Hackers heated Europe's supermarket freezers. No record said which food stayed cold.

On Monday, 2 November 2026, a Delhaize supermarket north-east of Brussels put up a sign: "Due to cyberattacks, there will be no products on the refrigerated or freezer shelves." Chains in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported fridges and freezers that had been pushed overnight to as high as 50C, according to The Guardian. So why did shops empty whole freezers, not just the ones that got warm? Because once the controller is compromised, nothing independent says which food stayed cold. EU rules ask display cabinets for a visible thermometer, not a recording, so the safe answer is to bin everything.

What happened in the freezer cyber attack on 2 November?

This was the second wave. In October, attackers took over refrigeration controllers in hundreds of French supermarkets. Al Jazeera counted at least 300 Intermarché and Netto stores, more than 100 Coopérative U outlets and 80 Carrefour supermarkets. Intermarché's chief executive, Thierry Cotillard, put the losses at "tens of millions of euros nationwide in a single day". The controllers were mostly made by Danfoss, the Danish company, which said the affected units "were running outdated firmware".

The method is almost boring. Stephan Moelans, who runs Sabcobel, the company that maintains Delhaize's refrigeration in Belgium, told the Belga news agency the units' evaporators were switched to defrost mode. A defrost cycle is a normal thing a freezer does. Left on all night, it turns a freezer into a warm box.

Nobody has said who did it. There has been no claim of responsibility and no ransom note, which is why Tom Hegel of SentinelOne called it sabotage. I'm not going to guess past that.

My first reaction: just take them off the internet

That was my first thought, and it's the popular comment under the Reddit threads Google shows for this story. Patrick Lamplmair of the security firm Tributech said "thousands of these controllers were still reachable from the internet after the French attack." John Billow, who heads Sweden's national cybersecurity centre, said the country had "quite a lot of exposed operational technology devices". So yes, patch them and close the remote access.

Then I looked at where the money was actually lost. It wasn't the freezers. The loss was the food, and the food went because of a rule, not because all of it was ruined.

Intermarché told AFP that affected stores must discard all fresh and frozen products. That is the right call for a store that can't show what happened inside each cabinet overnight. And here is the part that surprised me. EU law already asks for temperature records in the cold chain. Commission Regulation (EC) No 37/2005 says warehouses and transport for frozen food must have "suitable recording instruments" and keep the records for a year. Then Article 3 makes an exception. In "retail display cabinets", the air temperature "shall only be measured by at least one easily visible thermometer." The reason given in the preamble is that recording "would be excessive" for small retail equipment.

So the last few metres of the cold chain, the cabinet you open, is the one place the law doesn't ask for a record. A thermometer you read in the morning tells you it's cold now. It doesn't tell you it was 50C at three in the morning, or that it wasn't.

Where have we seen an attack like this before?

In Chicago, in 1982. Seven people died on 29 and 30 September after taking Extra Strength Tylenol capsules laced with cyanide. As History.com tells it, Johnson & Johnson's McNeil unit recalled roughly 31 million bottles nationwide. The recall was about doubt, as I read it: nobody could tell a touched bottle from an untouched one, so they all went.

The lasting fix wasn't catching the poisoner, who was never found. It was packaging that shows its own history. US rules today, at 21 CFR 211.132, define a tamper-evident package as one with indicators or barriers that, if breached or missing, give "visible evidence to consumers that tampering has occurred." The seal doesn't stop anyone. It lets you keep the bottles that weren't opened.

The freezer attacks have the same shape. The attacker doesn't need to spoil every product. They need to make spoiling impossible to rule out. A precaution does the rest.

What would a tamper-evident freezer look like?

A temperature logger that doesn't share the controller's network or credentials. A cheap battery logger in each cabinet, read in the morning, would let a store say "these four warmed, those twenty didn't" and keep the twenty. That's my inference, not something any retailer has said. The one hint in the reporting points the same way: in Estonia, Jann Mutso of Kitman Coldtech said the attack was caught "within minutes" and there was no significant damage. Speed and evidence are what turn a total loss into a partial one.

I'm not saying patching doesn't matter. Danfoss's old firmware is the way in, and closing it is the first job. It's the same argument I made about old PHP versions that stop getting fixes: the owner of an old system is the one who pays when it's left open. But the next wave will find some other controller. A record the attacker can't reach limits the damage whichever door they use. I've run into this gap before in a very different place, when NIST's curve seeds turned out to be timestamps that no record explained. When the evidence is missing, everyone has to assume the worst.

How sure am I?

Who did this, whether the two waves are linked, and how much stock each store could have saved are all unknown to me. If a retailer reports keeping stock because a separate log showed it stayed cold, that would back the claim. If stores with loggers still threw everything out, I'm wrong about where the loss sits.

More on Daily Ferment: PHP shipped a critical fix. Old versions got none. Now what? and NIST's curve seeds were timestamps. No record said so.

Sources

• Jon Henley, Shop fridges and freezers across Europe hit by fresh suspected cyber-attack, The Guardian, 2 Nov 2026.
• Hundreds of supermarkets in France hit by 'unprecedented' cyberattack, Al Jazeera, 13 Oct 2026.
• Commission Regulation (EC) No 37/2005 on monitoring temperatures of quick-frozen foodstuffs, 12 Jan 2005.
• Council Directive 89/108/EEC on quick-frozen foodstuffs, 21 Dec 1988.
• Dave Roos, How the 1982 Tylenol Poisonings Nearly Canceled Halloween, History.com, 3 Oct 2022.
• 21 CFR 211.132, Tamper-evident packaging requirements, eCFR.