Refrigeration and Freezer Systems Breached at Large Scale

On 2 November 2026, the supermarket chains ICA and Coop confirmed that an incident affected refrigeration and freezer systems at a limited number of Swedish stores during the night. ICA Kvantum stores in Sjöbo and Tomelilla and ICA Supermarket Baronen in Stockholm were reported as affected, and Coop reporting that six of their stores were affected. The ICA Sjöbo store stated that its refrigeration systems had been hacked and that freezer temperatures were set to 50 degrees Celsius, requiring stock to be discarded and the store to close temporarily while systems were restored. Neither Coop or ICA have publicly confirmed the technical entry point, affected controller brands, or whether the activity was coordinated beyond the reported stores. [1] [2]

The Swedish incident follows a destructive cyberattack against supermarket refrigeration systems in France on 11 and 12 October. Attackers remotely manipulated refrigeration controls, causing units at hundreds of stores to heat up and forcing retailers to discard food. Reporting linked affected environments to remote management software used with older or outdated refrigeration controllers, including systems supplied by Danfoss. French authorities opened a cybercrime investigation. [3]

This is followed by further spreading as RTL Todays reports on similar issues in Luxemburg [4], and RTE writing about SuperValu in Ireland being affected [5]

A potentially related pattern has also been reported in the United States. The Pentagon is treating freezer malfunctions at at least six military commissaries in August as a suspected cyberattack. At one base, a freezer entered defrost mode and heated its contents overnight. US investigators are coordinating with French counterparts, but they have not publicly confirmed a technical link, attack method, responsible actor, or motive. [6]

Assessment

The available reporting supports an assessment that the disruption may be part of a wider pattern of opportunistic sabotage against remotely managed refrigeration systems. Similar physical effect in Sweden, Belgium, Luxemburg and Ireland, with possible connection to the events in France and the United States, namely unauthorized heating or extended defrost behavior.

Currently there is no clear attribution or confirmed motive. No public reporting cited here identifies a ransom demand, extortion attempt, data theft objective, or claim of responsibility. The deliberate manipulation of temperature controls and resulting product destruction appear destructive rather than financially motivated, but the absence of a public demand does not by itself exclude a financial motive. Joint government guidance describes opportunistic access through public-facing remote services, outdated software, default or weak credentials, followed by manipulation of HMI settings to create disruptive physical effects. [7]

Internet-exposed OT and edge management interfaces with outdated firmware, weak authentication, or unrestricted remote access present a plausible attack path. The earlier Truesec assessment of the French campaign noted vulnerabilities in web management interfaces, the presence of obsolete or outdated devices, and the need to patch supported controllers and remove direct internet exposure. However, the specific vulnerability used in France was not conclusively established.

Organizations operating refrigeration and other business-critical OT should immediately inventory internet-reachable controllers and remote maintenance paths, remove direct public exposure, restrict administration through a managed VPN or zero-trust access gateway, enforce unique credentials and multifactor authentication where supported, and validate firmware against vendor-supported versions. Detection teams should alert on changes to temperature setpoints, defrost duration, alarm configuration, user accounts, and remote-login sources. Operators should retain controller, firewall, VPN, and third-party service logs, establish independent temperature alarms that cannot be suppressed through the primary controller, and test manual isolation and safe recovery procedures. Suspected devices should be isolated while preserving evidence before reset or reconfiguration.

If you or your organization have concerns about the topic above or need support, please reach out to your Truesec contact for further assistance.

References

[1] Aftonbladet, “Ica:s frysar hackade”: https://www.aftonbladet.se/nyheter/a/31ygzM/ica-s-frysar-hackade

[2] Reuters, “Temperature soars at Swedish grocery store freezers, one store blames hackers”: https://www.reuters.com/business/retail-consumer/temperature-soars-swedish-grocery-store-freezers-one-store-blames-hackers-2026-11-02/

[3] INCIBE-CERT, “Cyberattack on Supermarket Refrigeration Systems in France” https://www.incibe.es/en/incibe-cert/publications/cybersecurity-highlights/cyberattack-supermarket-refrigeration-systems-france

[4] RTL Today, “Delhaize supermarkets targeted by cyberattack affecting refrigeration” https://today.rtl.lu/news/luxembourg/delhaize-supermarkets-targeted-by-cyberattack-affecting-refrigeration-1637836789

[5] RTE, “Refrigeration systems at 13 SuperValu stores hit by suspected cyber attack” https://www.rte.ie/news/business/2026/1102/1597612-13-supervalu-stores-hit-by-suspected-cyber-attack/

[6] Reuters, “Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say”: https://www.reuters.com/technology/pentagon-treating-military-base-freezer-malfunctions-suspected-cyberattack-2026-10-29/

[7] CISA and partner agencies, “Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity”: https://www.ic3.gov/CSA/2024/240501.pdf