A change made to a refrigeration controller was enough to turn supermarket cooling systems across Europe into a source of spoiled food and heavy losses. The attacks in October and November 2026 affected about 700 French stores and more than 100 shops elsewhere, showing how a low-profile commercial system can produce physical consequences when it is connected to a network.
British cybersecurity company Lupovis later recorded 256 attempted attacks on decoy systems made to resemble genuine controllers for Danfoss refrigeration equipment. The infrastructure used in those attempts had previously been associated with Russian hacking operations. That is a significant technical clue, but it does not identify a particular group or establish who ordered the attacks.
The setting that spoiled the stock
The first major wave took place overnight from 11 to 12 October in France. Attackers moved refrigeration units into defrost mode, causing temperatures inside cold rooms and display cases to rise. Food that depended on continuous refrigeration then had to be removed from sale and discarded.
About 700 French supermarkets were affected, including outlets operated by Intermarché, Carrefour, Coopérative U and Monoprix. In some individual stores, the value of spoiled goods was estimated at tens of thousands of euros. Across the affected retail networks, total losses were put at tens of millions of euros.
A second wave struck during the night of 2 November. More than 100 shops in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden were affected. Similar incidents were reported in Finland, Italy and Portugal. The damage in this later wave was substantially smaller: in Belgium, spoiled meat alone was valued at about €15,000.
The method required neither a break-in nor the destruction of machinery. A remote alteration to a digital setting was enough to redirect an automated process. Equipment designed to preserve food became the mechanism that caused it to be wasted.
That distinction matters for retailers. The immediate loss is the value of the stock, but the full bill can include disposal, cleaning, technical inspections, repairs, emergency deliveries, replacement goods and lost trading time. A store does not need to close for days for a cyber incident to become financially serious.
Lupovis sets a trap
To investigate the activity, Lupovis placed online systems designed to look like genuine Danfoss refrigeration controllers. These decoys, or online traps, were intended to be difficult for attackers to distinguish from equipment operating in real shops.
Between 20 and 30 October, the company recorded 256 attempts from 91 sources. Lupovis chief executive Xavier Bellekens said the attackers were using infrastructure previously linked to Russian hacking operations. He said the company could not identify a specific group, although the number of actors matching the observed characteristics was “very narrow”.
The findings were reported on 4 November 2026 in a report on the Lupovis investigation.
Technical links such as these can help investigators connect activity with earlier operations, but they do not amount to proof of authorship. The available information does not show whether every attempt against the decoy controllers was part of the supermarket campaign, preparation for later attacks, or the work of operators copying infrastructure and techniques associated with other hackers.
That uncertainty is not a minor detail. Digital infrastructure can be reused, rented, copied or deliberately made to resemble the tools of another actor. The evidence points to a narrow circle of possible operators, but it does not establish that the Russian state directed the incidents, or even that one organisation carried out every related intrusion.
Why a supermarket matters
Refrigeration in a supermarket is not normally placed in the same category as an electricity grid, hospital or water network. Yet it is essential to the daily operation of food retail. Controllers monitor temperatures, manage cooling and defrost cycles, and may be connected to systems that allow remote supervision or administration.
That connectivity brings efficiency as well as exposure. An unauthorised user who reaches a controller does not need to cause a national outage to create disruption. Changing one operating state can affect stock, staff, customers and the store’s relationship with its suppliers.
The events also show how an attack can cross the boundary between the digital and physical worlds without spectacular destruction. No building has to be damaged and no power station has to fail. A command sent through a network can alter the behaviour of equipment, and the consequences can appear later as spoiled meat, discarded dairy products or empty refrigerated shelves.
For businesses, the risk extends beyond individual stores. Repeated incidents could place pressure on producers, wholesalers, distributors and logistics companies, which might have to replace orders, reroute deliveries or manage sudden changes in demand. A campaign that never reached the level of a national emergency could still impose a steady financial burden on the wider supply chain.
A possible test of connected infrastructure
The supermarket incidents do not show that energy, transport, municipal or industrial systems have been penetrated. They do, however, illustrate why networked control equipment in those sectors can be attractive to attackers. The basic mechanism is transferable: gain access to a connected controller and alter the way a physical process operates.
That makes commercial systems relevant to the wider security debate. Retailers may once have treated cyber protection chiefly as a question of safeguarding payment systems, customer information and office computers. Operational devices such as refrigeration units, temperature sensors and building-management systems require protection too. Network separation, strict access controls, monitoring and tested recovery procedures can limit the damage if one device is compromised.
The scale of the French losses also demonstrates the economic leverage of a disruption that leaves buildings standing. Tens of millions of euros in damage can be imposed without a fire, explosion or prolonged nationwide shutdown. If attackers repeatedly targeted stores, cold-storage warehouses or distribution centres, the cumulative impact could grow through waste, delays and the cost of defensive measures.
Food security is a conditional concern rather than an outcome of the incidents described so far. The attacks did not cause a Europe-wide shortage, and the November losses were much lower than those recorded in France. A wider assault on refrigerated warehouses, transport or distribution hubs could have more serious consequences, particularly if it coincided with another supply or logistics problem.
There is also a harder-to-measure public effect. Customers confronted with empty chilled cabinets may not know whether the cause is a technical fault, a delivery failure or deliberate interference. Repeated disruptions could increase anxiety about the systems behind everyday services and force companies and governments to demonstrate that ordinary commercial infrastructure is being protected.
The firmest conclusion at this stage is limited but consequential: refrigeration systems in supermarkets across several European countries were manipulated, and Lupovis observed further attempts against convincing replicas of those controllers. The possible connection with infrastructure associated with past Russian operations raises the geopolitical stakes, while the responsible group remains unidentified. The unresolved question is whether the incidents were a contained effort to inflict commercial losses or an early test of how easily cyber access can be converted into physical and economic harm.
