Refrigeration Attacks Are Spreading. What Unsecured Vendor Access Costs Food and Beverage.

Refrigeration cyberattacks hit roughly 700 French supermarkets in October 2026, then stores in at least five more European countries in November, after attackers reached internet-exposed controllers. Food and beverage plants rely on remote OEM service for the same kinds of systems, with more at stake.

Picture this. At 2 a.m., a setpoint changes on a refrigeration controller. Nobody on the night shift touched it. The vendor who services it is asleep. By the time the morning crew notices, everything in that cold room is waste. 

That’s no longer a tabletop exercise. On the night of October 11, attackers did it to roughly 700 supermarkets across France. Overnight into November 2, it happened again in at least five more countries, including Belgium, Luxembourg, Ireland, Sweden and Estonia. 

Supermarkets took the first hits. Food and beverage plants run on the same model: refrigeration and process equipment serviced through vendor remote access, with more at stake behind every connection. So the question for every plant leader is a financial one: what does it cost to put off securing vendor remote access? 

What Happened in the Supermarket Refrigeration Attacks? 

Attackers reached internet-exposed refrigeration controllers and forced them into a continuous defrost cycle. In France, controllers were set as high as 50°C (122°F) for roughly six hours. The Paris prosecutor’s office is investigating food losses and reported fires. 

The first wave hit E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. Intermarché's CEO put the damage at tens of millions of euros nationwide in a single day. Two stores in Alsace alone reported €270,000 in losses. 

The second wave landed three weeks later. Carrefour said 15 of its Belgian stores were hit. Musgrave said refrigeration at 13 SuperValu stores in Ireland was affected. In Sweden, freezers at ICA and Coop stores were set to 50°C, and grocer Axfood said freezers at a home-delivery distribution center near Gothenburg were hacked. 

The exposed surface was the same both times: refrigeration controllers reachable from the internet. Investigators haven’t confirmed exactly how attackers got in. France's cybersecurity agency named systems from Danfoss, Copeland and Dixell. In Belgium, the CEO of Sabcobel, the refrigeration installer that operates Delhaize's systems, said the attack followed the same mechanism as France. No one has claimed responsibility for either wave. 

Are Cyberattacks on the Food Supply Becoming More Frequent? 

Yes. The two confirmed refrigeration waves landed three weeks apart. Look at the last four months: 

The broader numbers point the same way. Food and Ag-ISAC counted 227 ransomware incidents against food and agriculture through July 2026, up 62% from the same period in 2025. That’s already closing in on the 265 recorded in all of 2025. 

Adversarial AI is part of the reason. On November 2, Belgium's Centre for Cybersecurity called the rising number of incidents, especially those driven by targeted use of AI, an evolving trend. The barrier to entry has collapsed. An attacker no longer needs deep OT expertise. They need an exposed controller running outdated firmware and a reason.  

And the door is already open at most organizations. According to the SANS State of ICS/OT Security 2025, half of incidents began with external access, yet fewer than 15% of organizations have advanced remote access controls in place. 

Why Are Food and Beverage Plants Exposed to Refrigeration Cyberattacks? 

Because the weakness is any internet-reachable path into OT, and most plants have more than one.  

Look at who actually ran those systems. Les Mousquetaires said the attack came through a service provider that manages refrigeration in some of its stores. In Belgium, it was Sabcobel, a refrigeration installer.  

Food and beverage plants run on that same model, at a larger scale. According to PMMI data cited by Food Engineering, 54% of food and beverage end users have increased investment in remote services since COVID. Ammonia refrigeration, blast freezers, high-pressure processing, pasteurization and clean-in-place systems are serviced remotely by OEMs and integrators. Equipment suppliers are also adding 4G and 5G uplinks that create paths IT doesn’t see. 

The consequence is bigger, too. A supermarket throws out a cold case. A plant that can’t prove what happened to a temperature or process setpoint could be facing product holds, recalls and destroyed lots. 

What Could Waiting Cost a Food and Beverage Manufacturer? 

Here’s how the exposure stacks up for one plant and one event: 

Multi-site manufacturers run the same vendor access model at every facility, so the exposure multiplies with each one. 

Those figures don't include the costs that show up later: a recall if nobody can prove what changed a setpoint, the cyber insurance renewal, the retail customer's security questionnaire, the audit finding, the weeks of overtime to rebuild inventory. 

The math on acting now is much shorter. According to the same Dragos report, secure remote access and defensible architecture together cut OT cyber risk by up to 30%: 12% from secure remote access, 17% from defensible architecture. 

Why Does Vendor Remote Access Keep Slipping Down the List? 

Because three teams own a piece of it, and each pulls in a different direction. 

Security wants every path locked down. Operations needs the refrigeration OEM connected before the cold room warms up. Food safety and quality need a record of every change to a temperature or process setpoint. When the secure path is slower than the workaround, the workaround wins. Technicians share a login. A modem stays plugged in. A VPN account outlives the contract. 

That's friction. It's an architecture problem, and it builds quietly. Nobody chose to leave a controller on the internet. It happened one reasonable shortcut at a time, and no single team owned the whole path. That's why it waits for next year's budget, right up until the night it can't. 

What Should Food and Beverage Manufacturers Do Now? 

Start by finding out whether you can answer five questions across every plant: 

• Which refrigeration, utility, and production controllers can be reached from the internet today, directly or through a vendor modem? 

• Which OEMs and integrators can connect into OT, and how many use shared or never-expiring credentials? 

• Can you give one vendor access to one asset for one approved window, then revoke it automatically? Do you have a recording of what they did while connected? 

• If a setpoint changed at 2 a.m., could you show who connected, from where, and what they did? 

• How fast could you cut every external path into OT, across every plant, at once? 

If any answer is "we'd have to check with each plant," the exposure that hit European retailers exists in your operation too. 

You don't need a multi-year program to close it. Start with one plant and its highest-consequence system: 

• Week 1: Install one gateway and onboard the two or three OEMs that service refrigeration and critical lines. 

• Week 2: Begin inventorying every external path into OT, including vendor modems and remote tools. 

• Weeks 3–4: Route every vendor session through approvals and recording, then shut off the legacy paths. 

• Day 30: Review the session logs with plant leadership and agree on the rollout for the remaining sites. 

How Dispel Eliminates the Exposure 

The Dispel Zero Trust Engine replaces scattered vendor VPNs, modems and remote desktop tools with one controlled path into OT at every plant. Each weakness the attackers relied on has a matching control. 

• OT Secure Remote Access eliminates unmanaged paths into OT. Every outside connection runs through one controlled, recorded path at each site instead of a direct link to the controller. 

• Just-in-time access windows eliminate standing vendor access. Every technician gets a unique login with MFA and approval, and it expires when the window closes. 

• Moving Target Defense eliminates the fixed, scannable target an attacker can return to. There’s no persistent IP and no stable endpoint, and every pathway is destroyed when the session ends. 

• Session Forensics eliminates the blind spot after the fact. Every remote change to a setpoint has a name, a time and a recording, creating audit evidence of who accessed what, and when, for any product-disposition review. 

None of this slows the OEM down. Technicians connect in under 30 seconds instead of waiting on a VPN ticket or a truck to drive onsite. It also deploys with no intrusive agents and no network redesign, which matters when supplier terms prohibit third-party software on their machines. Mitsubishi Electric offers a Dispel-based Zero Trust remote access solution for its factory automation equipment.

As one IT director at a food and beverage manufacturer put it: "Not only does Dispel allow third parties to get in quickly and securely, but the recording feature lets us go back and see exactly what was done to bring a line back online."

That's the point. When the secure path is also the fastest path, nobody builds a workaround. Security gets enforced controls, operations gets faster repairs, and food safety gets its evidence automatically. 

The attacks in France and across Europe were a warning that arrived at someone else's door. Talk with our team about how food and beverage manufacturers are taking ownership of vendor remote access before the next wave. 

Reducing Operational Friction in Manufacturing with Modern Remote Access 

Based on research from Takepoint Research, see how manufacturers cut downtime, speed up OEM response and standardize vendor access across every plant. Download the whitepaper.