmed the attack came through its refrigeration equipment supplier. Reports say the attack targeted Danfoss refrigeration controllers. The result was spoiled goods and, in some stores, fires.

Second wave, night of 1 to 2 November. Belgium, Luxembourg, the Netherlands, Sweden, Finland, Estonia, Ireland and Germany. Attempts were recorded in Switzerland. Reuters puts it at more than 100 stores, including Delhaize, Carrefour Belgium (15 of more than 700 stores), Colruyt, ICA, Coop, SuperValu, K Group and Ikea Mons. In Germany it was Rewe in Raesfeld, Edeka in Reisbach and CAP-Markt in Wuppertal. The operator Rewe-Kaufmann had no cyber insurance.

The mechanism was the same as in France. Evaporators were switched into defrost mode and temperatures rose as high as 50 °C, as confirmed by Sabcobel, the refrigeration service company for Delhaize. The attack ran overnight on a weekend and was only discovered in the morning. According to Euronews, the damage to goods runs into hundreds of thousands of euros. The Belgian federal prosecutor has opened an investigation. The perpetrator is not yet known.

Nine countries in less than a month.

Why nobody noticed until morning

Every supermarket has a temperature alarm. So why did nobody react?

Because the alarm usually runs in the same device that controls the refrigeration, and often over the same network. Whoever controls the controller also controls the warning. The attack then looks like this:

1. The refrigeration controller is reachable from the internet for remote servicing.
2. The attacker gains control through a vulnerability or through a supplier's access.
3. They switch the evaporators into defrost mode for the whole night.
4. The alarm stays silent because it runs in the same device.
5. In the morning, staff find spoiled goods and empty shelves.

The weak point does not have to be your own network. In the E.Leclerc case, the refrigeration supplier's access was enough. One mistake outside your own IT and a whole chain of stores is unprotected.

Why it will happen again

On 13 October, Germany's federal cybersecurity agency BSI urged operators of refrigeration systems to block internet access to them. It recommends preventing direct access from the internet, using VPN with multi-factor authentication and installing updates quickly. BSI president Claudia Plattner also warned that the attack could find copycats at any time.

The second wave came less than three weeks after that warning.

The reasons are practical. Modern supermarkets manage refrigeration remotely because their service companies need remote access. Taking the controller off the internet means changing how servicing works, and that does not happen overnight. In Germany, supermarkets are also outside the NIS-2 obligations under the BSI Act, so each chain decides its own level of security.

An attacker therefore has thousands of stores in front of them with the same technology, the same way of managing it and the same blind spot.

Two layers of protection

The BSI recommendations should be taken seriously. Blocked internet access, VPN with multi-factor authentication and updates are the baseline. But IT security alone is not enough, because it only protects what you control. You do not control the refrigeration supplier's access, their service laptop or their cloud.

That is why a second layer makes sense: independent temperature monitoring. A second pair of eyes that an attack on the refrigeration cannot take out, because it has nothing to do with the refrigeration.

A temperature probe on a thin cable clipped to the wire shelf of a refrigeration cabinet between dairy products

How independent monitoring works

KALM measures temperature with its own probes placed directly in the refrigeration and freezer units. It does not read values from the controller. It measures them itself.

It sends data over its own LTE connectivity, separate from the store network and from the refrigeration supplier's network. If an attacker takes over the controller or the store network, KALM does not see it and keeps measuring.

It has no control channel into the refrigeration. KALM only measures, it controls nothing. The refrigeration cannot be switched off or reconfigured through it.

When a temperature leaves its set band, the alarm reaches the responsible people within minutes, with escalation to the next person if the first does not respond. Not in the morning at opening time, but at night, while goods can still be saved by moving them or calling service.

It also keeps an independent temperature record. For HACCP as proof of the cold chain, and for the insurer as evidence of exactly when the temperature rose and how long it lasted.

Today KALM monitors a network of more than 400 sites in Slovakia, including refrigerated medicines with strict cold-chain requirements. Prediction of refrigeration failures from temperature trends is in pilot operation.

Supermarket machine room: a large refrigeration controller cabinet and, on the wall next to it, a small separate unit with an LTE antenna

Pilot: 10 stores, 9 weeks

If you operate a chain of stores, we offer a pilot in 10 stores over 9 weeks. Installation requires no intervention in the refrigeration and no connection to store IT. The probes and the communication unit are independent of everything already running in the store.

Every week you receive a report with temperature deviations, response times and false alarms. At the end of the pilot we review together what the data showed and whether it makes sense to continue across the whole network. Pricing is available on request.

Write to us at info@omnius.sk or through the contact form. The October and November attacks showed that the question is not whether it happens again, but whether you find out before morning.

Sources

• AP / ABC News: Cyberattack targeting refrigeration systems hits 700 supermarkets in France
• BleepingComputer: Cyberattack shuts down refrigerators at French supermarkets
• Euronews: Cyberangriff legt Kühlanlagen europäischer Supermärkte lahm
• ESM Magazine: SuperValu, Delhaize among supermarkets hit by refrigeration cyberattacks
• Dr. Web: Kühlregal-Angriff in Deutschland: Edeka, Rewe
• it-daily: BSI call to refrigeration operators
• it-daily: Claudia Plattner on copycats
• netzwelt: Cyberattacke auf Supermarkt-Kühlsysteme in Frankreich