How hackers took control of supermarket fridges across Europe, and what it means for India’s cold chain

Overnight on October 11–12, hackers took control of refrigeration systems at around 700 retail sites in France, including stores run by Carrefour and Intermarché. They turned up the temperature settings used to melt ice off the cooling coils, causing food to spoil and starting at least 15 fires, according to France’s national cybersecurity agency, ANSSI.

A second wave of such attacks followed in early November, affecting stores in eight European countries, including Belgium, Sweden and Ireland, and forcing retailers to throw away large quantities of food. Separately, an attack on a refrigeration equipment supplier affected the systems that monitor and control temperatures at three sites of France’s national blood service. Its alarm systems alerted staff, who moved the blood products before any were lost.

On November 9, France accused Shahid Kaveh, a unit linked to Iran’s Revolutionary Guard Corps (IRGC), of orchestrating the October attacks, a charge Iran has denied. Authorities have not established that the subsequent incidents were carried out by the same group.

Refrigeration keeps food and medical supplies at safe temperatures as they are stored, transported and distributed. That temperature-controlled system is known as the cold chain. Connecting cooling equipment to the internet lets operators check temperatures, spot faults and adjust settings remotely. The attacks showed what can happen when someone else gains access to those controls.

First, how do cold storage systems work?

A cold-storage facility is a large, insulated refrigerator, often divided into rooms maintained at different temperatures depending on what is stored inside. Its insulated walls slow the entry of heat from outside, while refrigeration equipment continuously removes the heat that gets in. This preserves everything from fresh fruits and vegetables to frozen food, vaccines and blood products.

But how does a refrigerator actually cool a room?

It uses a refrigerant, a substance that circulates through pipes and changes between liquid and gas. As it passes through cooling coils inside the storage area, it absorbs heat from the surrounding air. A compressor raises the pressure and temperature of the refrigerant, which then releases heat through a second set of coils outside the cooled space.

Maintaining the required temperature involves constant monitoring. Sensors measure the temperature and send readings to an electronic controller. In industrial facilities, this may be a programmable logic controller (PLC), a rugged industrial computer that sends instructions to equipment such as compressors, fans and pumps.

Story continues below this ad

For instance, when a loading door opens and warmer air enters, the sensors detect the resulting temperature change. The controller can then adjust the cooling equipment to bring the room back to the required temperature. It also manages defrost cycles, during which ice accumulated on the cooling coils is periodically melted. Without this process, ice can obstruct airflow and reduce cooling efficiency.

So, why connect refrigerators to the internet?

Traditionally, staff checked and recorded temperatures by hand. Connecting refrigerators to the internet allows businesses to monitor their performance remotely and manage several facilities through a single system.

“Businesses connect refrigerators to the internet to monitor temperatures and equipment performance in real time, receive alerts before stock spoils, diagnose faults remotely and manage many sites from one system,” Sandeep Kachhawa, an energy efficiency researcher, told The Indian Express.

Such equipment is part of the Internet of Things (IoT), where physical devices, including sensors and controllers, exchange information over a network.

Story continues below this ad

Connected systems “also allow authorised staff or service providers to adjust temperature settings, alarm thresholds or defrost cycles remotely,” Kachhawa said “This improves response times, but creates a cyber risk if the controller is poorly secured.”

How can a cyberattack disrupt refrigeration?

Refrigeration controllers can become vulnerable when they are directly exposed to the internet or accessed through poorly secured remote connections. Attackers can identify such equipment online and attempt to gain access using weak or default passwords, or exploit vulnerabilities in outdated software.

“Many legacy systems used in Pharma, hospitals and industrial cold chains may have internet connectivity to enable monitoring and remote access so suppliers can undertake remote diagnostics,” Arun Rajagopal, principal consultant and managing partner at Cyber Forte UK, told The Indian Express.

Such connections could also allow attackers to move from an organisation’s corporate network into the systems controlling its physical equipment. “Time and time again, past security incidents have shown how easy it is for an attacker to pivot from Corporate IT Networks to OT or Industrial Environments,” Rajagopal said.

Story continues below this ad

The risks are compounded by the long lifespan of industrial equipment. Xavier Bellekens, CEO of cybersecurity firm Lupovis, pointed out that while laptops might be replaced every three to five years, refrigeration equipment can remain operational for 15–20 years, sometimes long after manufacturers stop providing software security updates.

“The equipment may still work perfectly from a mechanical perspective, even though its software is outdated and its manufacturer no longer provides security updates,” he said.

Lupovis observed suspicious activity against its simulated Danfoss refrigeration controllers, known as honeypots, between October 20 and 30, following the first wave of attacks in France. These systems replicate real equipment, allowing researchers to observe attackers without exposing actual facilities.

“Over this ten-day period, we identified more than 250 attempts from 91 distinct sources, with activity peaking on 26 October,” Bellekens told The Indian Express. The attackers attempted to log in using default credentials and probed the controllers for vulnerabilities.

Story continues below this ad

Bellekens had earlier told POLITICO that the activity could be linked to a Russian state-sponsored group, citing infrastructure previously associated with Russian hackers. Russia has denied involvement.

“We believe this activity may represent preparation for the second wave, but definitive attribution would require further investigation,” Bellekens told The Indian Express.

What could an attack mean for food supplies?

Farmers could lose income if their produce spoils or buyers cannot collect it. Food processors, retailers and logistics companies could face stock losses and supply delays, while consumers could experience shortages or higher prices.

“An attack on an individual facility would be unlikely to cause a nationwide food crisis, but disruption to a major distribution hub could affect supplies across several cities or regions,” Kachhawa said.

Story continues below this ad

“If several facilities use the same refrigeration controls and automation vendor, a security weakness could affect multiple sites. This could turn a problem at one supplier or platform into a wider disruption,” he added. However, he cautioned that using the same technology does not automatically make every facility vulnerable; the security of the systems and their remote connections matters.

What does this mean for India’s cold chain?

India had 8,831 cold-storage facilities with a combined capacity of about 40.3 million metric tonnes, the Ministry of Agriculture and Farmers Welfare said in a response to a Rajya Sabha question on February 6, 2026.

As these facilities adopt more automated and remotely monitored systems, they could also become exposed to the vulnerabilities seen in Europe.

In India, the risk is likely to be concentrated in cold-chain facilities that use internet-connected refrigeration controls, remote monitoring and external vendor access, Kachhawa said. These include organised retail chains, dairy chilling facilities, pharmaceutical warehouses, vaccine storage centres and large distribution hubs. Refrigerated transport may also be vulnerable where trucks use connected temperature-monitoring and fleet-management systems.

Story continues below this ad

The exposure, however, is not uniform. Traditional potato cold storage facilities are less exposed to remote cyberattacks because most of their equipment is locally controlled and not connected to external networks, Kachhawa said.

Who is responsible for keeping these systems safe?

According to Arun Rajagopal, securing connected refrigeration systems is a shared responsibility, involving equipment manufacturers, software providers, maintenance contractors and the businesses operating them.

“This is a shared responsibility between product manufacturers, system integrators and asset owners and operators,” Rajagopal said. He pointed to network and information security rules in the UK and EU for operators, and to the EU Cyber Resilience Act’s requirements for product suppliers.

Manufacturers are responsible for secure equipment and software updates, while operators must monitor which devices are connected and who can access them.

Story continues below this ad

For older equipment that no longer receives security updates, Bellekens said operators need additional protections rather than necessarily replacing entire refrigeration installations. “However, it must recognise that the controller presents a risk and restrict access to it accordingly.”

India is also encouraging greater automation in cold-chain infrastructure. The National Centre for Cold-chain Development’s (NCCD) Engineering Guidelines & Minimum System Standards (2025) encourage IoT-based monitoring, remote control and unified control systems for facilities supported under central government schemes.

However, Kachhawa said the guidelines do not appear to specify detailed cybersecurity requirements for these connected systems, including secure remote access, network separation, user authentication and software updates.

Separately, CERT-In’s May 2026 cybersecurity blueprint identifies operational technology (OT), which controls physical equipment, and cyber-physical systems as areas requiring protection. Its recommendations include restricting remote access, monitoring third-party vendors and managing supply-chain risks.

What should operators do? Rajagopal stressed the importance of strong passwords, multi-factor authentication and keeping critical controllers off the public internet.

“Cybersecurity and safety trumps operational flexibility,” he said.

Kachhawa also recommended independent temperature sensors and alarms, alongside procedures for manually monitoring temperatures and moving products if automated controls fail.

The French blood-service incident demonstrated why such precautions matter: its alarms detected abnormal temperature changes, allowing staff to move blood products before they were lost.

At the policy level, Kachhawa called for cybersecurity requirements to be incorporated into cold-chain infrastructure standards and government funding conditions, alongside regular assessments of facilities storing essential food and medical products.