OT and IoT security, connected refrigeration and critical infrastructure exposure

Hackers Didn't Need Ransomware. They Just Turned Up the Refrigerators.

Reporting published November 7, 2026 describes intrusions into internet-connected cooling at European supermarkets and three French blood-storage sites — attacks that needed no ransomware because the target was a control setpoint. Ahold Delhaize estimated the disruption could cut fourth-quarter 2026 revenue by about €250 million and operating profit by about €100 million, a company estimate relayed through secondary reporting rather than an audited figure. Alarms worked in France and the health ministry reported no operational impact; three UK abattoirs recorded defrosting units and one 100°C reading on empty equipment. A security firm logged more than 276 attempts against Danfoss refrigeration controllers from October 20 to October 30, from 91 distinct actors. No group has claimed responsibility and no ransom was demanded.

JWilliams & Associates · November 8, 2026 · 11 min read

A blood-storage freezer in Bourgogne-Franche-Comté was set to hold plasma at roughly minus 30 degrees Celsius. According to French reporting, someone changed the value in its control system to 110.

No file was encrypted. No ransom note appeared. No customer record left the building. That is the whole point, and it is why this story should worry a board more than a breach would.

The wave of attacks on European refrigeration systems needed none of the usual machinery of ransomware, because nobody was after information. They were after a setpoint — the instruction that tells equipment what temperature to hold.

A figure with a currency symbol attached

Most coverage of this incident stayed at the level of spoiled food and disrupted stores. One number moves it into the boardroom.

Ahold Delhaize, the Dutch retail group, estimated that the refrigeration disruption could reduce fourth-quarter 2026 revenue by approximately €250 million and operating profit by approximately €100 million, according to Reuters reporting relayed in Vietnamese coverage published November 7.

Treat that carefully. It is a company estimate, delivered through one relayed account, describing a quarter that had not yet finished. It is not an audited loss, and it may move in either direction before it is reported.

Even discounted heavily, it changes the category of the event. This was not a prank played on a thermostat.

The dates, separated from the coverage

Almost every summary of this story compresses a week of incidents and a week of reporting into a single blur. The gap matters, because the sequence tells you what the responders knew and when.

What	When it happened	How it is sourced
Refrigeration intrusions at hundreds of French supermarkets	Mid-October 2026	Translated secondary reporting; ANSSI and the Paris prosecutor reported as involved
Probing of Danfoss refrigeration controllers observed on decoy systems	October 20–30, 2026; peak October 26	Lupovis, relayed through Euronews Next and regional coverage
Blood-storage cooling systems, Bourgogne-Franche-Comté	Night of November 1–2, 2026; one account dates EFS confirmation to November 3	Translated secondary reporting; accounts conflict
European retail wave first reported publicly	November 2, 2026	EFE agency reporting, republished
Three UK abattoirs affected	Overnight November 2; confirmed November 3	UK national newspaper citing the Association of Independent Meat Suppliers
NCSC annual review remarks	Tuesday, November 3, 2026	UK national newspaper
Consolidated assessments published	November 7, 2026	EFE; Kompas.com; Metrotvnews; Oslobodjenje; other syndicated coverage

One inconsistency inside that table deserves naming rather than smoothing over. French reporting places the blood-storage intrusion on the night of Sunday, November 1 into Monday, November 2. A separate Vietnamese account states that the French blood establishment confirmed the intrusion at three sites on November 3.

Those are not necessarily contradictory. An intrusion and its public confirmation are different events. But neither account establishes when the attacker first had access, and that is the number an incident review would actually want.

The 110 was a setpoint, not a temperature

This correction is the difference between a scare and a catastrophe, and most coverage skipped it.

The 110°C figure was the value written into the refrigeration control system. It was not a temperature the freezer physically reached. Whether blood products are destroyed depends on what the equipment actually did, how quickly anybody noticed, and — critically — whether the alarm that fired was independent of the controller that had just been tampered with.

In the French case, the answer was yes. The monitoring systems detected the anomaly, staff responded, and France's health ministry confirmed the incident did not disrupt operations.

That is a control working as designed. It is also the only reason this is a story about refrigeration rather than about the blood supply.

The UK cases came closer to luck. Three abattoirs were affected, according to the Association of Independent Meat Suppliers on Tuesday, November 3. Two reported refrigeration units defrosting unexpectedly overnight. Another recorded a temperature reading of 100°C. The units were empty, and no meat was lost.

Empty equipment is not a security control.

What was actually exploited

Nothing in the reporting describes a sophisticated intrusion. It describes the ordinary, accumulated state of internet-connected operational equipment.

Exposed control interfaces. Refrigeration controllers reachable from the public internet, with login pages discoverable by scanning.
Factory credentials. Reporting cites default accounts left unchanged, including a username of "Supervisor" and a password of "12345."
Older firmware. Initial examination pointed toward a vulnerability in systems made by Danfoss, the Danish engineering company, with Danfoss reported to suspect an older firmware version. That attribution is reported, not confirmed.
Third-party access. In the French blood case, the target was described as a maintenance provider servicing cooling facilities for the national blood establishment — not the operator itself.

Awais Rashid, a professor of cybersecurity at the University of Bristol, is quoted making a point that travels well beyond groceries: many of these units are managed by third parties and had not received the updates that would have stopped the intrusion.

The manufacturer's position is more uncomfortable still. A cooling-systems producer quoted in the same coverage argued that software patching alone would not fix it, and that direct physical modification of the devices was required to close the network exposure.

Five, nine or eleven countries

The affected-country count moved as the week progressed: at least five in the wave first reported on November 2, nine by early November, eleven in coverage dated November 3 and later. This is what early incident reporting looks like. The totals describe what had been confirmed at the moment of writing, not what happened.

Named retailers vary by outlet for the same reason. One account lists roughly 40 Delhaize branches across Belgium and Luxembourg, five Colruyt stores and 15 of Carrefour's 700 Belgian locations, with IKEA and ICA also affected. Another lists approximately 150 Intermarché stores, 80 Carrefour stores and 25 Monoprix locations in France. A third describes hundreds of supermarkets across France, Belgium and the Netherlands in the mid-October phase.

Intermarché's chief executive put losses in the tens of millions of euros. Ahold Delhaize's estimate is larger and more specific. Neither is audited, and they may not measure the same thing.

Attribution: claimed, suspected, unproven

No group has claimed responsibility. No ransom has been demanded. Those two absences are themselves information, though of what remains unclear.

The most specific attribution-adjacent finding comes from Lupovis, a cybersecurity firm operating honeypots — deliberately exposed decoy systems used to observe attacker behavior rather than production targets. Between October 20 and October 30 it recorded more than 276 access attempts against components of Danfoss refrigeration controllers, originating from 91 distinct threat actors, with activity peaking October 26.

Its chief executive, Xavier Bellekens, described attackers trying default passwords and exploiting known vulnerabilities, working from hosting providers that resist takedown requests and that have previously been used by Russian hacking groups. He characterized the operation as well planned and consistent with a state actor, while stating plainly that his company cannot prove a Russian link.

European officials have pointed toward Russia. The Kremlin rejected those accusations on Thursday, November 5. Analysts quoted by EFE — Hervé Lambert of Panda Security and Josep Albors of ESET Spain — agreed the incidents share elements but said the hypotheses do not yet support a conclusion about a single origin or motive.

George Nott, technology editor at The Grocer, made the case for restraint most directly: with no ransom demand and no claim of responsibility, the actor could be a state — or a group of teenagers doing it for amusement.

Meanwhile, the same controller opens the door

The most useful sentence in the entire body of coverage comes from Kumar Sokka of Acre Security: the freezer is nothing special. It is simply the most visible example of a much broader category.

The same class of controller, he notes, can manage doors, cameras, alarms, lighting and heating, ventilation and air conditioning in a modern building. In a hospital or a data center, an intrusion could disable a camera or silence an alarm without producing any obvious sign that something is wrong.

That reframing turns a grocery story into an estate problem. These devices are not in the IT asset register. They are commissioned by facilities, maintained by a contractor, reached over a link somebody set up years ago, and updated on a schedule that belongs to a manufacturer's support policy rather than a security program.

What the policy response actually said

On Tuesday, November 3, the head of the UK's National Cyber Security Centre used the refrigeration disruption as an illustration of societal exposure. "Our resulting exposure as a society is huge and increasingly exploited in cyber attacks as we are seeing in the disruption of refrigeration units across Europe," Richard Horne said at the launch of the agency's annual review.

He had already put the stakes plainly: "When food isn't on the shelves, when lights aren't on, businesses have gone under." Asked whether the attacks reinforced official advice to households to keep emergency supplies, he answered: "Absolutely."

That advice — three days of non-perishable food and bottled water — was published on October 22 under the Be Ready campaign. The government also announced £60 million for the first phase of a Cyber Shield initiative and £70 million for a center to identify vulnerabilities across critical infrastructure.

Read those two things together and the policy logic is clear. When physical systems are reachable from the internet, the failure mode is not a data breach. It is empty shelves.

Five questions for the next leadership meeting

1. Which of our physical systems are under remote control, and who can reach them? This is Lambert's recommendation and the right starting point: not a policy review, an inventory — including the devices facilities bought without telling IT.

2. Do we know the firmware version and credential state of every one of those devices? A default password is not a configuration error to be corrected eventually. In this incident it was the entire attack.

3. Can the operational network be separated from the corporate one, and is remote access mediated rather than direct? Bellekens' observation — that many of these systems would be better protected behind a VPN than exposed to the internet — is a design decision, not a product purchase.

4. Does the alarm work independently of the system being attacked? The French blood case is the model: the alarm fired because it was not the compromised controller. The UK abattoir cases are the warning: nothing was lost because the equipment happened to be empty.

5. Which third party holds the keys, and does the contract require patching? In the blood-storage incident the target was a maintenance provider. Vendor management is the control.

What this edition could not establish

Attribution. Suspicions are named; proof is not. The Lupovis findings describe probing activity against decoys, not the intrusions themselves.
Whether the episodes are one operation. Common elements, no confirmed link.
Whether Danfoss firmware was the root cause. Reported as an initial line of inquiry. Not confirmed.
The exact blood-storage timeline. French reporting places it on the night of November 1–2; one account dates confirmation to November 3.
Actual peak temperatures. Some outlets report internal temperatures reaching 50°C; others conflate control setpoints with measured readings. The 110°C figure is a setpoint. The 100°C figure is a reading on empty equipment.
Secondary physical damage. Reports of fires at some French locations appear in one translated account and were not corroborated here.
Whether artificial intelligence was used. No evidence in the reporting indicates it. Both analysts said it would be plausible while noting no indication it was present.
Total financial loss. Two company-level estimates, no audited figure, one quarter still open.

The freezer was never the target

The reason this story travels is that refrigeration is legible. Everyone understands a warm freezer. Very few people can picture a building management controller.

But the freezer was the proof of concept. A device installed for convenience, connected for remote maintenance, configured once and forgotten, reachable from anywhere on the internet. Every enterprise has some of these. Most have hundreds.

The reporting does not describe a failure of cryptography or a novel exploit. It describes a decade of procurement decisions in which "connected" was a feature and "defended" was nobody's line item.

Ahold Delhaize's estimate — roughly €250 million of revenue and €100 million of operating profit at risk in one quarter — is what that decade costs when someone finally tests it. France's blood supply survived on an alarm that happened to work. That is not a security posture. It is a coincidence with good timing, and the next building where the alarm shares a controller with the door may not be so fortunate.

Hashtags

#CustomSoftware #SystemsIntegration #EnterpriseAI #BusinessAutomation #CyberResilience #OTSecurity #ColdChain #SupplyChain #CriticalInfrastructure #FacilitiesManagement #RiskManagement #ZeroTrust #ITLeadership #CISO #DataGovernance #BusinessContinuity #OperationalExcellence #DigitalTransformation #VendorManagement #SecurityStrategy

Sources & references

Los ciberataques a supermercados y bancos de sangre en Europa: todo lo que se sabe y lo que aún falta por aclarar — Infobae, citing EFE (November 7, 2026)
Spanish-language agency reporting, translated. Establishes: the wave public on November 2 affected shops in at least five European countries, with more territories added in following days; attacks in Belgium, the Netherlands and Sweden occurred about three weeks after a similar French episode; three French blood banks were attacked on the Monday, sharply raising refrigerator temperatures, with alarms functioning and no health impact; refrigeration systems connect to platforms permitting remote monitoring and modification, so an intruder can alter temperature or defrost cycles from a computer thousands of kilometers away; no proof links all episodes to one operation, attributes them to a specific group, or establishes that artificial intelligence was used; the Kremlin rejected European accusations of Russian involvement on the Thursday; analysts Hervé Lambert (Panda Security) and Josep Albors (ESET Spain) agreed the cases share common elements but the hypotheses are insufficient to confirm a single origin or motive; Lambert's assessment that malware and attack tools are easy to find online without the dark web, and that an outdated system, weak password or poorly protected remote connection may suffice; and their recommended responses — identify which physical systems are under remote control, verify only authorized parties can reach them, keep equipment updated, maintain monitoring, avoid direct internet exposure of industrial devices, separate corporate networks from those controlling critical installations, and provide independent alarms and emergency protocols. Agency reporting relayed through a republisher.
Rentetan Serangan Siber di Perancis, Kulkas, Bank Konvensional, hingga Fasilitas Penyimpanan Darah Jadi Korban — Kompas.com (November 7, 2026, 11:15 WIB)
Indonesian-language coverage, translated. Establishes the mid-October 2026 French retail incident: remote access to cooling control systems at hundreds of French supermarkets, temperatures rising to 50°C, spoiled food, and reported fires at some locations; affected chains including Les Mousquetaires (Intermarché) at roughly 150 stores, Carrefour at roughly 80, Monoprix at roughly 25 of 490 French stores, and Coopérative U with an unknown count; Intermarché chief executive Thierry Cotillard estimating losses in the tens of millions of euros; the Paris prosecutor categorizing the incident as a large-scale attack with ANSSI investigating; initial examination pointing to a vulnerability in a system made by Danfoss, the Danish engineering company, with Danfoss suspecting an older firmware version; suspected similar targeting in Spain, Portugal, Poland, Germany and Belgium, and early-November disruption at supermarkets across nine European countries. Also the source for the blood-storage incident in Bourgogne-Franche-Comté on the night of Sunday, November 1 to Monday, November 2, 2026, targeting Coolworld, a maintenance provider for the French blood establishment (EFS); the reported change of the control setting from approximately minus 30°C to 110°C, with the explicit clarification that this figure was the value configured in the control system rather than the temperature actually reached inside the freezer; early detection by staff; and the French health ministry confirming no operational disruption. Translated secondary reporting; several details are single-source and not independently corroborated.
Hacker Sasar Kulkas Supermarket di Eropa, Tidak Perlu Alat Canggih! — Metrotvnews (November 7, 2026, 14:32)
Indonesian-language coverage, translated. Establishes the incident date as Monday, November 2, 2026; that internet-connected supermarket refrigeration was targeted and temperatures raised to as high as 50°C, spoiling food and causing large losses; the affected estate including roughly 40 Delhaize branches across Luxembourg and Belgium plus branches in Sweden, Ireland, the Netherlands, Estonia and Finland, five Colruyt supermarkets in Belgium, 15 of Carrefour's 700 Belgian stores, and Belgian branches of IKEA and ICA. Also the source for University of Bristol cybersecurity professor Awais Rashid's observation that many supermarket refrigeration units are managed by third parties and had not received updates that would stop attackers; for the assessment by experts and a cyber advisory board that these units were reachable online with default passwords, requiring no advanced tools or techniques; and for cooling-systems manufacturer Sabcobel's position that software updates alone are insufficient and direct physical modification is needed to close the security exposure. Translated secondary reporting.
Lỗ hổng công nghệ đe dọa những dịch vụ thiết yếu của châu Âu — Báo Tuyên Quang (November 7, 2026, 08:49), citing Reuters
Vietnamese-language coverage, translated. Source for two figures used in this article. First, the Ahold Delhaize estimate: the Dutch retail group estimated the incident could reduce fourth-quarter 2026 revenue by approximately €250 million and operating profit by approximately €100 million — a company estimate reported through secondary coverage, not an audited result. Second, the timing detail: as of November 3, 2026, at least 11 European countries had recorded cooling-system incidents, per Reuters. Also states that the French blood establishment (EFS) confirmed cooling systems at three locations were intruded on November 3, that temperature and defrost parameters were pushed to abnormal levels, and that the monitoring system detected the fault quickly, allowing staff to intervene — a date that differs from the night-of-November 1–2 timeline reported elsewhere and is flagged as conflicting rather than reconciled. Adds that hundreds of supermarkets in France, Belgium and the Netherlands were targeted in mid-October 2026, and that no organization has publicly claimed responsibility. Translated secondary reporting relaying Reuters.
Objavljeni detalji o napadima na frižidere u trgovinama: "Lozinka je bila 12345" — Oslobodjenje (November 7, 2026, 18:08)
Bosnian-language coverage, translated. Primary source for the honeypot findings: Lupovis recorded more than 276 access attempts against components of Danfoss refrigeration controllers between October 20 and October 30, originating from 91 distinct threat actors, with activity peaking October 26; chief executive Xavier Bellekens told Euronews Next that attackers tried default passwords and exploited specific vulnerabilities, that attempts were observed on deliberately exposed decoy systems, and that hosting providers used resist takedown and have previously been used by Russian hacking groups; Bellekens characterized the operation as well planned and consistent with a state actor while stating the company cannot prove a Russian connection, and noted similar activity in Europe but not in South America, Africa, North America or Asia. Also the source for: factory default credentials including username "Supervisor" and password "12345"; George Nott of The Grocer noting no ransom demand and no claim of responsibility, leaving a state actor or a group acting for amusement both possible; the note that attackers used weak passwords and vulnerabilities for which patches already existed; Bellekens' view that many systems would be better protected behind a VPN than exposed directly to the internet; and Kumar Sokka of Acre Security describing the freezer as merely the most visible example of a much broader category, with the same controller class managing doors, cameras, alarms, lighting and HVAC in modern buildings, including hospitals and data centers where an attack could disable a camera or alarm without an obvious sign. States no indication that AI was used in the European refrigeration attacks. Translated secondary reporting.
JWilliams & Associates
Destination for the advertisement in this article and the source for the capabilities described there: custom software and portals/APIs, custom AI applications and agents, multi-tenant SaaS development, enterprise architecture, systems integration, data engineering and managed services, together with the stated design philosophy that custom AI should serve as a force multiplier for company staff rather than making staff replacement the default goal. Nothing in this source supports any claim about specific customer results, incident prevention, operational technology security outcomes or savings, and no relationship with Danfoss, Lupovis, EFS, Coolworld, Ahold Delhaize, Delhaize, Colruyt, Carrefour, Intermarché, Monoprix, IKEA, ICA, Sabcobel, Panda Security, ESET or Acre Security is asserted.
Britain given 'food shortage warning' as fears over attack soar — Express (November 2026)
UK national newspaper coverage used for the domestic dimension and for direct English-language quotations. Establishes: at least 11 European countries affected, with reported temperatures in some fridges and freezers reaching 50°C and large quantities of spoiled food discarded; supermarkets affected in Belgium, Sweden, Ireland, Italy, Germany and Romania; three UK abattoirs affected, two reporting refrigeration units defrosting unexpectedly overnight and another recording a temperature reading of 100°C, with the units empty and no meat lost; the Association of Independent Meat Suppliers confirming on Tuesday, November 3 that some of its roughly 300 members were affected and that businesses using the same software as affected European supermarkets became 'collateral'; National Cyber Security Centre chief executive Dr Richard Horne's remarks at the launch of the agency's annual review on Tuesday, November 3, quoted verbatim, including that exposure is 'increasingly exploited in cyber attacks as we are seeing in the disruption of refrigeration units across Europe' and his 'Absolutely' when asked whether the attacks reinforced emergency-supply advice; the Be Ready campaign published October 22 advising three days of non-perishable food and bottled water; government funding of £60 million for the first phase of Cyber Shield and £70 million for a center to identify vulnerabilities across critical infrastructure; the British Retail Consortium confirming retailers were working with the NCSC; and the observation that no group had claimed responsibility for attacks following a similar French incident around three weeks earlier. Tabloid source; its NCSC quotations were not corroborated elsewhere in this edition's retrieval and are attributed to this outlet.