What Are Freezer Cyberattacks 2026 | Supermarket Hacks, Spoiled Food & Cybersecurity Risks

Freezer cyberattacks in 2026 involve hackers remotely manipulating internet-connected refrigeration controllers, potentially forcing supermarket freezers into defrost mode and causing food spoilage. On October 12, 2026, a major incident affected more than 350 French establishments, with some refrigeration units reportedly reaching 122°F (50°C). Further incidents were reported across Europe on November 2, while US military commissary freezer failures from August remained under investigation as suspected cyberattacks.

What Are Freezer Cyberattacks? – Introduction

Freezer cyberattacks moved from a theoretical cybersecurity risk to a serious supermarket concern in October 2026. On October 12, hackers reportedly gained control of refrigeration systems in hundreds of French supermarkets. Some units were switched into defrost mode, allowing temperatures to rise as high as 122°F (50°C). Store employees found spoiled food and water leaking from refrigeration units.

The reported incidents involved major French retailers, including Intermarché, Carrefour, Monoprix, Coopérative U and E.Leclerc. The incidents raised concerns about the security of internet-connected refrigeration controllers and the potential consequences of attacks on supermarket infrastructure.

The story expanded beyond France. On November 2, 2026, retailers in Belgium, Ireland and Sweden reported refrigeration problems or suspected cyber incidents. Meanwhile, US military commissary freezer failures from August 2026 were being investigated as suspected sabotage or cyberattacks.

This report examines reported incidents, affected retailers, exposed refrigeration controllers, food-safety risks and the cybersecurity weaknesses that can put supermarket refrigeration systems at risk.

Interesting Facts About Freezer Cyberattacks 2026

Sources: Reuters via Military Times (October 29, 2026); CBS News and AFP (November 2, 2026); The Register (October 15, 2026).

The first major reported wave began overnight on October 12, 2026. Attackers allegedly manipulated refrigeration systems, causing some units to enter defrost mode and reach temperatures of up to 122°F (50°C).

Les Mousquetaires, the parent organization of Intermarché, reported that refrigeration units in approximately 150 stores remained at 50°C for around 6 hours. Reuters subsequently reported that more than 350 French establishments were affected.

A second wave of incidents was reported on November 2, 2026, involving retailers in several European countries. Separately, Reuters reported that at least six US military commissaries experienced freezer failures in August that the Pentagon treated as suspected cyber incidents.

A cybersecurity scan reported by The Register identified 2,624 refrigeration controllers with login pages exposed to the internet. An exposed login page does not automatically mean a device is vulnerable or compromised, but it can increase the risk of unauthorized access.

Freezer Cyberattacks in France 2026: How Many Supermarkets Did Hackers Hit?

Reports published during October 2026 provided different estimates of the number of French supermarkets affected.

Sources: Military Times (Reuters), BleepingComputer, Al Jazeera and The Register, October 2026.

The estimates range from approximately 250 to nearly 700 stores. These differences may reflect different reporting periods, retailer disclosures and definitions of what counted as an affected establishment.

Some reports may count only locations that experienced food losses, while others may include stores where refrigeration systems were disrupted without confirmed stock damage.

Reuters reported more than 350 affected establishments on October 29. Because the available reports do not establish one universally accepted national total, the figures should be presented as separate reported estimates rather than combined into a single confirmed count.

Supermarket Hacks 2026: Which French Chains Reported Freezer Cyberattacks?

Several major French supermarket chains reported refrigeration disruptions during the October 2026 incidents.

Sources: Reuters and CNN (October 12, 2026); Industrial Cyber (October 2026).

Les Mousquetaires reported that approximately 150 Intermarché stores experienced refrigeration problems. Some units reportedly reached 50°C for six hours.

Coopérative U reported approximately 100 affected outlets, while Carrefour confirmed problems at 80 supermarkets. Monoprix said that 5% of its approximately 490 stores were affected, representing roughly 25 locations.

E.Leclerc also reported that several stores were targeted but did not provide an exact figure.

Some reports gave different estimates for individual retailers. Industrial Cyber, for example, cited approximately 300 Intermarché and Netto stores. These differences reinforce the need to distinguish company-confirmed figures from estimates published by other outlets.

The incidents also raised questions about the range of refrigeration equipment involved. French cybersecurity authorities reportedly expanded their warnings beyond Danfoss systems to include Copeland and Dixell XWEB equipment.

Freezer Cyberattacks in Europe 2026

Reports published on November 2, 2026, described further refrigeration incidents involving supermarket chains in Belgium, Ireland and Sweden.

Sources: The Register, CBS News and AFP, November 2, 2026.

Delhaize reportedly experienced an IT incident affecting approximately 40 Belgian stores. Around 15 Carrefour stores in Belgium were also reported to have experienced problems.

The chief executive of refrigeration company Sabcobel told Belga that a cyberattack had switched refrigeration evaporators into defrost mode. He also indicated that fixing the underlying weakness could require physical modifications to equipment.

In Sweden, Coop reported that six stores out of approximately 800 had been affected by refrigeration problems. This represents approximately 0.75% of its stores. However, Coop said it did not have information confirming that a cyberattack caused the failures.

ICA confirmed that a limited number of stores were affected but did not disclose an exact count. At least 13 SuperValu stores in Ireland reportedly had to discard fresh and frozen food.

The available reports do not establish whether every incident involved the same attack method or whether the incidents were connected.

Freezer Cyberattacks in the United States 2026

The United States also experienced freezer failures at military commissaries in August 2026. These incidents later attracted attention because of their possible connection to the European supermarket attacks.

Source: Reuters via Military Times, October 29, 2026.

Reuters reported that freezer failures in late August affected at least six US military commissaries. One incident occurred at Fort Huachuca in Arizona, where a freezer reportedly entered defrost mode and food was damaged.

The incident was publicly reported on August 26, 2026. A blog called Signal and Silence raised the possibility of sabotage on August 28, two days later.

According to the Reuters report, the Pentagon treated the commissary incidents as suspected cyberattacks rather than confirmed cases. A US Cyber Command unit and the Army Criminal Investigation Division’s cyber office were reportedly involved in the investigation.

Investigators were also said to be in contact with French counterparts. However, the precise cause of the US incidents and the refrigeration controller brands involved had not been established in the reporting cited here.

Freezer Cyberattack Vulnerabilities 2026: How Many Refrigeration Controllers Sit Online?

Internet-connected refrigeration systems can create cybersecurity risks when their control interfaces are exposed or inadequately protected.

Source: Coalition scan data reported by The Register, October 15, 2026; CISA industrial control system advisories.

Coalition reportedly conducted a scan between September 7 and October 6, 2026. It identified 2,624 refrigeration controllers with login pages exposed to the internet. These included 1,506 Danfoss StoreView panels and 1,119 XWEB controllers.

The figures should not be interpreted as a count of successfully hacked devices. An exposed login page does not automatically mean that a controller has a known vulnerability or that an attacker has accessed it.

However, internet-accessible control panels can increase the attack surface, particularly when systems use weak credentials, outdated software or inadequate access restrictions.

Cybersecurity warnings involving refrigeration controllers had also been issued before the October incidents. CISA published an advisory concerning vulnerabilities in Copeland XWEB units in February 2026 and a Danfoss-related advisory in May 2025.

On October 15, 2026, Coalition reportedly still identified 618 Danfoss devices online, including 206 in France, 50 in the United States and two in the United Kingdom.

These figures demonstrate why operators of industrial refrigeration systems need to monitor internet exposure, apply security updates and restrict access to control interfaces.

Freezer Food Safety 2026: How Long Does Food Stay Safe After a Hack?

A refrigeration failure can create food-safety risks when perishable food remains above recommended temperatures. The USDA provides guidance for food affected by power outages, which can also help explain the risks associated with refrigeration disruptions.

Sources: USDA Food Safety and Inspection Service, FoodSafety.gov and FDA guidance on power outages.

According to USDA guidance, an unopened refrigerator can keep food safe for up to 4 hours during a power outage. A full freezer can maintain its temperature for approximately 48 hours, while a half-full freezer can do so for approximately 24 hours, provided the door remains closed.

Refrigerators should generally remain at or below 40°F (4°C), while freezers should remain at or below 0°F (-18°C).

Perishable food held above 40°F for more than two hours should be discarded. When temperatures exceed 90°F, the recommended limit falls to one hour.

A cyberattack can be more complicated than a conventional power outage. Instead of simply losing power, a compromised refrigeration controller may actively change operating settings and raise temperatures.

In the French incidents, some refrigeration units reportedly reached 122°F (50°C). At such temperatures, supermarkets may need to discard affected fresh and frozen products rather than risk selling unsafe food.

Consumers should never taste food to determine whether it is safe. A food thermometer can help check temperatures, but food exposed to unsafe conditions should be discarded according to official food-safety guidance.

How Can Supermarkets Prevent Freezer Cyberattacks?

Supermarkets and food retailers increasingly depend on connected refrigeration systems. Protecting these systems requires both physical security and cybersecurity measures.

Important precautions include:

1. Restrict internet access: Refrigeration controllers should not be directly exposed to the public internet unless access is necessary and properly secured.
2. Use strong authentication: Operators should replace default passwords and use strong, unique credentials.
3. Install security updates: Firmware and controller software should be updated when manufacturers release security fixes.
4. Monitor unusual activity: Sudden temperature changes, unexpected defrost cycles and unauthorized configuration changes should trigger alerts.
5. Separate operational networks: Refrigeration control systems should be isolated from ordinary business networks wherever practical.
6. Maintain manual controls: Staff should have procedures for responding when automated refrigeration systems behave unexpectedly.
7. Prepare food-safety plans: Retailers need clear procedures for checking temperatures, isolating affected products and documenting food disposal.

These measures can reduce the risk of unauthorized access and help stores respond quickly when refrigeration systems malfunction.

Frequently Asked Questions About Freezer Cyberattacks

What are freezer cyberattacks?

Freezer cyberattacks involve unauthorized access to connected refrigeration systems. Attackers may manipulate controller settings, interrupt cooling or force refrigeration units into defrost mode, potentially causing food spoilage.

When did the major French supermarket freezer attacks happen?

The major French incidents discussed in reports occurred on October 12, 2026. Retailers reported refrigeration disruptions, and some units reportedly reached temperatures as high as 122°F (50°C).

How many French supermarkets were affected?

Published estimates varied from approximately 250 to nearly 700 stores. Reuters later reported more than 350 affected establishments. The figures differ across reports and should not be treated as one confirmed total.

Which supermarket chains were affected in France?

Reported chains included Intermarché, Coopérative U, Carrefour, Monoprix and E.Leclerc.

Were US military commissaries hacked?

Reuters reported that at least six US military commissaries experienced freezer failures in August 2026. The Pentagon reportedly treated the incidents as suspected cyberattacks, but the cause had not been confirmed in the cited reporting.

How many refrigeration controllers were exposed online?

Coalition scan data reported by The Register identified 2,624 refrigeration controllers with login pages exposed to the internet. Exposure does not necessarily mean that a device was compromised.

Can a cyberattack make supermarket food unsafe?

Yes. If refrigeration temperatures rise beyond safe limits for long enough, perishable food can become unsafe. Retailers should follow official food-safety guidance when deciding whether products must be discarded.

How can supermarkets protect refrigeration systems?

Supermarkets can reduce risks by restricting internet access, using strong passwords, installing security updates, monitoring unusual temperature changes and separating refrigeration control systems from ordinary business networks.

Disclaimer: This research report is compiled from publicly available sources. While reasonable efforts have been made to ensure accuracy, no representation or warranty, express or implied, is given as to the completeness or reliability of the information. We accept no liability for any errors, omissions, losses, or damages of any kind arising from the use of this report.