A butcher in Athens told Greek television that someone had raised the temperature inside his refrigeration unit to 150 degrees Celsius. A Swedish supermarket found its freezers set to 50.
Across France, Belgium, the Netherlands, Sweden, Ireland and Portugal, retailers spent October and November 2026 throwing out food because somebody else was setting the temperature.
No zero-day was involved. The compromised refrigeration controllers were internet-exposed, remotely managed by outside contractors, and running firmware nobody had updated. Attackers switched evaporator units into defrost mode, which heats rather than cools. This was not a sophisticated intrusion. It was a governance failure that became visible because the food spoiled.
What Happened to Europe’s Supermarket Freezers?
Attackers reached the controllers that regulate temperature inside refrigeration units and changed the settings remotely. Defrost mode clears ice buildup. Run continuously, it heats the unit instead of cooling it.
Stores in seven countries reported spoiled stock. In France, some units overheated enough to catch fire. The equipment was ordinary building-management hardware: Danfoss AK-SM and AK-SC controllers, Copeland and Dixell xweb systems. 
Nobody picked a hard target. They picked an unattended one.
Was This a Sophisticated Attack?
No. And the people investigating it have said so plainly.
Three conditions made it possible, none of them a security control. The devices were reachable from the internet. Nobody owned them internally, because refrigeration belongs to facilities while the controller belongs to a vendor. And the vendor’s access had never been assessed as a risk.
An asset you have not inventoried cannot be patched, monitored, or governed. True of a mail server. Just as true of a freezer controller.
Does This Affect Organizations in the United States?
The same equipment is widely deployed in American retail. Researchers at Armis disclosed ten vulnerabilities in Copeland E2 and E3 controllers, named Frostbyte10, which chained together allow privilege escalation and remote code execution. Copeland issued a firmware update.
Whether that update has been applied is the question that matters, and most organizations cannot answer it. The units were never in an inventory to begin with.
Why Does This Matter Outside Retail?
The failure pattern has nothing to do with groceries. Any organization running building management, access control, cameras, or vendor-maintained hardware has the same structure: devices outside IT’s inventory, reachable by a third party, patched by nobody in particular. Hospitals, universities and municipal buildings are full of them.
So, the uncomfortable question for any IT director reading this. How many connected devices sit on your network that nobody in IT provisioned, nobody patches, and some vendor can reach from outside? The number is almost always higher than the inventory says. The refrigerators just made the consequences visible within hours. Most of these failures never do.
Where Should You Start?
Inventory first, because every other control depends on knowing what exists. Every connected device needs a named owner, a documented patch path, and a recorded answer to one question: who outside this organization can reach it, and how?
Then the contracts. Remote management agreements routinely grant standing access with no expiry and no obligation to maintain firmware. Nobody wrote those terms badly on purpose. They were written when a controller was not an attack surface, and never revisited. Our work on cybersecurity controls during Office 365 migration makes the same argument in a different setting: access nobody reviews becomes access nobody controls.
Patch ownership comes third, assigned by name rather than by department.
How Messaging Architects Can Help
We work on the unglamorous side of security: knowing what you have, who can reach it, and what governs it. ePolicy review, third-party access assessment, and the asset documentation insurers and regulators now expect. More sits on the Messaging Architects blog, and our parent company eMazzanti Technologies handles the managed security side.
The refrigerators were never the point. They were just where the failure became impossible to ignore.
