Hackers heat up freezers: what the attack on Europe’s supermarkets means for your business

Suddenly 50 degrees in the freezer: since October, unknown attackers have been manipulating the refrigeration systems of supermarkets across Europe – now in Germany too. The European Commission has called crisis meetings. The cases show how vulnerable connected equipment is – and that many businesses aren’t insured at all for the most expensive damage.

Get your cyber cover checked

Key points at a glance

• Attacks across Europe: According to press reports, refrigerators and freezers in supermarkets in at least eleven countries were remotely set to as high as 50 °C.
• Germany affected too: Cases were reported at Edeka and Rewe, among others. In one store, food worth €34,000 had to be thrown away.
• Point of entry: Refrigeration controllers that were directly accessible from the internet – often with outdated software or default passwords.
• Insurance gap: Spoiled goods are property damage. Many cyber policies don’t pay for it – and many property policies exclude cyberattacks.

What happened?

• 12 October 2026, France: Several hundred stores, including Intermarché, Netto, Coopérative U and Leclerc, were affected. Refrigerators and freezers were fixed at 50 °C. According to the French press, a single store had to dispose of goods worth around €220,000; the head of the Les Mousquetaires group estimates the total damage in the tens of millions.
• 1 and 2 November 2026, second wave: Countries affected included Belgium, Sweden, Luxembourg, the Netherlands, Italy and Germany. In Germany, dpa and t-online reported cases at Edeka (Reisbach, Lilienthal), Rewe (Raesfeld) and stores in Wuppertal and Wetter. In Lilienthal, food worth €34,000 ended up in the bin.
• EU response: The European Commission has called two crisis meetings with the EU cybersecurity agency ENISA and Europol. Investigations are ongoing; the perpetrator is not known.

How could this happen?

According to press reports, the attacks targeted refrigeration controllers, including those made by Danfoss, that were directly accessible from the internet. Many devices were running outdated software that no longer receives updates, or unchanged default passwords. Automated scanning tools find such systems in no time. In October, the security provider Forescout counted almost 13,000 internet-accessible refrigeration management systems in 99 countries.

Experts stress that little technical know-how was needed for the attack. That is the real warning: any business with connected equipment can be affected – not just supermarkets, but also butchers, bakeries, restaurants, hotels, pharmacies, laboratories, medical practices with vaccine refrigeration, or farms.

How to protect your business: an 8-point checklist

The German Federal Office for Information Security (BSI) has urged operators to disconnect such controllers from the public internet immediately. These points are in line with the recommendations of the BSI, the French agency CERT-FR and security experts:

1. Take stock: Which devices in your business are connected to the internet? Refrigeration, heating, ventilation, POS systems, cameras, solar PV.
2. Disconnect from the open internet: Controllers must not be directly accessible from the internet.
3. Secure remote maintenance: Access only via VPN with two-factor authentication – and only as much as the service provider really needs.
4. Change default passwords: Every device gets its own strong password.
5. Install updates: If a device no longer receives updates, talk to the manufacturer about replacing or isolating it.
6. Separate networks: Building technology and office IT belong in separate network segments.
7. Set up a separate temperature alarm: A separate alarm that warns you by text message – even if the controller itself has been manipulated.
8. Have an emergency plan ready: Who gets notified at night, who is allowed to shut things down, where do the goods go?

Where cyber insurance helps – and where it stops

Cyber insurance is worth a lot in an attack like this. Depending on the policy, it covers:

• Immediate assistance from IT forensics experts: How did the attackers get in, are they still in the system?
• Recovery of systems and data
• Loss of income when the business is at a standstill
• Crisis communication when the press and customers start asking questions
• Liability claims by third parties, e.g. if customer data is affected

According to the insurance trade press and large industrial brokers, however, there is a gap: spoiled goods are property damage – and many cyber policies exclude it. At the same time, many property and refrigerated goods policies exclude damage caused by cyberattacks. The business is then stuck between two policies, neither of which pays. Intermarché told the news agency AFP that its insurance does not cover the incident.

What you should do:

• Compare both policies side by side: Check the property damage exclusion in the cyber policy, and the cyber exclusion in the property or refrigerated goods policy.
• Ask specifically about inclusions: Is there cover for spoiled goods or property damage resulting from a cyberattack? Some insurers now offer this.
• Know your obligations: Some policies require security updates to be installed within certain deadlines. If you fail to do so, you risk trouble when making a claim.

Prevention is part of the policy

Modern cyber insurance helps even before any damage occurs. According to the provider, cyber insurer Stoïk includes a scan that keeps an eye on externally accessible vulnerabilities; if critical issues are found, you are notified – we’re happy to clarify this for you in advance or on a case-by-case basis. Exactly this kind of scan would have flagged exposed refrigeration controllers. Learn more: Cyber security for businesses and Everything Stoïk offers.

What we offer: We compare your cyber, property and refrigerated goods insurance side by side and show you where the gap is – with policies from Stoïk, Hiscox, Markel and VHV, among others.

Frequently asked questions

Will my cyber insurance pay for spoiled goods after a hacker attack?

Often not. Spoiled goods are property damage, and many cyber policies exclude property damage. At the same time, many property and refrigerated goods policies exclude cyberattacks. Whether your policy pays depends on its exact wording – we’re happy to check that for you.

Are only supermarkets at risk?

No. Any business with connected equipment that is accessible from the internet is at risk: butchers, bakeries, restaurants, hotels, pharmacies, laboratories, medical practices with vaccine refrigeration, or farms.

What should I do first?

Check which controllers in your business are accessible from the internet and disconnect them from the open internet. Only allow remote maintenance via VPN with two-factor authentication, and change default passwords. The BSI recommends this too.

Warm regards from KiS

Note: General information, as of 03.11.2026, not individual advice. Details of the incident are based on press reports; investigations are ongoing and figures may still change. The terms and conditions of the respective insurer apply. Sources: Lebensmittel Zeitung, dpa/dpa-AFX, WirtschaftsWoche, t-online, Journal du Geek (all October/November 2026), Lockton, Business Insurance, Insurance Business. KiS – Kontor im Schwarzwald GmbH, insurance broker licensed under § 34d Abs. 1 GewO, Reg.-Nr. D-PS74-61V96-00.

👉 Get your cyber cover checked

← All articles