{"version":"1.9","identifier":"d71264c2-2e30-4451-b3db-8ef9349a5686","language":"en-US","title":"Supermarket freezers hacked in a second European wave as governments split on who is behind it","layout":{"columns":7,"width":1024,"margin":32,"gutter":20},"componentLayouts":{"text":{"columnStart":0,"columnSpan":7,"maximumContentWidth":720,"margin":{"top":12,"bottom":12}},"photo":{"columnStart":0,"columnSpan":7,"margin":{"top":20,"bottom":20}}},"componentTextStyles":{"default":{"fontName":"HelveticaNeue","fontSize":18,"lineHeight":29,"textColor":"#171717"},"headline":{"fontName":"HelveticaNeue-Bold","fontSize":36,"lineHeight":42,"conditional":[{"conditions":{"maxViewportWidth":480},"fontSize":28,"lineHeight":34}]},"intro":{"fontName":"HelveticaNeue","fontSize":20,"lineHeight":28,"textColor":"#555555"},"caption":{"fontName":"HelveticaNeue","fontSize":13,"lineHeight":19,"textColor":"#666666"},"byline":{"fontName":"HelveticaNeue","fontSize":13,"lineHeight":20,"textColor":"#666666"},"body":{"fontName":"HelveticaNeue","fontSize":18,"lineHeight":29,"paragraphSpacingAfter":14,"linkStyle":{"textColor":"#00704a"}}},"metadata":{"canonicalURL":"https://567politics.com/news/europe-supermarket-refrigeration-cyberattacks-second-wave-november-2026","datePublished":"2026-11-04T04:08:03.693516Z","dateModified":"2026-11-04T04:10:32.794624Z","authors":["Patrick Karsh"],"excerpt":"Stores in Sweden, Belgium, Luxembourg, Ireland and Estonia dumped food after controllers were set to 50°C on November 2, three weeks after about 700 French supermarkets were hit. No claim, no ransom, and no public evidence yet of a state actor.","thumbnailURL":"https://pub-fac99da959e344fe99d810d309cef7df.r2.dev/photos/article/d71264c2-2e30-4451-b3db-8ef9349a5686/91057b590dcf98a19425958c1a828eed.jpg","keywords":["world"],"generatorName":"Frog News","generatorVersion":"1.0"},"components":[{"role":"title","text":"Supermarket freezers hacked in a second European wave as governments split on who is behind it","textStyle":"headline","layout":"text"},{"role":"intro","text":"Stores in Sweden, Belgium, Luxembourg, Ireland and Estonia dumped food after controllers were set to 50°C on November 2, three weeks after about 700 French supermarkets were hit. No claim, no ransom, and no public evidence yet of a state actor.","textStyle":"intro","layout":"text"},{"role":"byline","text":"By Patrick Karsh · Published November 4, 2026","textStyle":"byline","layout":"text"},{"role":"photo","URL":"https://pub-fac99da959e344fe99d810d309cef7df.r2.dev/photos/article/d71264c2-2e30-4451-b3db-8ef9349a5686/91057b590dcf98a19425958c1a828eed.jpg","caption":"An ICA Kvantum supermarket in Kiruna, Sweden, in 2017; ICA stores were among those hit on November 2, 2026 · Arild Vågen via Wikimedia Commons, CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/)","accessibilityCaption":"An ICA Kvantum supermarket in Kiruna, Sweden, in 2017; ICA stores were among those hit on November 2, 2026","layout":"photo"},{"role":"caption","text":"An ICA Kvantum supermarket in Kiruna, Sweden, in 2017; ICA stores were among those hit on November 2, 2026 · Arild Vågen via Wikimedia Commons, CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/)","textStyle":"caption","layout":"text"},{"role":"body","format":"markdown","text":"Supermarket fridges and freezers in at least five European countries were switched into heating mode overnight into Monday, November 2, 2026. Stores in Sweden, Belgium, Luxembourg, Ireland and Estonia threw out chilled and frozen food. By Tuesday, reports had reached Germany, Italy, Portugal, the Netherlands and Finland. The method matched the attack on roughly 700 French supermarkets three weeks earlier. No group has claimed either wave. No ransom demand has been reported. Investigators in several capitals say they do not yet know who did it.\n\nThe politics is moving faster than the forensics. The European Commission calls the incidents \"a deliberate attempt to disrupt\" the food chain. Washington is asking whether freezer failures at US military commissaries in August were the first sign. Yet France's cyber agency, a Romanian cyber chief and several researchers say the attackers used basic weaknesses, not advanced tools, and that there is no evidence yet of a state behind them.\n\n## What happened on November 2\n\nAlarms started in the early hours. A Delhaize store manager in Brussels told RTBF he was woken by alarms on his phone around 3:00 a.m., the same time a Belgian butchery chain's alerts fired ([RTBF](https://www.rtbf.be/article/les-frigos-de-plusieurs-dizaines-de-supermarches-touches-par-un-incident-informatique-11809193)). In Sweden, store owners found freezers reading 50°C or more on Monday morning ([SVT](https://www.svt.se/nyheter/lokalt/smaland/hackerattack-mot-kylar-och-frysar-ica-i-boda-och-morlunda-drabbade)). In Estonia, a Selver store's freezer was set to 50°C but was caught within about ten minutes, and no stock was lost ([ERR](https://www.err.ee/1610183272/kuberrundaja-tostis-selveri-kulmleti-temperatuuri-50-soojakraadini)).\n\nThe companies' own statements, gathered by the Associated Press, TT, Belga, RTÉ and ERR, give the clearest picture.","textStyle":"body","layout":"text"},{"role":"htmltable","html":"<table><tr><th>Country</th><th>Chain</th><th>Stores affected</th><th>Company statement</th></tr><tr><td>Sweden</td><td>ICA</td><td>&quot;a limited number&quot;; 23 per Reuters</td><td>Gustaf Nilsson, ICA: &quot;a limited number of stores have been affected by an incident during the night&quot; (<a href=\"https://www.svt.se/nyheter/lokalt/smaland/hackerattack-mot-kylar-och-frysar-ica-i-boda-och-morlunda-drabbade\">SVT</a>)</td></tr><tr><td>Sweden</td><td>Coop</td><td>6 (Nov 2), 7 (Nov 3)</td><td>Stores back up, refrigeration disconnected from the internet (<a href=\"https://www.investing.com/news/stock-market-news/european-supermarkets-rush-to-patch-vulnerabilities-after-regionwide-fridge-hack-4995896\">Reuters via Investing.com</a>)</td></tr><tr><td>Belgium/Luxembourg</td><td>Delhaize</td><td>&quot;several dozen&quot;; about 40 in Belgium, 4 in Luxembourg</td><td>Sarah De Meester: fresh and frozen range &quot;temporarily somewhat limited&quot; (<a href=\"https://abcnews.com/International/wireStory/freezers-supermarkets-european-countries-hit-apparent-cyberattacks-137765494\">AP via ABC News</a>)</td></tr><tr><td>Belgium</td><td>Carrefour</td><td>15 of 700+</td><td>Impact &quot;extremely limited&quot;; Mich Vergauwen: &quot;It's a cyberattack, there is no other reason&quot; (<a href=\"https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers\">Euronews</a>)</td></tr><tr><td>Belgium</td><td>Spar (Colruyt)</td><td>5</td><td>Fridge systems attacked at five franchise shops (<a href=\"https://www.aljazeera.com/news/2026/11/2/freezers-in-sweden-belgium-overheat-following-possible-cyberattacks\">Al Jazeera/Reuters</a>)</td></tr><tr><td>Ireland</td><td>SuperValu (Musgrave)</td><td>13 of 223</td><td>&quot;fully resolved&quot; by Monday afternoon; &quot;limited to a specific model of refrigeration&quot; (<a href=\"https://www.rte.ie/news/business/2026/1102/1597612-13-supervalu-stores-hit-by-suspected-cyber-attack/\">RTÉ</a>)</td></tr><tr><td>Estonia</td><td>Selver (via Kitman Coldtech)</td><td>1</td><td>Jann Mutso: &quot;The signature is the same&quot; (<a href=\"https://www.err.ee/1610183272/kuberrundaja-tostis-selveri-kulmleti-temperatuuri-50-soojakraadini\">ERR</a>)</td></tr></table>","layout":"text"},{"role":"body","format":"markdown","text":"The counts are the companies' own and were still moving on Tuesday. Edeka confirmed one hacked store in Germany, Mosqueteiros seven Intermarché stores in Portugal, and a Coop group in Sicily at least four ([The Hacker News](https://thehackernews.com/2026/11/second-wave-of-cyberattacks-hits.html)). A Danfoss spokesperson told Dutch broadcaster NOS that at least 17 Dutch businesses, mainly butchers and small grocers, were hit ([NL Times](https://nltimes.nl/2026/11/02/fridges-freezers-17-dutch-businesses-attacked-large-supermarkets-unaffected)). Axfood said a delivery warehouse near Gothenburg discarded food worth about SEK 3 million ([SVT](https://www.svt.se/nyheter/inrikes/bohlin-om-hackerattacken-alla-maste-agera-skyndsamt)).\n\n## How the attack works\n\nEvery account from France, Belgium, Sweden and Estonia describes the same mechanism. Store refrigeration is run by a supervisory controller, often made by the Danish firm Danfoss, that maintenance contractors reach over the internet. The attackers logged in and switched the evaporators into a long defrost cycle, or set the target temperature to 50°C. Stephan Moelans, head of the Belgian installer Sabcobel, which looks after Delhaize's systems, told Belga the units \"were switched to defrost mode.\" He said a software update alone is not enough, because physical changes to the installations are needed ([Euronews](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers)).\n\nDanfoss says the problem lies with old or unpatched equipment. In October it named the AK-SM 800, out of support since May 2021, and the AK-SC 355, phased out in 2016, as the units most affected. It said it had \"long advised customers to keep supported systems updated with the latest firmware\" ([AP via KSAT](https://www.ksat.com/business/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says/)). On Monday a Danfoss spokesperson told NOS the Dutch systems hit were not on a secure network and \"were still using default passwords\" ([NL Times](https://nltimes.nl/2026/11/02/fridges-freezers-17-dutch-businesses-attacked-large-supermarkets-unaffected)). Danfoss advisory DSA-2025-03-01, dated March 24, 2025, covers an authentication flaw (CVE-2025-41450) in the newer AK-SM 8xxA series, fixed in version 4.2 ([Danfoss](https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-03-01/)). The US agency CISA republished it on May 20, 2025, with a CVSS v3.1 score of 8.2 and advice to keep such devices off the internet ([CISA](https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03)).\n\nWhether that flaw was even needed is disputed. ANSSI director Vincent Strubel told a French Senate committee on October 21 that \"défauts de sécurisation élémentaires\" (basic security failures) enabled the French attack. Equipment was exposed directly to the internet and run without special protection, he said, and he set aside outside analyses that blamed the published vulnerabilities ([Public Sénat](https://www.publicsenat.fr/actualites/politique/des-defauts-de-securisation-elementaire-et-des-mots-de-passe-faibles-ont-permis-la-cyberattaque-contre-les-frigos-de-supermarches)). British researcher Kevin Beaumont wrote on October 12 that on several thousand internet-facing Danfoss units \"The username is admin and the password changes every day automatically to.. the current date,\" and that changing the temperature was \"easily scriptable\" ([Mastodon post](https://cyberplace.social/@GossiTheDog/117429502412235079)). That is one researcher's account; 567politics has not tested it.\n\nThe exposure can be measured. Forescout queried Shodan on October 22 and found 12,976 refrigeration-control services on 6,017 public IP addresses in 99 countries. Of those, 4,697 were Danfoss StoreView interfaces, and 80 percent of them ran firmware older than the patched 4.3.1 release ([Forescout](https://www.forescout.com/blog/cold-chain-open-control-exposed-refrigeration-systems-reveal-global-risk/)). Censys tracked what happened in France after the first attack.\n\n**Internet-exposed Danfoss StoreView hosts in France after the October attack**\n\nHosts reachable from the public internet, by scan date, per Censys","textStyle":"body","layout":"text"},{"role":"htmltable","html":"<table><tr><th>Date</th><th>Exposed hosts</th></tr><tr><td>Oct 11</td><td>1,825</td></tr><tr><td>Oct 12</td><td>1,781</td></tr><tr><td>Oct 14</td><td>537</td></tr></table>","layout":"text"},{"role":"body","format":"markdown","text":"Source: [Infosecurity Magazine, citing Censys](https://www.infosecurity-magazine.com/news/france-expose-danfoss-controllers/)\n\nFrance went from 1,825 exposed hosts to 537 in three days, a 71 percent drop. Exposure outside France fell far less over the same period, from 1,166 to 966 ([Infosecurity Magazine](https://www.infosecurity-magazine.com/news/france-expose-danfoss-controllers/)). That gap helps explain why the second wave landed outside France.\n\n## The French precedent\n\nThe first wave hit on the night of October 11–12. CERT-FR, the response arm of ANSSI, published alert CERTFR-2026-ALE-012 on October 12. It said it was \"aware of numerous compromises\" of remote refrigeration controllers, and later added Copeland and Dixell XWEB devices to the Danfoss AK-SC and AK-SM series ([CERT-FR](https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012)). Finance Minister Roland Lescure told Parliament on October 13 that about 700 of France's 10,000 supermarkets were affected and called it \"a wake-up call for everyone\" ([AP via KSAT](https://www.ksat.com/business/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says/)). Les Mousquetaires put Intermarché and Netto's share at about 300 stores; Coopérative U said 80 of its 2,000; Carrefour said 80 franchised stores ([The Hacker News](https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html)). Lescure is the same minister now steering a contested 2027 budget, which 567politics covered in [its report on the postponed revenue vote](https://567politics.com/news/france-assembly-budget-2027-revenue-vote-november-3-lescure-49-3-november-2026).\n\nThe Paris prosecutor's cybercrime section opened an inquiry, assigned to the anti-cybercrime office OFAC, covering spoiled food and equipment that began to catch fire ([The Hacker News](https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html)). Thierry Cotillard of Les Mousquetaires told BFMTV he expected losses in the tens of millions of euros nationwide. No official total has been published. 567politics found no report of an arrest in France as of November 3.\n\n**From the French attack to the second European wave**\n\n* **2025-03-24**: Danfoss publishes advisory DSA-2025-03-01 for the AK-SM 8xxA authentication flaw\n* **2025-05-20**: CISA republishes the flaw as an industrial-control advisory\n* **2026-08-26**: Fort Huachuca, Arizona, says a commissary freezer \"went into defrost mode\"\n* **2026-10-12**: Overnight attack on about 700 French supermarkets; CERT-FR issues alert\n* **2026-10-13**: Lescure tells Parliament about 700 of 10,000 supermarkets were hit\n* **2026-10-21**: ANSSI chief Strubel tells senators \"basic security failures\" enabled the attack\n* **2026-10-29**: Reuters reports the Pentagon treats August freezer failures as a suspected hack\n* **2026-11-02**: Second wave hits Sweden, Belgium, Luxembourg, Ireland, Estonia and the Netherlands\n* **2026-11-03**: Reports from Germany, Italy, Portugal and Romania; Commission says \"not isolated incidents\"\n\nSource: [CERT-FR](https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012), [Reuters via CP24](https://www.cp24.com/news/world/2026/10/29/pentagon-treating-military-base-freezer-malfunctions-as-suspected-cyberattack-officials-say/), [Euronews](https://www.euronews.com/2026/11/03/italy-holds-emergency-talks-as-supermarket-fridge-attacks-spread-across-europe)\n\n## How governments are responding\n\n**Sweden.** Minister for Civil Defense Carl-Oskar Bohlin said the events \"once again show how important it is for all organizations to review their cybersecurity and IT systems.\" He added that \"the worsened security situation and rapid technological development mean everyone must act quickly\" ([SVT](https://www.svt.se/nyheter/inrikes/bohlin-om-hackerattacken-alla-maste-agera-skyndsamt)). John Billow, head of Sweden's National Cybersecurity Center, told Reuters the center was handling several incidents and that \"we have quite a lot of exposed operational technology devices in Sweden\" ([Al Jazeera/Reuters](https://www.aljazeera.com/news/2026/11/2/freezers-in-sweden-belgium-overheat-following-possible-cyberattacks)). Police in southern Sweden are coordinating a national investigation. In April, the same two men disclosed that an actor \"with ties to Russian intelligence and security services\" had tried to disrupt a Swedish heating plant in 2025 ([Euronews](https://www.euronews.com/2026/04/15/sweden-foiled-pro-russian-cyberattack-on-thermal-power-plant-in-2025-minister-says)). Bohlin now speaks for a government in limbo: the Riksdag [rejected a new prime minister on Tuesday](https://567politics.com/news/sweden-riksdag-rejects-thand-ringqvist-prime-minister-vote-november-2026), leaving Ulf Kristersson's cabinet in caretaker mode.\n\n**Belgium and Luxembourg.** Interior Minister Bernard Quintin said there was \"aucun problème général d'approvisionnement\" (no general supply problem) ([RTBF](https://www.rtbf.be/article/les-frigos-de-plusieurs-dizaines-de-supermarches-touches-par-un-incident-informatique-11809193)). The federal prosecutor opened a criminal investigation. Katrien Eggers of the Center for Cybersecurity Belgium told Euronews: \"There are no reports yet as to who was behind the attack... and it may never be possible to identify them\" ([Euronews](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers)). The response falls to a federal government whose prime minister [offered its resignation over the budget](https://567politics.com/news/belgium-de-wever-offers-resignation-budget-talks-fail-november-2026) days earlier. In Luxembourg, Delhaize said four stores were hit; no government statement had been published by Tuesday ([Paperjam](https://paperjam.lu/article/la-cyberattaque-sur-les-frigos-touche-aussi-le-luxembourg)).\n\n**Ireland.** Justice Minister Jim O'Callaghan was briefed and the National Cyber Security Center monitored the incident ([RTÉ](https://www.rte.ie/news/business/2026/1102/1597612-13-supervalu-stores-hit-by-suspected-cyber-attack/)). Taoiseach Micheál Martin said on Tuesday: \"There are ongoing attacks almost on a weekly, daily basis from hacktivists,\" and that \"it is becoming far more concerning and even more dangerous than ever before\" ([Irish Times](https://www.irishtimes.com/politics/2026/11/03/almost-daily-cyberattacks-are-very-very-worrying-warns-taoiseach/)). He named no state. He spoke on his way into the Cabinet meeting at which he was [pressing his island-futures study](https://567politics.com/news/ireland-martin-futures-study-initiative-constitutional-future-island-november-2026).\n\n**Estonia.** Mai Kraft, head of the cyber security center at the Information System Authority (RIA), told ERR that \"what the motives of these attacks are is unknown at the moment.\" RIA had received one notification, from Selver, and had found fewer than ten exposed refrigeration controllers in Estonia, against more than 30,000 vulnerable internet-connected devices of all kinds ([ERR](https://www.err.ee/1610183710/kraft-millised-on-runnakute-motiivid-pole-praegu-teada)).\n\n**European Union.** Agriculture Commissioner Christophe Hansen said: \"These are a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it,\" while stressing that \"food security is not currently at risk\" ([The Next Web](https://thenextweb.com/news/eu-commission-probe-supermarket-fridge-hacks); [Eunews](https://www.eunews.it/en/2026/11/02/hacker-attacks-on-eu-supermarkets-hansen-says-an-attempt-to-disrupt-the-food-supply/)). Commission spokesperson Thomas Regnier said on Tuesday, \"These are not isolated incidents\" ([Euronews](https://www.euronews.com/2026/11/03/italy-holds-emergency-talks-as-supermarket-fridge-attacks-spread-across-europe)). ENISA said the attacks underscored \"the importance of European cooperation, rapid information-sharing and coordinated responses to cyber incidents\" ([Reuters via Investing.com](https://www.investing.com/news/stock-market-news/european-supermarkets-rush-to-patch-vulnerabilities-after-regionwide-fridge-hack-4995896)). 567politics found no Europol statement by Tuesday evening. Italy's ministers met intelligence chiefs on Tuesday and called the domestic impact \"highly limited\" ([Euronews](https://www.euronews.com/2026/11/03/italy-holds-emergency-talks-as-supermarket-fridge-attacks-spread-across-europe)). The incidents land as EU leaders head into a summit where Kaja Kallas has been [urging a \"step by step\" path to closer security ties](https://567politics.com/news/uk-germany-military-ai-streeting-pistorius-kallas-eu-summit-november-2026).\n\n**United Kingdom.** Richard Horne, head of the UK's National Cyber Security Center, said attackers had also tried small meat-processing firms and that \"We're obviously on heightened alert\" ([Reuters via Investing.com](https://www.investing.com/news/stock-market-news/european-supermarkets-rush-to-patch-vulnerabilities-after-regionwide-fridge-hack-4995896)).\n\n## The attribution debate\n\nThe gap between what officials suspect and what they can show is wide, and most say so.\n\nThe case for a state-linked campaign rests on context, not evidence from these incidents. Reuters notes that European governments have blamed Moscow for a growing list of infrastructure incidents, and that Russia has repeatedly denied involvement in sabotage or hybrid warfare ([Al Jazeera/Reuters](https://www.aljazeera.com/news/2026/11/2/freezers-in-sweden-belgium-overheat-following-possible-cyberattacks)). SentinelOne's Tom Hegel wrote on Tuesday that \"Russian-aligned groups are credible suspects, but attribution remains open.\" He cited the record of groups such as CARR and Z-Pentest against exposed industrial controls, but stated that \"Responsibility for the European incidents has not been publicly established\" and listed copycats, ideological operators and financially motivated intruders as alternatives ([SentinelOne](https://www.sentinelone.com/labs/defrost-and-disrupt-an-assessment-of-europe-s-refrigeration-attacks/)). Germany's spyware warning to Bundestag members last week, [covered here](https://567politics.com/news/germany-bundestag-iphones-spyware-bsi-apple-warning-november-2026), shows how quickly European governments now reach for a hostile-state frame, and how rarely they publish the evidence.\n\nThe case against naming a state comes mostly from the technical agencies. Dan Cimpean of Romania's National Cyber Security Directorate called the attack \"semi-amateurish\" and said there was no suspicion of a state actor ([Euronews](https://www.euronews.com/2026/11/03/italy-holds-emergency-talks-as-supermarket-fridge-attacks-spread-across-europe)). Strubel's testimony points the same way. Ken Munro of Pen Test Partners suggested in October the culprits could be \"kids messing around,\" given how easy the exploit was ([coverage summarized on Wikipedia](https://en.wikipedia.org/wiki/2026_French_supermarket_refrigerator_hack)). Awais Rashid of the University of Bristol said the likely motive is disruption with \"societal impacts in terms of security of the food supply chain,\" without naming an actor ([Al Jazeera](https://www.aljazeera.com/news/2026/11/3/very-cold-war-whos-attacking-europes-supermarket-freezers)).\n\nBoth camps lean on pattern. \"Russia has done this before, so Russia did this\" is an inference, not a finding. So is \"the method was crude, so it was not a state.\" Both are premises waiting for evidence.\n\n## The US angle\n\nReuters reported on October 29, citing four officials, that the Pentagon is treating freezer failures at US military bases in August as a suspected hack. At least six commissaries were affected. Fort Huachuca in Arizona wrote on Facebook on August 26 that a freezer \"went into defrost mode where it heated up all the food. Trust us when we say it was 'spoiled.'\" A Cyber Command unit said it was \"working in close coordination with interagency and law enforcement partners,\" and the Army's Criminal Investigation Division said its cyber field office was working with French police ([Reuters via CP24](https://www.cp24.com/news/world/2026/10/29/pentagon-treating-military-base-freezer-malfunctions-as-suspected-cyberattack-officials-say/)). Reuters could not confirm which controller brand the bases used. 567politics found no CISA advisory specific to the October or November incidents; the May 2025 Danfoss advisory remains its latest published guidance on these devices.\n\n## Does food retail count as critical infrastructure?\n\nUnder EU law, mostly not yet. The NIS2 Directive, which member states had to transpose by October 17, 2024, lists \"production, processing and distribution of food\" among its \"other critical sectors.\" But it limits that to food businesses engaged in wholesale distribution and industrial production and processing, and applies in general to firms with at least 50 staff or more than €10 million in turnover ([European Commission](https://digital-strategy.ec.europa.eu/en/policies/nis2-directive); [Finnish Food Authority](https://www.ruokavirasto.fi/en/foodstuffs/food-sector/setting-up-a-food-business/kyberturvallisuusdirektiivi-nis2-elintarviketoimialalla/)). Finland's official guidance states that retail trade is outside the scope. An independent franchise supermarket, the kind hit hardest in Sweden and France, is usually not an NIS2 entity at all.\n\nThe Critical Entities Resilience Directive uses the same food definition. It applied from October 18, 2024, and required each member state to identify its critical entities by July 17, 2026 ([EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2557)). 567politics could not establish whether any member state has designated a grocery retailer under it.\n\nThe Cyber Resilience Act reaches the devices rather than the stores. It entered into force on December 10, 2024. Its vulnerability-reporting duties for manufacturers applied from September 11, 2026, and its main obligations apply from December 11, 2027 ([European Commission](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act)). It does not reach back to a controller sold in 2015 and left online with its default password.\n\n## What people are saying online, and the limits\n\n567politics set out to quote verified public posts from officials, researchers, retail workers and shoppers in the affected countries. Searches on November 3 found candidate posts on X from news aggregators and individual users in Sweden, Germany and elsewhere. But the tool we use to confirm a post's exact wording and timestamp failed for every post attempted, and X's pages could not be opened directly. We therefore quote no X posts here. Reddit was not accessible to us this run. The one social post we could verify is Kevin Beaumont's October 12 Mastodon post quoted above, retrieved from its original server. We found no representative poll on these incidents. Nothing in this article should be read as a measure of public opinion in any country.\n\n## What remains unknown\n\n* Who did it. No claim, no ransom note and no arrests have been reported in any country as of Tuesday evening.\n* Whether the November wave used the same entry path as France. SentinelOne notes that the French assessment pointed to exposed interfaces and weak passwords, and that it is not yet known whether this applies to the November incidents or the US commissaries ([SentinelOne](https://www.sentinelone.com/labs/defrost-and-disrupt-an-assessment-of-europe-s-refrigeration-attacks/)).\n* Whether a shared maintenance contractor was the common link anywhere. Sabcobel said about 20 of the hundreds of units it manages were hit ([Euronews](https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers)); no compromised provider has been confirmed.\n* The total loss. France has a trade estimate; Sweden has one warehouse figure; Belgium has no total.\n* Whether the US commissary failures are connected at all, and what controllers they ran.\n* Whether regulators will move retail refrigeration into the NIS2 or CER scope, and who would pay to replace end-of-life controllers in independent stores.\n\nWhat is established is narrower. Thousands of refrigeration controllers were reachable from the public internet with weak or default credentials, vendors and agencies had warned about it for more than a year, and someone has now used that twice in three weeks.","textStyle":"body","layout":"text"}]}