Hackers heat supermarket fridges to 50C as first German cases surface in Bavaria and NRW

The operator of the Edeka market in Reisbach went public on Facebook, according to heise online. He said vast quantities of food had to be thrown away. "Und das macht uns einfach nur wütend," the operator wrote above a photo of produce in a waste container, a line heise reported on 3 November. The Niederbayern police headquarters is investigating. It says it will coordinate with authorities in other affected countries. Police have not confirmed that a cyberattack caused the outage.

Cases have also been reported from North Rhine-Westphalia. Whether they are connected, and who is behind them, remains unclear.

The German incidents sit inside a much wider picture. On Monday, supermarkets in Belgium, Luxembourg, Sweden, France, Finland, Ireland and Estonia reported disruptions to refrigeration and freezer systems. At least one store recorded temperatures of up to 50C (122F). CNBC reported on 3 November that Ahold Delhaize had dozens of Delhaize stores hit in Belgium and Luxembourg. Carrefour told the BBC 15 of its Belgian stores were attacked, and Intermarché said 15 of its 153 Belgian outlets were affected. Colruyt Group said five Spar stores in Belgium were targeted, according to Reuters.

"In most cases, the security measures in place made it possible to quickly contain the attack," an Intermarché spokesperson told CNBC. "However, a few stores did suffer some stock losses, although nothing comparable to the attack in mid-October." The same spokesperson pointed the finger elsewhere: "At this stage, the information available to us indicates that the bulk of the attack affected other players in the sector, notably Carrefour and Delhaize."

Brussels convenes a task force

The EU Commission is in direct contact with national authorities. It convened a meeting on Tuesday morning of the EU interinstitutional Task Force together with ENISA, Europol and the relevant Commission services, a spokesperson confirmed to CNBC. That is the most concrete official response so far. No attribution has been made public.

IKEA told CNBC that a cyber incident affected refrigerators and freezers at its Mons store in Belgium between Sunday and Monday. It is inspecting equipment and checking installations at its other Belgian stores. "The incident has a limited impact on the offering in our restaurant and Swedish Food Market," an IKEA spokesperson said by email. ICA, Sweden's largest grocery retailer, said a "limited number of stores" on networks outside its central systems had been affected, and that it was supporting them. Kesko in Finland, SuperValu in Ireland and Estonia's One Selver also reported disruptions.

The method echoes an attack on French supermarkets in mid-October. According to heise online, attackers in that wave exploited security holes in older internet-connected Danfoss controllers. They did not switch fridges off but dialled temperatures sharply upward so food spoiled. Tom's Hardware reported on 2 November that the same trick was used again: hackers remotely triggered the units' built-in defrost mode, overriding temperature and defrost duration. Belga News Agency, cited by Tom's Hardware, said the Belgian attack began around midnight on Sunday. Refrigeration firm Sabcobel estimated at least twenty units were affected across the country. Whether the new cases use the identical technique is not confirmed.

The controller problem

The Edeka operator in Reisbach defended connecting its refrigeration to the internet. He argued it is standard practice and serves food safety: the units are monitored around the clock. Power failures, refrigerant loss or other faults at night trigger automatic alarms and phone calls. The affected systems have now been disconnected and will not be reconnected for the time being, heise reported.

Germany's federal cybersecurity agency, the BSI, has issued a warning. It has previously pointed to attacks in Poland, describing them as "rein destruktive Sabotageakte" that were "einfach vermeidbar." Its core advice is blunt: the most important and at the same time simplest protection is to disconnect the systems from the internet. VPN tunnels, multifactor-protected access, blocklists, protocol filtering and updates make life harder for attackers, the agency says.

Regulation is tightening in parallel. Under the Cyber Resilience Act, tougher due diligence duties for makers of connected devices apply from December 2027. Manufacturers have had to report actively exploited vulnerabilities and serious security incidents since 11 September 2026, according to heise online.

The grocery attacks are not the only government-adjacent activity in the news. Palo Alto Networks Unit 42 disclosed a cyber espionage campaign against Linux infrastructure at government entities, tracked as CL-UNK-1211, observed between October 2025 and April 2026, The Hacker News reported on 2 November. Researchers Roey Porat and Tom Fakterman said the attackers attempted to dump sensitive databases and exfiltrate government mailboxes. Several scripts carried conversational, step-by-step reasoning notes, the researchers said. That suggests the code was copied from AI prompt output or deployed by an automated agent.

Separately, Dream Research Labs reported an Iran-aligned group called DarkBlinders compromising a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq between August and October 2026, also covered by The Hacker News. Kaspersky, meanwhile, detailed NetamLoader, a .NET assembly-loading framework found in a Windows cabinet archive on a custom Windows 10 build used exclusively by government entities in Asia.