Supermarket cyberattacks that left freezers running hot across at least ten European countries have moved from a retail headache to a test of how the European Union polices connected equipment. Members of the European Parliament were scheduled to debate cyber resilience and the protection of critical infrastructure and supply chains in plenary on 11 November 2026, with the refrigeration incidents framing the discussion.
The scale of the supermarket cyberattacks is hard to dismiss. French Finance Minister Roland Lescure told national lawmakers on 28 October that roughly 700 of the country’s 10,000 supermarkets had been affected, warning that the attack touched the heart of food security. Groupement Mousquetaires reported problems at 300 Intermarché and Netto stores, while Coopérative U counted 80 of its 2,000 outlets.
A second wave followed on 2 November. Delhaize reported an IT incident across dozens of Belgian shops, Carrefour saw refrigeration failures at about 15 of its 700 Belgian locations, and the Colruyt group counted five affected stores. Coop in Sweden lost cooling at seven of 800 shops, and Musgrave flagged problems in 13 SuperValu stores in Ireland. One Belgian butcher reported meat worth around €15,000 ruined after a fridge was pushed to 18 degrees Celsius.
The technique behind the supermarket cyberattacks was crude rather than sophisticated. Attackers forced continuous defrost cycles and set target temperatures as high as 50 degrees Celsius, according to French media reports. The French cybersecurity agency ANSSI said it was aware of numerous compromises involving remote-control modules made by Danfoss and Copeland, and both vendors said the affected units were older, end-of-life products that no longer receive security updates.
That detail matters for the policy debate. Security firm Claroty had warned in August that controllers on the Danfoss AK-SM 800A and Copeland XWeb Pro platforms were reachable from the public internet. Researchers interviewed by The Parliament Magazine and Al Jazeera pointed to guessable default passwords, missing multi-factor authentication and remote management by third-party contractors, not to advanced tooling.
The Cyber Resilience Act is the obvious reference point. It will require manufacturers of connected products to ship secure defaults and handle vulnerabilities over a defined support period, but its main obligations only apply from December 2027, and it does little for equipment already installed in thousands of stores. The NIS2 Directive covers larger food distribution companies, yet enforcement still depends on national authorities, several of which transposed the rules late.
Attribution for the supermarket cyberattacks remains contested. No group has claimed responsibility, Belgian prosecutors opened a criminal investigation on 2 November, and the Paris prosecutor’s cybercrime unit is examining the French incidents, including fires and spoiled stock. CNBC reported on 10 November that France was blaming Iran and weighing sanctions, a step that would bring the file into the EU’s cyber sanctions framework.
Agriculture Commissioner Christophe Hansen has called the supermarket cyberattacks a deliberate attempt to disrupt the food supply, while stressing that food security itself is not currently at risk. The real costs so far are food waste, emergency repairs and lost trading, but the episode shows how a cheap intrusion into building-management systems can ripple across the single market.
For lawmakers, the lesson of the supermarket cyberattacks is less about new legislation than about closing the gap between rules on paper and devices in the field. Mandatory replacement or isolation of unsupported controllers, faster NIS2 audits of retail chains and coordinated vulnerability disclosure through ENISA would do more in the short term than another strategy document.
