Cyber Watch · Preparedness · November 9, 2026
Overnight on October 11, hackers took control of the computers that run supermarket refrigeration in France and switched fridges and freezers into heating and defrost mode. By morning, stores were throwing out their fresh and frozen food. Three weeks later a second wave hit stores in seven more European countries, and a French blood bank had to rescue its supplies. On Monday, France formally blamed a cyber unit of Iran’s Revolutionary Guards. U.S. agencies say the same kind of equipment is used across America.
- France (October 11): France’s national cybersecurity agency, ANSSI, says Iranian military hackers took over refrigeration controllers at around 700 retail sites, from supermarkets to butcher shops.[11]
- Europe (November 1–2): stores in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland were hit, with some freezers reportedly reaching 50°C (122°F).[3]
- United Kingdom: some meat suppliers and a London produce wholesaler were affected. The UK’s National Cyber Security Centre called the national impact “minimal.”[4]
- United States: at least six military commissaries saw freezers fail in late August. Reuters reported that the Pentagon is treating it as a suspected hack.[9] On November 5, CISA, the FBI, HHS, USDA and the Department of Transportation warned all cold-storage operators.[5]
- What you can do: the steps that protect your food at home are the same ones you would use in a power outage. They’re below, along with a printable PDF checklist.
The Story So Far
We have covered attacks on the systems that keep daily life running before, including water-system cyberattacks reported in 12 states (September 9), where Iran was also the main suspect. This time the target was the cold chain: the refrigerators and freezers that keep food and medicine safe between the farm and the table. They are run by small computers called controllers. Owners and repair companies can reach many of them over the internet, so a technician can check temperatures without driving to the store. That convenience is the opening the attackers used.
1. France: Hundreds of Stores in One Night
The retailers told AFP that at least 300 Intermarché and Netto shops were targeted, along with more than 100 Coopérative U stores and several E.Leclerc stores. Carrefour told Reuters that 80 of its supermarkets were attacked.[1] Paris prosecutors opened an investigation and said the attack had also sparked fires. Intermarché said affected stores would have to throw away all of their fresh and frozen products.[1]
The Danish manufacturer Danfoss told AFP that most of the affected equipment was “legacy” products that “no longer receive software or security updates,” naming its AK-SM800 and AK-SC355 systems.[1] In other words, many of the hacked controllers were old units that had stopped getting security fixes and were still connected to the internet.
2. The Second Wave: Seven More Countries
On November 1 and 2, the BBC reported, around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, along with smaller numbers of shops in Sweden, Ireland, the Netherlands, Estonia and Finland.[3] The reported damage:
- Belgium: 15 Carrefour stores, five Spar shops and the Ikea store in Mons. One Delhaize branch in Hoeilaart said it lost €100,000 worth of produce.[3]
- Sweden: several ICA stores and 7 of Coop’s 800 stores. One ICA branch in Sjöbo posted that its fridges and freezers were set to 50 degrees overnight.[3]
- Ireland: 13 SuperValu supermarkets.[3]
- The Netherlands: Danfoss told Dutch public radio that systems were attacked at 17 or more companies, mostly butchers’ shops and small neighborhood stores.[3]
- Finland and Estonia: some K-stores in Finland and a Selver supermarket in Estonia.[3]
The European Commission, ENISA (the EU’s cybersecurity agency), Europol’s cybercrime centre and the network of national cyber response teams issued a joint statement on November 4. They said refrigeration systems had been hit in several EU member states “since 11 October 2026.”[2]
“Given the large-scale nature of these incidents, cooperation, rapid information-sharing and coordinated response at European level is essential.”
European Commission and ENISA joint statement, November 4, 2026[2]
Belgium’s Centre for Cybersecurity (CCB) published warnings after both waves telling owners of remote refrigeration controllers to patch immediately.[18]
3. The UK: Meat Suppliers and a Produce Wholesaler
No UK grocery chain has been hit directly, The Guardian reported, but the British Association of Independent Meat Suppliers said some of its members were affected. One supplier saw its cold units rise as high as 100°C; the units were empty at the time.[4] A London fruit and vegetable wholesaler, Langridge Organic, found its units reset to defrost and stopped the attack by unplugging its cold storage from the internet. Its managing director, Alex Pearce, said: “the simple solution was to unplug ourselves from the internet.”[4]
Paul Chichester of the NCSC said the attacks were not AI-enabled and used weaknesses that had been “out there for a long period of time.”[4]
4. Blood, Medicine and U.S. Military Bases
On November 3, the French Blood Establishment (EFS) confirmed that a cyber incident at one of its refrigeration equipment suppliers had changed temperature and defrost settings at three sites that store blood products.[8][19] NPR reported that staff caught the activity in time to save the blood.[7] The health sector’s information-sharing group, Health ISAC, sent its members an alert.
“This incident underscores a stark operational reality: cybersecurity in healthcare is fundamentally about patient safety,”
Errol Weiss, chief security officer, Health ISAC, to NPR[7]
In the United States, freezers failed at six or more military commissaries in late August, according to a Reuters review of the bases’ posts. At Fort Huachuca, Arizona, the base said its freezer went into defrost mode and “heated up all the food.”[9] Reuters reported on October 29, citing four officials, that the Pentagon is treating the failures as a suspected hack.[9] The Pentagon has not said publicly that it was a cyberattack.[12]
On November 5, CISA, the FBI, HHS, USDA and the Department of Transportation published a joint fact sheet. It says attackers are going after unpatched or internet-connected temperature controllers in grocery stores and cold storage. They can force units into “continuous heating and defrost cycles,” causing inventory loss, fire hazards, and harm to consumers who eat food that was stored unsafely.[5]
“Every organization that depends on refrigeration and monitoring systems should assume it could be a target.”
Chris Butera, CISA Acting Executive Assistant Director for Cybersecurity[6]
5. France Blames Iran
On Monday, November 9, France accused Iran’s Islamic Revolutionary Guard Corps (IRGC) of the October attacks. ANSSI said the hackers also targeted several small hydroelectric power plants, with “moderate effects.”[10][11] It tied the attacks to the hackers’ digital infrastructure, links to a propaganda outlet, and “traces” of the Farsi language.[11] The Paris prosecutor named the unit as Shahid Kaveh and is requesting international arrest warrants.[11][12]
“marks the first large-scale cyberattack aimed at sabotage on our national territory, and it constitutes a major attack on the nation’s interests and the security of the French people.”
French Foreign Minister Jean-Noël Barrot, via NPR[11]
France summoned Iran’s ambassador. Barrot said those responsible would face sanctions.[12]
What’s Disputed or Unconfirmed
- Who carried out the November wave. France’s attribution covers the October attacks in France. The BBC reported that it is not known whether the later attacks are linked.[12]
- Competing claims. Two pro-Russian groups, NoName057(16) and Z-Pentest Alliance, claimed responsibility for the attacks across Europe.[7] The BBC reported that “few believed them.”[12] Researchers at the firm Lupovis told The Guardian that attacks on their decoy fridge controls looked similar to Russia-linked operations.[4]
- Iran’s response. Iran has not responded officially. The BBC reported that some Iranian media called the accusation baseless.[12]
- U.S. bases. The Pentagon has not confirmed that the August failures were cyberattacks, and has not named a culprit.[11]
- Totals. Counts differ by source and date: CBS/AFP reported at least 400 French stores on day one, and ANSSI now says around 700 sites. The total cost has not been published.
How to Verify
- Read the U.S. joint fact sheet, which lists the exact steps for equipment owners, on cisa.gov.[5]
- Read the EU joint statement on enisa.europa.eu.[2]
- France’s attribution is on ANSSI’s site, cyber.gouv.fr (in French). Your browser can translate it.[10]
- Check whether your country has issued its own warning. Belgium’s technical warnings are on ccb.belgium.be.[18]
What You Can Do Right Now
Your home fridge was not the target here. The risk for most families is in the supply chain: stores emptying their freezer aisles, or a corner store or food pantry losing its stock. A fridge that stops cooling because of a hack is handled the same way as one that stops in a power outage. U.S. and UK food-safety agencies agree on the basic timings.
The refrigerator will keep food cold for about four hours. A full freezer will keep the temperature for about 48 hours.
FEMA, Power Outages guidance[15]
At home
- Put a thermometer in the fridge and the freezer. FEMA says to throw out food if the temperature reaches 40°F or higher.[15] The UK Food Standards Agency allows fridges up to 8°C during a power cut. At 8°C or above, chilled food should be eaten or thrown away within 4 hours.[16]
- Keep the doors shut. A full freezer holds about 48 hours, or about 24 hours if half full.[16]
- Eat in the right order. First food that needs refrigeration, then defrosted frozen food that doesn’t need cooking, then room-temperature perishables, and canned and dried food last.[16]
- Keep a backup supply. Keep nonperishable food, water and coolers on hand. Ask your doctor or pharmacist how long your refrigerated medicines can stay out of the fridge.[15]
- Cook safely. Generators, camp stoves and grills go outdoors only, at least 20 feet from windows. Never heat your home with a gas stove.[15]
- Got a smart fridge? The UK’s NCSC says to change default passwords and install updates on connected household devices, fridges included.[17]
If you run a store, restaurant, church kitchen or food pantry
- Ask your refrigeration contractor whether your controllers can be reached from the internet. If they can, take them off it, or put remote access behind an updated firewall.[5]
- Change default passwords, use strong ones, and turn on multifactor authentication where you can.[5]
- Update the firmware. Replace controllers the manufacturer no longer supports.[5]
- Set safe temperature limits on the equipment and turn on alerts for anything outside them.[5]
- Report suspicious activity to the FBI. The FBI’s Brett Leatherman asked organizations to “report any suspicious activity to the FBI.”[6] In the EU, report significant incidents to your national CSIRT (the national cyber response team).[2]
Download the printable checklist (PDF): home food safety, cooking without power, and cold-storage security for small businesses, with every item sourced.
Kemetic Minds Analysis
Most of the hacked controllers were old, unpatched and left online so a technician could check them from far away. In the Netherlands, the victims were mostly butchers and small neighborhood stores. Those are the businesses least likely to have an IT department, and the ones many of our communities rely on when the nearest big supermarket is miles away. Guarding against this costs little: a firewall, a changed password, a thermometer, and knowing what to throw out and when. Langridge Organic in London stopped an attack in progress by pulling a plug. The bigger lesson is that food security now includes cybersecurity, starting with the store on your block.
References
- CBS News. (2026, October 12). Hackers turn up the heat in refrigerators at hundreds of supermarkets in France, sparking fires and food losses. cbsnews.com — secondary source (with AFP). ↩
- European Union Agency for Cybersecurity (ENISA) and European Commission. (2026, November 4). Joint statement on cyber incidents in refrigeration systems across the EU. enisa.europa.eu — primary source (official statement). ↩
- BBC News. (2026, November 2). Shop freezers in seven European countries hit by cyber-attack. bbc.com — secondary source. ↩
- The Guardian. (2026, November 3). Food suppliers in UK hit by cyber-attacks after freezers targeted in Europe. theguardian.com — secondary source. ↩
- CISA, FBI, HHS, USDA and DOT. (2026, November 5). US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems (joint fact sheet). cisa.gov — primary source (government advisory). ↩
- CISA. (2026, November 5). CISA, FBI, HHS, USDA, and DOT Urge Critical Infrastructure To Strengthen Industrial Refrigeration and Cold Chain Monitoring Systems Cybersecurity. cisa.gov — primary source (press release). ↩
- NPR. (2026, November 6). Health intel-sharing group warns industry in wake of cyberattack on French blood bank. npr.org — secondary source. ↩
- Établissement français du sang (EFS). (2026, November 3). L’EFS confirme l’incident de cybersécurité impactant un de ses prestataires d’équipement frigorifique. efs.sante.fr — primary source (press release, in French). ↩
- Reuters, via Military Times. (2026, October 29). Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say. militarytimes.com — secondary source. ↩
- Agence nationale de la sécurité des systèmes d’information (ANSSI). (2026, November 9). Campagnes de déstabilisation et sabotage menées à l’encontre des intérêts français par la République islamique d’Iran. cyber.gouv.fr — primary source (government statement, in French). ↩
- NPR. (2026, November 9). France accuses Iran of cyber ‘sabotage’ in fridge attacks. npr.org — secondary source. ↩
- BBC News. (2026, November 9). France accuses Iran of supermarket fridge hacking. bbc.com — secondary source. ↩
- FRANCE 24 English. (2026, November 9). France blames Iran for cyberattack on supermarket fridges. youtube.com — secondary source (news video). ↩
- BBC News. (2026, November 4). Why are fridges being hacked around the world? youtube.com — secondary source (news video). ↩
- Federal Emergency Management Agency (FEMA). Power Outages. FEMA — primary source (government guidance). ↩
- UK Food Standards Agency. (2023, July 26). Food safety in a power cut: advice for consumers. gov.uk — primary source (government guidance). ↩
- UK National Cyber Security Centre. Smart devices: using them safely in your home. ncsc.gov.uk — primary source (government guidance). ↩
- Centre for Cybersecurity Belgium (CCB). (2026, November). Warning: Update: Security Incidents Across Europe Targeting Remote Controllers of Refrigeration Installations. ccb.belgium.be — primary source (government advisory). ↩
- BleepingComputer. (2026, November 6). FBI, CISA warn of cyberattacks targeting refrigeration systems. bleepingcomputer.com — secondary source. ↩
Related Reading
- Water Cyberattacks Reported in 12 States; Iran Is Prime Suspect
- The Real Prepper’s Budget Guide: Surviving No Power, No Water, No Gas
- Nine Substations Could Black Out US for 18 Months; UK Plant Hacked
Methodology: every fact above comes from the numbered sources, and quotes are copied word for word from the pages cited. Government statements and guidance are labelled primary sources. Two French government pages (ANSSI and EFS) block automated readers, so details from them are attributed to the NPR and BleepingComputer reports that quote them, and the originals are linked for readers. Images are public domain (USDA, U.S. Air Force, and CC0 photos via Wikimedia Commons), and the videos are the publishers’ own uploads. This piece was researched and written in an editor-supervised session, not by an automated pipeline.
Kemetic Minds Editorial Desk
Verified NewsroomPrimary-sourced investigative intelligence on civil rights, voting rights, federal policy, and consumer protection. Sourced from primary legal filings, government statistics, and direct field reporting.