The supermarket fridge hack exposes the cracks in tech vision of an ‘internet of things’

Imagine opening a supermarket in the morning to find the freezer aisle dripping, the floor wet, and thousands of euros’ worth of food ruined. That is what happened in France overnight on 11-12 October 2026, when hackers remotely manipulated refrigeration systems at hundreds of supermarkets. Temperatures reportedly reached 50°C, spoiling food worth millions of euros. The attacks spread. In early November, similar incidents affected supermarkets in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden. Food suppliers in the UK were also targeted. A London wholesaler narrowly avoided losing its stock by disconnecting affected equipment from the internet. On Monday November 9, French officials accused Iran of being behind the attacks in France. Others, including cybersecurity experts, have previously suspected Russian involvement – something Moscow has denied. Whoever is responsible, these incidents reveal an uncomfortable reality: cyberattacks are no longer confined to stolen passwords, compromised bank accounts or leaked information. They can disrupt the physical systems on which everyday life depends. A term, the “internet of things”, is sometimes used for the increasing trend for physical objects to be embedded with sensors and communicating with other devices or systems over the internet. But as more devices become connected to the internet, the question is not simply how hackers managed to heat supermarket freezers, but who is responsible for keeping these devices – and others like them – secure. Modern supermarket refrigeration systems often use control panels that allow engineers to monitor temperatures, receive alerts, and adjust settings remotely. Why are supermarket fridges being hacked? (BBC News) The control panels operate electronic devices called controllers that manage the refrigeration systems and can be accessed remotely via the internet. This is useful: a failing freezer in the middle of the night can cause substantial losses and remote monitoring can help prevent it. But the same connectivity that makes these systems convenient can also create opportunities for attackers. From freezers to ovens Attackers reportedly extended defrost cycles from around one hour to eight hours, delaying alarms while temperatures rose. The concern is that equipment can remain mechanically functional long after its cybersecurity protections become inadequate. And the implications extend beyond supermarkets. Hospitals, pharmacies, and warehouses depend on refrigeration, while connected systems also manage heating, ventilation and other building functions. Perhaps the most revealing aspect of these attacks is their potential scale. Hackers need not target supermarkets individually. They can search the internet for particular controllers for appliances, such as fridges and freezers, and attempt to exploit the same weaknesses across businesses and countries. Hackers targeted supermarkets across Europe, including Sweden (shown). TT News Agency / Alamy Since the attacks, there has been evidence that refrigeration controllers have been disappearing from the internet, consistent either with the companies taking action to protect them, or owners disconnecting the appliances. Yet more than 3,100 remained visible online on November 5 2026. Exposure does not necessarily mean vulnerability, but it illustrates the scale of the shared risk. A refrigeration controller may accept a change to its defrost settings even when the resulting temperatures could destroy food. Businesses therefore need more than protection against unauthorised access. Critical operating limits should be protected against dangerous remote changes, with independent safeguards and local controls – allowing supermarket employees to adjust refrigeration equipment – if digital systems are compromised. Secure connectivity is another part of the solution. In January 2026, the UK’s National Cyber Security Centre published guidance on how industrial systems connect to external networks and how those connections should be controlled. But securing these systems also raises a question of responsibility. A supermarket may buy equipment from one company, use another for maintenance and depend on a third for software support. When vulnerabilities emerge, responsibility can become fragmented. This can leave critical security gaps unaddressed. Many devices in the home are now connected to the internet, including video doorbells. Frame Stock Footage / Shutterstock International cybersecurity agencies are urging organisations to consider security when purchasing industrial equipment, including manufacturers’ commitments to security updates and support throughout a product’s lifespan. This approach is known as “secure by demand”. But what happens when an attack succeeds despite these precautions? A supermarket may suffer the immediate losses, even when the weakness lies in equipment or software supplied by someone else. Insurance may cover some of the damage, but who ultimately bears the cost depends on contracts, liability and the terms of the insurance policy. Financial risk may be transferred between organisations, but responsibility for preventing and managing cyberattacks is not necessarily transferred with it. What about the rest of us? The same risks increasingly extend into our homes. Smart thermostats, security cameras, doorbells and connected appliances create ongoing dependencies on their manufacturers. Unlike traditional appliances, connected devices may rely on software updates and cloud services long after purchase. A device can become insecure before it becomes unusable. And if its manufacturer withdraws support or shuts down a cloud service, some functions may stop working altogether. Before buying connected technology, we should ask: how long will security updates be provided? Will essential functions work without internet access? What happens when support ends? But consumers cannot reasonably assess every vulnerability or control manufacturers’ decisions. Responsibility for security cannot rest with them alone. We routinely ask what connected technology can do for us. Perhaps we should also ask who bears the risks when things go wrong, and who remains responsible for keeping it secure as it gets older.