Cold chain under attack, the door was open

Between October and November 2026 someone remotely took control of the refrigeration of hundreds of European supermarkets, Italy included. No data was stolen and no ransom was demanded, because temperatures were simply raised and the stock ended up in the bins. It is the first attack on an industrial system that the general public has seen with its own eyes.

What happened

On the night of 11 to 12 October the attackers triggered a forced defrost of the refrigerated display cases in about 700 French supermarkets, out of roughly 10,000 in the country. Temperatures rose to 50 °C for hours, causing damage worth millions of euros. Three weeks later, on the night of 1 to 2 November, the same pattern repeated in at least nine European countries.

Date	What happened
10 November	The National Committee for Public Order and Security meets at the Italian Interior Ministry, together with the heads of national cybersecurity
9 November	France attributes the October attack to the cyber unit of the Iranian Revolutionary Guards, while minister Tajani points to pro-Russian hackers for the attacks on Italy
3 November	The National Cybersecurity Agency (ACN) updates its bulletin for the cold chain and meets large-scale retail
2 November	Second wave in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden
13 October	The ACN publishes urgent measures for food distribution and the cold chain
11–12 October	About 700 French supermarkets hit, with forced defrost and temperatures up to 50 °C

In Italy at least four supermarkets in Sicily were hit, according to the group that runs them. The ACN received an NIS incident notification from a Tuscan catering company and detected an attack on an Emilia-Romagna frozen food producer. The second wave has not yet been formally attributed.

Consumers were not at risk, because the compromised goods were discarded and the Italian authorities found no cases of danger to health. The damage is economic and a matter of trust.

They did not break down the door, they found it open

It was not a sophisticated attack, and that is the bad news, because it can be replicated with little effort. According to the French agency ANSSI, the intrusion was made possible by basic flaws, namely refrigeration equipment exposed directly to the internet, administered with little protection and weak passwords. The director of the UK’s NCSC added that many units were connected to the internet with factory-default passwords.

Many controllers were running old firmware, or firmware no longer supported by the manufacturer. Fixes existed, but the installed base stayed online as it was. It is technical debt that came due all on the same night.

The figure that concerns Italy most closely comes from an independent researcher, who counted more than 13,000 refrigeration controllers reachable from the internet, 10,354 of them in Europe. The country with the most exposed devices is Italy, ahead of the United States, France, Greece and Germany. The count may include other industrial devices, but the order of magnitude is clear.

Those who acted reduced their risk quickly. In France, after the alert, the exposed panels of a single manufacturer fell within three days from over 1,800 to 537, while in the rest of Europe the number stayed almost unchanged. Three weeks later the second wave arrived.

One access, dozens of stores

Remote management was created for convenience, because the maintenance provider adjusts temperatures and defrost cycles remotely without sending a technician. In these weeks the price of that convenience became visible. A single controller often runs an entire store, with display cases, cold rooms and refrigeration racks, and a single vendor console reaches dozens of them.

In the second wave the common thread was precisely the suppliers. In Portugal a chain traced its seven affected stores to an attack that appears to have targeted the external provider in charge of refrigeration. In Sweden another chain explained that the stores involved were connected outside the central network, through an external provider.

A company’s security perimeter therefore includes whoever installs, maintains and monitors its equipment. If a supplier enters from the internet with the same credentials at dozens of sites, those credentials are everyone’s weak point.

The problem is noticing in time

Temperatures rose for hours without anyone intervening. In many cases it was staff who noticed when opening the store, when the goods were already ready for the bin.

The reason is structural. Traditional security tools protect computers and servers, not an industrial controller, and a setpoint change at three in the morning looks like a legitimate command. Researchers at Claroty Team82 have shown that a compromised controller can switch cooling off while continuing to display normal temperatures.

What is needed is monitoring that understands the language of machines, that is, which parameter changed, when and from which access. Without this visibility, the alarm comes from the shop floor or from the customer, not from security.

What the ACN and the regulations require

The ACN asked food distribution, cold logistics, industrial refrigeration and maintenance providers for six immediate checks. They are set out in the bulletin “Urgent verification and mitigation measures for food distribution and cold chain operators”, published on 13 October and updated on 3 November.

Check	What it asks for, in brief
Inventory	Identify controllers, operator panels, supervision and remote support access, including suppliers’ cellular routers
Networks	Remove administration functions from the internet and truly separate the OT network, the corporate network and guest networks
Remote support	Access only through controlled channels, with multi-factor authentication and limited permissions
Credentials	Change default passwords, remove unnecessary accounts, revoke suspicious sessions
Integrity	Compare setpoints, defrost cycles, thresholds and alarm recipients with the approved configurations
Updates	Check device support, apply patches, plan replacements

The bulletin also asks to analyse logs going back up to 90 days and to report indicators of compromise to CSIRT Italia. And it reminds readers that bringing the temperature back to the correct value does not, by itself, prove that the goods were stored properly.

On the regulatory side, NIS2 (Italian Legislative Decree 138/2024) covers, in the food sector, wholesale distribution and industrial production and processing, so logistics platforms, cold stores and the frozen food industry. Entities within the perimeter must manage supplier risk and send an early notification of significant incidents within 24 hours. A single retail store does not become a NIS2 entity just because it has connected refrigerators.

The other side concerns manufacturers. Since 11 September 2026 the Cyber Resilience Act requires them to report actively exploited vulnerabilities and severe incidents affecting their products, and from 11 December 2027 the requirements on secure configuration and update support will apply. From 20 January 2027 the Machinery Regulation also requires control systems to be protected against tampering, including intentional tampering. For anyone buying equipment today, support duration and secure remote assistance are purchasing criteria, not technical details.

It is not only about supermarkets

The same pattern applies to any remotely managed facility, and in France it has already reached healthcare. At three plasma storage sites the temperature and defrost thresholds were raised, with no loss of bags according to the national blood service. ANSSI then worked with hospitals, pharmacies and laboratories to secure their refrigeration systems.

Medicines, logistics, energy, water, manufacturing, the parameters change but the model does not. A controller reachable from the internet, a supplier’s remote access, a password that was never changed. In the assessments we carry out on energy, manufacturing and service facilities we almost always find these problems, far more often than exotic flaws.

Five questions to ask tomorrow morning

Before talking about technology, whoever is responsible for a plant should be able to answer these questions.

Which systems can be reached from the internet, even through a supplier’s router?
Who has remote access, and can I revoke it in five minutes?
Have the factory passwords been changed on all devices?
Are there devices that the manufacturer no longer updates?
If a parameter changes at three in the morning, who notices, and how quickly?

If at least three answers are “I don’t know”, the starting point is an assessment of the plant.

How we work in industrial plants

The supermarket refrigerator is an industrial system with a web page. It must be protected and monitored day and night like a power plant, not like a printer.

At Cquri we have been doing IT security since 2005 and industrial plant security since 2017. We always start from an asset inventory based on passive traffic analysis, so nothing is stopped and everything that talks on the network becomes visible. Connected devices that the customer did not know about almost always emerge, and active tests come later, in maintenance windows.

We design networks in zones and conduits according to IEC 62443, so that a compromise stays confined to its own area. We manage maintainers’ remote access as a service in its own right, in which each supplier enters only where and when needed, with sessions that are tracked and revocable.

Then there is monitoring, with a 24/7 SOC and NOC that knows industrial protocols and recognises a parameter changed out of hours or from an unusual access. Today we monitor more than 80 facilities this way across energy, manufacturing and services. We also support companies with NIS2 compliance, with the OT perimeter included from day one, and manufacturers with the CRA and the Machinery Regulation.

To go further, read our articles on PAM and remote access, on IT and OT network monitoring and on the 2027 Machinery Regulation. If you want to understand where to start, get in touch and we can discuss it with our SOC.

Sources

ACN, bulletin for food distribution and the cold chain, v1.1 of 3 November 2026
Cybersecurity360, Refrigerators under attack, ACN asks for six urgent checks, 3 November 2026
Teleborsa, cases in Tuscany and Emilia-Romagna, 3 November 2026
Tgcom24, attack on French supermarkets, October 2026
Notizie Geopolitiche, French attribution and 700 stores, 9 November 2026
Sky TG24, French investigation and statements by Tajani, 9 November 2026
Virgilio Notizie, the Committee convened at the Interior Ministry, 9 November 2026
Retail Gazette, the basic flaws according to ANSSI, October 2026
SecurityWeek, spread of the attack and Censys data, October 2026
The Korea Times (AP), the second wave and the NCSC, 4 November 2026
Help Net Security, second wave in Europe, 2 November 2026
eNCA (AFP), the supplier case in Portugal, 3 November 2026
Straight Arrow News, controllers exposed on the internet, 4 November 2026
The Record, research by Claroty Team82
Silicon UK, ANSSI before lawmakers
European Commission, Cyber Resilience Act, 11 September 2026