On the morning of Monday, November 2, 2026, staff at several supermarkets in Sweden arrived to find freezer cases running at plus 50°C. Stock had to be discarded, and at least one store could not open on time while equipment was emptied and reset.
No ransom demand was made and no data was taken. Instead, the attackers changed the operating parameters of the refrigeration systems themselves.
Three weeks earlier, the same pattern affected around 700 supermarkets in France. Together, the two waves show that refrigeration controllers are operational technology (OT) and are now being actively targeted.
The larger wave took place in France on the night of October 11 to 12, 2026. Temperature setpoints on store refrigeration systems were raised to as high as 50°C, or units were forced into continuous defrost cycles.
Around 700 stores across several national chains were affected. Stock worth millions of euros was destroyed and fires were reported at several sites.
The French incidents have been linked to remote refrigeration management controllers and monitoring platforms from more than one manufacturer. Many of the compromised units were end-of-life and no longer received security updates, while others were supported models that had not been updated.
The Swedish incidents followed on the night of November 1 to 2, 2026. A limited number of stores belonging to two grocery groups were affected, in southern Sweden, Stockholm and further north. Investigations are ongoing, and early indications point to the same class of internet-reachable management platforms.
No malware was required. The attackers used the controllers’ own supervisory functions, the same interfaces technicians use to adjust temperatures or start defrost cycles.
Independent research published after the incidents identified nearly 13,000 internet-exposed refrigeration management service observations across more than 6,000 public IP addresses worldwide. Four conditions recur across the affected estates.
Where all four are present, the effort required of an attacker is low. Researchers noted that little target-specific knowledge was needed, which is consistent with opportunistic scanning rather than a tailored operation. Hacktivist groups have also claimed more than 20 attacks on refrigeration systems since January 2026.
These are cyber-physical attacks. Their objective is interference with a physical process rather than theft of data or extortion, and the consequences are immediate, including destroyed inventory, closed stores, lost sales and, in some cases, fires.
Retail refrigeration sits where facility management, industrial control and food supply meet. It has historically been purchased and maintained as equipment rather than secured as a control system, and its cybersecurity maturity lags behind heavier industrial sectors.
The same controller families and remote service models are used in pharmaceutical storage, hospital cold rooms, food processing and logistics. The exposure therefore extends across the wider cold chain, with direct implications for food safety and public health.
The systems attacked in these incidents had been in service for years. The exposure that enabled the attacks accumulated during operation, as contractors opened remote access, firmware moved out of support and temporary firewall rules remained in place.
The attackers located these systems by scanning the internet. Operators need the same visibility, and they need it first. Preemptive Exposure Management (PEM), extended beyond IT to cover OT and facility systems, provides it. PEM operates continuously and from the outside in, across four stages.
Periodic security assessments remain valuable, but on their own they cannot keep pace with estates whose configuration changes frequently. Validation needs to be continuous.
Acceptance testing would not have protected the systems attacked in France and Sweden. They were installed years earlier, and retail refrigeration rarely passes through a formal security gate.
Its value lies in the projects that follow. Many operators will now replace end-of-life controllers across their store estates, and those projects are the right point to prevent the same exposure from being reintroduced.
Cyber Factory Acceptance Testing (FAT) and Cyber Site Acceptance Testing (SAT), aligned with IEC 62443, make cybersecurity a contractual acceptance criterion with independent verification.
| Cyber FAT | Cyber SAT |
|---|---|
| At the manufacturer or integrator | On site, before commissioning |
| Secure defaults, strong authentication on HMIs and remote interfaces, current firmware with no known vulnerabilities, and logging of setpoint and defrost changes. | No direct internet reachability, correct network zoning, remote access only through controlled channels with MFA, and alerting on abnormal control changes. |
Cyber FAT and SAT establish a verified baseline at handover, and continuous exposure management maintains it throughout operation. Together they provide assurance across the full asset lifecycle.
Leadership and facility teams can use the following questions to assess their current position.
| # | Question | Why it matters |
|---|---|---|
| 1 | Do we have a current inventory of every refrigeration and facility controller that can be reached from the internet? | Exposure that is not recorded is not managed. |
| 2 | Has each exposed interface been tested to confirm what an attacker could change? | Validation separates real risk from scan noise. |
| 3 | Does every contractor connect through a managed gateway with individual accounts and MFA? | Shared vendor access is the most common entry path. |
| 4 | Would anyone be alerted if a setpoint changed at three in the morning? | Early alerting limits stock loss. |
| 5 | Are Cyber FAT and SAT written into the contract for the next controller replacement? | Defects cost least to correct before handover. |
The incidents in France and Sweden show that equipment with a remote management interface can be used to cause physical disruption with limited effort. Refrigeration, HVAC, building management and similar commercial OT require the same lifecycle discipline already applied to industrial control systems.
For existing estates, the immediate priority is continuous discovery and validation of exposed controllers, together with tighter control of contractor access. For new and replacement projects, Cyber FAT and SAT should be included as contractual acceptance criteria. Responsibility for these systems should sit with the teams accountable for OT cybersecurity, not with facility maintenance alone.
