Hackers have turned supermarket refrigeration systems against their owners in at least 11 European countries, with Germany, Romania and the United Kingdom the latest to report attacks on Monday.

Officials said the attackers raised the temperatures of fridges and freezers remotely, spoiling tonnes of food across the continent. The European Union promised a collective response on Tuesday, warning that the attacks were “not isolated” incidents.

How the attacks spread

The first wave struck France in October, when hackers hit around 700 supermarkets and pushed freezer temperatures as high as 50 degrees Celsius. A second, broader wave began on 2 November, reaching stores in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden.

On Tuesday, officials and company representatives said four supermarkets in Germany and six in Romania had been affected, and the United Kingdom, which is not in the EU, was also hit. In Italy, about 20 supermarkets were affected. That brought the number of European countries caught up in the hacking spree to at least 11.

The attacks have gone beyond food retail. In France, the national blood service, the Établissement Français du Sang, said cold storage units at at least three blood banks had been hacked, with temperature and defrost thresholds set to excessively high levels. Monitoring and alarm systems alerted staff in time, and no blood products were lost and no patients were harmed.

Exposed controllers and weak passwords

Investigators say the attackers reached refrigeration controllers that had been left exposed on the public internet, often with unpatched firmware and factory or weak passwords. The systems named in French cyber agency alerts include Danfoss AK-SM and AK-SC controllers, along with Copeland XWEB and Dixell XWEB units.

Security researchers have warned about the risk for years. France's cyber agency first told operators in 2014 never to put the controllers directly online, yet more than 1,000 Danfoss store systems were still exposed online on the day of the second wave, according to security company Claroty.

Romania's cyber security director, Dan Cîmpean, described the attackers as “semi-amateurish” and said no state actor was currently suspected. France's foreign minister, Jean-Noël Barrot, has pointed the finger at Iran, but no group has claimed responsibility and investigators have not reached a settled conclusion on who is behind the attacks.

What happens next

Retailers and national cyber agencies across Europe are now racing to take the controllers offline or behind firewalls, change default passwords and apply patches. Belgium's refrigeration industry group said the damage would have been far worse had its members not started patching the vulnerabilities after the October attacks in France.

The episode has shown how a cheap, low-skill attack on everyday equipment can disrupt food supplies and even threaten medical stocks. The same controllers that set a fridge's temperature also run cold rooms in hospitals, medicine warehouses and data centres, and European officials say the collective response must cover all of them.