Freezers are supposed to be the most boring part of a grocery store. This week they became a security story. Refrigeration systems at grocery chains across six European countries malfunctioned, with some freezer temperatures soaring to 122°F (50°C), forcing stores to throw away food. The incident is a suspected supermarket freezer cyberattack, and it has renewed concern about vulnerable legacy software running in the physical world.
The attribution is still described as suspected, so it is worth being careful about what is known and what is not. What is clear is the pattern: software that controls physical equipment failed in a way that looks deliberate, and the consequences were measured in spoiled inventory rather than stolen data.
What Happened to the Supermarket Freezers
According to the reporting, refrigeration systems at grocery chains in six countries stopped behaving normally. In some cases, freezer temperatures climbed to 122°F. Stores had to discard food that could no longer be kept safe to sell.
Coverage of the French part of the incident describes hackers gaining control of the software that regulates refrigeration units and forcing some to warm overnight. Some reports put the number of affected French units in the hundreds. Danfoss, a maker of refrigeration equipment, reportedly told AFP that most of the affected equipment was "legacy" products which "no longer receive software or security updates." We have not independently verified those figures, and the investigation appears to be ongoing.
The damage in this case was mostly financial and operational: lost stock, disrupted stores, and staff dealing with the cleanup. But the same type of access could in principle affect any system that controls heat, cold, water, or power.
Why Legacy Software Makes a Supermarket Freezer Cyberattack Possible
Refrigeration controllers belong to a category called operational technology (OT). Unlike a laptop or phone, these devices are built to run for many years with minimal attention. They are installed, connected to a network so technicians can monitor them, and then largely forgotten.
That design creates several familiar weaknesses:
- No more updates. When a manufacturer stops issuing security patches for a product, any flaw found afterward stays open permanently. The reported Danfoss statement points directly to this problem.
- Remote management by design. Centralized systems let technicians diagnose issues and push changes without visiting each store. That convenience also gives an attacker a single place to aim if the system is reachable from the internet or poorly protected.
- Long lifespans. Equipment bought a decade ago may still work perfectly as a freezer while being impossible to defend as a networked computer.
- Safety over security. These systems were often designed to keep running reliably, not to resist a determined intruder.
None of this is unique to supermarkets. Hospitals, factories, and building management systems share the same trade-off between uptime and patching.
What This Means For You
Most readers do not run a grocery chain, but many run smaller versions of the same setup. A home or small business may have a router, a network camera, a smart thermostat, a connected fridge, a NAS drive, or a point-of-sale terminal. Each is a small computer attached to the internet, and many were bought years ago and never updated.
The lesson from the freezer incident is not that your kitchen appliance is about to cook your food. It is that internet-exposed devices with outdated software are a realistic way into a network, and that the impact can reach beyond data into physical operations. For a small café, restaurant, or shop with a walk-in freezer on a remote monitoring service, the scenario is not far-fetched. Spoiled stock hurts a small business far more than a large chain.
Your router matters most here. It is the gate for every other device. If it is old, unpatched, or managed with a default password, everything behind it inherits that risk.
How to Secure Connected Devices and Routers
You do not need specialist tools to reduce your exposure. A short audit goes a long way:
- List what is connected. Check your router's device list and note anything you do not recognize or no longer use. Unplug what you do not need.
- Update firmware. Install the latest updates on your router and every connected device. Turn on automatic updates where they are offered.
- Check for end-of-life status. Look up whether the manufacturer still supports each device. If a product no longer receives security updates, plan to replace it, or at least isolate it.
- Change default credentials. Replace factory usernames and passwords with unique, strong ones, and use a password manager to keep track.
- Turn off remote access you do not use. Disable remote administration, port forwarding, and UPnP on the router unless you have a specific reason to keep them.
- Segment your network. Put smart devices, cameras, and equipment on a guest or separate network away from laptops and work files. If one device is compromised, the damage stays contained.
- For small businesses, ask vendors direct questions. If a supplier remotely manages your refrigeration or other equipment, ask how access is secured, who can log in, and whether the hardware is still supported.
The Takeaway
The supermarket freezer cyberattack is a vivid reminder that legacy software does not stay a back-office problem. When old, unpatched systems are reachable from the internet, an attack can turn into melted stock and empty shelves. The same principles apply at home and in a small shop: know what is connected, keep it updated, retire what can no longer be patched, and separate risky devices from the rest of your network. Set aside an hour this week to audit your router and connected devices. It is a small task compared with the cost of throwing out a freezer full of food, or worse.
