A New Cold War: Refrigeration Attacks are Turning Up the Heat On Boards

5 November 2026 — based on information available at the time of writing.

What happened in the European refrigeration attacks?  

Overnight into 2 November, supermarkets in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, Finland, Portugal and Italy reported refrigeration disruption, with several incidents attributed to cyberattacks; SentinelOne also lists Germany. Some stores discarded food; one Swedish store reported that its refrigeration settings had been changed to 50°C.

Reported counts include:

Belgium and Luxembourg: several dozen Delhaize stores, around 15 Carrefour stores, 10–15 Intermarché stores, five Spar stores and an IKEA site in Mons

Ireland: 13 SuperValu stores

Sweden: six or seven Coop stores

Portugal: seven Intermarché stores

Netherlands: at least 17 businesses

At one Belgian butcher, temperatures reached 18°C. The incidents follow attacks affecting hundreds of French stores in October, which the French economy minister put at around 700. [1, 6, 7, 8]

Who is responsible? What we know and don’t know

A new “Cold War” makes an arresting headline. But there is nothing cold about the consequences: lost stock, interrupted trading and an urgent need to establish whether products remain safe. Nor should the phrase imply state involvement. Reporting has not established responsibility or a common cause across all these incidents, and no group had claimed the 2 November attacks by that evening. EU Agriculture Commissioner Christophe Hansen said they may be a deliberate attempt to disrupt food supply, while stating that food security is not at risk, and Belgium’s Centre for Cybersecurity said the perpetrators may never be determined. Belgium’s federal prosecutor has opened a criminal investigation. Danfoss and two Belgian companies say the methods resembled the French attacks, but a shared method does not show the same people were responsible, and Russian-aligned groups are one credible line of inquiry rather than a conclusion. [2, 6, 7, 8] Separately, the pro-Russian hacktivist group NoName057(16) has claimed a denial-of-service attack and data leak against Danfoss itself. That claim is unverified and would not explain changes to controller settings. US reporting also says the Pentagon is treating refrigeration failures at several military commissaries since late August as a suspected hack; no link to the European attacks has been established. [6]

Why operational technology is a board issue

For boards, the lesson is immediate. Cyber risk reaches into the equipment that keeps an organisation operating.

These controllers are examples of operational technology: systems that monitor or change physical conditions. Understanding that distinction should be part of every board’s cyber education. An attack on a business application might interrupt access to information. An attack on operational equipment can alter temperature, stop production or undermine the conditions required to deliver a service safely.

The wider relevance is considerable. Consider a pharmaceutical business storing temperature-sensitive products, a manufacturer relying on automated production, or a financial services organisation dependent on data-centre cooling. These are illustrative scenarios, rather than claims that those organisations were affected. Each raises the same question: which digitally controlled physical dependency could interrupt our business?

The governance challenge sits between functions. Facilities teams may own equipment. Procurement may appoint its maintenance provider. A contractor may control remote access. IT may manage connectivity. Unless responsibilities are joined up, everyone can fulfil their individual role while a material business risk remains unmanaged.

Board upskilling should therefore develop directors’ ability to connect technology, ownership and commercial consequences. Directors do not need to configure a refrigeration controller. They need to recognise when an apparently routine maintenance arrangement creates a critical dependency, and ask for evidence that it is controlled. 

Six questions boards should ask

1. What equipment could stop us trading?

   Include building systems, cooling, production machinery and equipment operated by suppliers.

2. Who can control it remotely?  

   Establish which employees and contractors have access, how that access is secured and who reviews it.

3. Which systems are beyond support?  

   Require a funded replacement plan or evidenced safeguards for equipment that can no longer receive security updates.

4. How quickly would we detect harmful changes?

   Test whether operational alarms reach someone able to act, including overnight.

5. How would we operate and recover safely?  

   Exercise isolation, manual procedures and restoration with operational teams and relevant suppliers.

6. Where could one weakness affect multiple locations or businesses?  

   Identify common equipment, maintenance providers and remote-management services.

References