The supermarket fridge hack exposes the cracks in tech vision of an ‘internet of things’
France has blamed Iran for cyberattacks that overheated supermarket fridges, as similar incidents across Europe expose how hackers can turn connected everyday technology into a costly physical security threat.
🔍 WHY THIS STORY MATTERS
Connected equipment can turn a software weakness into physical losses, making the security, maintenance and eventual obsolescence of internet-enabled devices a practical concern for businesses, infrastructure operators and consumers.
KEY TAKEAWAYS...
● Cyberattacks have manipulated supermarket refrigeration systems across France and several other European countries, causing food losses and operational disruption.
● Remote monitoring brings operational benefits but can expose physical equipment to attackers when connectivity, passwords, software or older controllers are inadequately secured.
● Internet-exposed refrigeration controllers illustrate a broader problem affecting operational technology used in food supply chains, buildings, healthcare and other infrastructure.
I magine opening a supermarket in the morning to find the freezer aisle dripping, the floor wet, and thousands of euros’ worth of food ruined.
That is what happened in France overnight on 11-12 October 2026, when hackers remotely manipulated refrigeration systems at hundreds of supermarkets. Temperatures reportedly reached 50°C, spoiling food worth millions of euros.
The attacks spread. In early November, similar incidents affected supermarkets in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden. Food suppliers in the UK were also targeted. A London wholesaler narrowly avoided losing its stock by disconnecting affected equipment from the internet.
On Monday November 9, French officials accused Iran of being behind the attacks in France. Others, including cybersecurity experts, have previously suspected Russian involvement – something Moscow has denied.
Whoever is responsible, these incidents reveal an uncomfortable reality: cyberattacks are no longer confined to stolen passwords, compromised bank accounts or leaked information. They can disrupt the physical systems on which everyday life depends.
Who was behind the ‘fridge cyberattack’?
France says Iran’s Islamic Revolutionary Guard Corps (IRGC) was behind the cyberattack that disrupted refrigeration systems in hundreds of French supermarkets on 11–12 October.
French Foreign Minister Jean-Noël Barrot publicly attributed the attack to the IRGC on 9 November. This remains an allegation by the French government: France has not publicly released technical evidence establishing Iranian responsibility, and the attribution has not been independently verified. The investigation is continuing.
Iran strongly denies the accusation, describing France’s claims as baseless.
Similar refrigeration incidents have affected other European countries, but there is currently no publicly established evidence that Iran was responsible for all of them. Russian involvement has also previously been suspected, which Moscow has denied.
A term, the “internet of things”, is sometimes used for the increasing trend for physical objects to be embedded with sensors and communicating with other devices or systems over the internet.
But as more devices become connected to the internet, the question is not simply how hackers managed to heat supermarket freezers, but who is responsible for keeping these devices – and others like them – secure.
Modern supermarket refrigeration systems often use control panels that allow engineers to monitor temperatures, receive alerts, and adjust settings remotely.
The control panels operate electronic devices called controllers that manage the refrigeration systems and can be accessed remotely via the internet. This is useful: a failing freezer in the middle of the night can cause substantial losses and remote monitoring can help prevent it.
But the same connectivity that makes these systems convenient can also create opportunities for attackers.
From freezers to ovens
Attackers reportedly extended defrost cycles from around one hour to eight hours, delaying alarms while temperatures rose. The concern is that equipment can remain mechanically functional long after its cybersecurity protections become inadequate.
And the implications extend beyond supermarkets. Hospitals, pharmacies, and warehouses depend on refrigeration, while connected systems also manage heating, ventilation and other building functions.
Perhaps the most revealing aspect of these attacks is their potential scale. Hackers need not target supermarkets individually. They can search the internet for particular controllers for appliances, such as fridges and freezers, and attempt to exploit the same weaknesses across businesses and countries.
Since the attacks, there has been evidence that refrigeration controllers have been disappearing from the internet, consistent either with the companies taking action to protect them, or owners disconnecting the appliances. Yet more than 3,100 remained visible online on November 5 2026. Exposure does not necessarily mean vulnerability, but it illustrates the scale of the shared risk.
A refrigeration controller may accept a change to its defrost settings even when the resulting temperatures could destroy food. Businesses therefore need more than protection against unauthorised access. Critical operating limits should be protected against dangerous remote changes, with independent safeguards and local controls – allowing supermarket employees to adjust refrigeration equipment – if digital systems are compromised.
Secure connectivity is another part of the solution. In January 2026, the UK’s National Cyber Security Centre published guidance on how industrial systems connect to external networks and how those connections should be controlled.
But securing these systems also raises a question of responsibility. A supermarket may buy equipment from one company, use another for maintenance and depend on a third for software support. When vulnerabilities emerge, responsibility can become fragmented. This can leave critical security gaps unaddressed.
International cybersecurity agencies are urging organisations to consider security when purchasing industrial equipment, including manufacturers’ commitments to security updates and support throughout a product’s lifespan. This approach is known as “secure by demand”.
But what happens when an attack succeeds despite these precautions? A supermarket may suffer immediate losses, even when the weakness lies in equipment or software supplied by someone else. Insurance may cover some of the damage, but who ultimately bears the cost depends on contracts, liability and the terms of the insurance policy. Financial risk may be transferred between organisations, but responsibility for preventing and managing cyberattacks is not necessarily transferred with it.
What about the rest of us?
The same risks increasingly extend into our homes. Smart thermostats, security cameras, doorbells and connected appliances create ongoing dependencies on their manufacturers.
Unlike traditional appliances, connected devices may rely on software updates and cloud services long after purchase. A device can become insecure before it becomes unusable. And if its manufacturer withdraws support or shuts down a cloud service, some functions may stop working altogether.
Before buying connected technology, we should ask: how long will security updates be provided? Will essential functions work without internet access? What happens when support ends?
But consumers cannot reasonably assess every vulnerability or control manufacturers’ decisions. Responsibility for security cannot rest with them alone.
We routinely ask what connected technology can do for us. Perhaps we should also ask who bears the risks when things go wrong, and who remains responsible for keeping it secure as it gets older.
🔮 WHAT MATTERS NEXT...
🎯 WHAT TO WATCH NEXT:
● Whether European retailers continue removing or restricting internet access to vulnerable refrigeration controls as operators reassess remote connectivity.
● Whether investigations establish connections between the French attacks and the subsequent incidents elsewhere in Europe; similar effects do not by themselves establish a common perpetrator.
● Whether France’s attribution produces coordinated European action. Paris has accused Iran’s Islamic Revolutionary Guard Corps, while Iran has rejected the accusation.
● Whether attacks move beyond food retail. France’s national blood service reported attacks on refrigeration controls, although technicians intervened before blood products were compromised.
🎯 MOST LIKELY OUTCOME:
● Operators are likely to face sustained pressure to reduce unnecessary internet exposure, strengthen remote access and replace or isolate ageing connected equipment, particularly where compromise can affect physical processes.
🎯 WHAT COULD CHANGE THE PICTURE:
● Further technical or government evidence identifying a common attacker, additional vulnerable product families, or attacks on more consequential infrastructure would materially increase the security and policy implications.
🎯 WHY THIS MATTERS:
● The central issue is no longer simply whether connected equipment can be hacked, but whether organisations can keep essential physical processes safe when remote digital controls are compromised.
GOING FURTHER
France blames Iran’s Revolutionary Guards for cyber-attacks on supermarket fridges | The Guardian
Iran rejects France's 'baseless accusations' on fridge cyberattacks | Euronews
Food suppliers in UK hit by cyber-attacks after freezers targeted in Europe | The Guardian
Shop fridges and freezers across Europe hit by fresh suspected cyber-attack | The Guardian
Which countries in Europe have been hit by supermarket fridge cyber incidents? | Euronews
French blood banks hacked in latest cyber-attack on Europe | The Guardian
Hackers probed Europe’s fridge systems weeks before cyberattacks. Who did it and what could they target next? | Euronews
The French fridge hacks were relatively unsophisticated. An AI-enabled attack would raise the stakes | The Guardian
Sources:
▪ This piece was originally published in The Conversation and re-published in Europeans TODAY on 12 November 2026. | The authors write in a personal capacity.
▪ Cover: Dreamstime/KORWEN.
