Global Cyberattacks Target Supermarket Refrigeration Systems to Spoil Food Supply

“They were blown up”: Cyberattacks Destroy Industrial Refrigeration Hardware

“They were blown up … they got overused and there was smoke. They were not repairable,” Omri Segev Moyal, head of the Israeli incident response firm Profero, told NPR regarding a targeted strike on a food production plant. This wasn’t a simple data breach or a standard ransomware demand; it was a physical destruction of infrastructure via digital means. Hackers bypassed safety limits and manipulated gas pressure valves to force industrial compressors to fail, leaving companies with massive equipment replacement costs and weeks of operational downtime.

The Bottom Line:

Infrastructure Vulnerability: Hackers are leveraging AI to rapidly map and exploit industrial control systems, specifically targeting Danfoss refrigeration controllers used in both European supermarkets and U.S. military commissaries.
Operational Destruction: Unlike typical cybercrime, these attacks aim for physical hardware failure, with reports of thermostats being remotely set to 50C (122F) to ensure total food spoilage and equipment damage.
Geopolitical Risk: Forensic data and propaganda linked to the “Cyber Isnaad Front”—a group tied to Iranian military operations—suggest these attacks are state-sponsored demonstrations of capability targeting global food supply chains.

The Danfoss Connection and the Vulnerability of Aging Hardware

The technical commonality across these disparate attacks is the hardware used to manage temperature. According to reports from NPR and ABC News, many of the affected facilities relied on Danfoss refrigeration remote control systems. In France, an October 12 attack targeted approximately 150 to 200 Intermarché stores and nearly 100 Coopérative U outlets, causing massive defrosting events. This pattern repeated in early November across Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium, according to Euronews.com.

🚨 Second wave of cyberattacks hits supermarket fridges across Europe. Hackers remotely changed cooling settings, in some cases setting freezers to 50°C. Stores have been forced to discard food and pull products from shelves. Here's what we know ↓ https://t.co/0sKmoLJxMt

— https://x.com/TheHackersNews/status/2117520354759565567

The risk is compounded by the use of legacy technology. A review of public government contracting documents via SAM.gov indicates that several U.S. Defense Commissary installations, including Fort Irwin and Fort Huachuca, have operated older versions of Danfoss controllers dating back to the mid-2000s. These units often cannot be updated with modern, secure software, leaving them exposed to exploits identified by French cybersecurity officials at CERT-FR.

The economic impact on retailers is immediate and severe. While some companies, such as the Belgian refrigeration group Sabcobel, attempted to patch systems following the French incidents, others remained vulnerable. Nick Jackson, director of cyber-operations at Bitdefender, told The Guardian that companies often hesitate to install patches because the required downtime for machinery can disrupt food retail operations.

the ai and cyber folks have predicted the progression of this stuff in a way that makes me pretty uncomfortable for what could be next! https://t.co/4swzSHP7dT

— https://x.com/cwarzel/status/2117288443906531695

State-Sponsored Signaling vs. Lone-Wolf Disruption

The motive behind these strikes remains a subject of intense debate among intelligence analysts. Rafe Pilling, senior director for threat intelligence at Sophos, told The Guardian that the most plausible scenarios involve either state-based signaling—demonstrating the ability to disrupt a nation’s food supply—or lone-wolf actors. However, the scale and sophistication suggest a more organized hand.

Moyal told NPR that the “Cyber Isnaad Front” appears to be behind the Israeli attacks. This group is linked to Iranian military operations and was previously associated with influence campaigns targeting U.S. elections in 2024, as documented by the FBI’s Internet Crime Complaint Center. The group has also been linked to previous attacks on U.S. water and wastewater treatment facilities, as noted in CISA advisories.

[Shop fridges and freezers across Europe hit by fresh suspected cyber-attack] “Chains in seven countries say cooling unit temperatures rose overnight in incident similar to hack of French shops“https://t.co/PhdOQqMZk3””

— https://x.com/norionakatsuji/status/2117413763876020661

Location/Entity	Reported Impact	Primary Source/Outlet
ICA/Coop (Sweden)	Temperatures raised to 50C	ABC News
Delhaize/Carrefour (Belgium)	Limited refrigeration disruption	ABC News

The Main Street Bridge: Inflation and Supply Chain Fragility

For the American consumer, this is not just a digital security issue; it is a direct threat to food price stability and availability. When industrial compressors are “blown up” or forced into defrost mode, the resulting spoilage creates immediate supply shocks. For retail chains, the cost of replacing specialized industrial hardware and the loss of high-margin perishable inventory leads to margin compression.

These costs are rarely absorbed by the corporation alone. As retailers face higher capital expenditures for hardware replacement and increased insurance premiums due to cyber-physical risks, the financial burden is passed down to the consumer through higher grocery prices. In a period of existing fiscal tightening, these localized supply chain disruptions can exacerbate inflationary pressures on essential goods.

Which countries in Europe have been hit by supermarket fridge cyber incidents — Photo: Euronews.com

The AI-Driven Escalation of Cyber-Physical Warfare

The technical sophistication of these attacks is evolving at a rate that traditional defense protocols struggle to match. Moyal noted to NPR that the attackers used AI to rapidly understand complex system configurations, attempting a massive number of settings in a short window to find the exact combination that would destroy the hardware. “It wasn’t human, the amount of configurations they were able to try in a short time span,” he said.

This shift from data theft to physical destruction marks a new era of risk for critical infrastructure. As more industrial components—from water pumps to heating systems—are connected to the internet for remote management, the attack surface for bad actors expands exponentially. The “Smart Money” is watching closely; institutional investors are increasingly scrutinizing the cybersecurity resilience of industrial manufacturers and the physical security protocols of large-scale food distributors.

Hackers target supermarket fridges in growing global cyber threat

The current trajectory suggests that the “testing” phase in Europe and the U.S. may be a precursor to more widespread, coordinated strikes against temperature-sensitive sectors, including pharmaceutical logistics and laboratory materials. The era of digital warfare has moved from the screen to the server room, and finally, to the compressor.

Disclaimer: The information provided in this article is for educational and market analysis purposes only and does not constitute financial, investment, or legal advice. Always consult with a certified financial professional before making investment decisions.