When Smart Devices Are Weaponised: The Real-World Harm Cyber Attacks Can Cause

Hackers spent October raising freezer temperatures to 50°C across hundreds of French supermarkets, sparking fires and destroying tonnes of food. By November 2, the same type of attack had spread to Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland. No computer systems were broken into. No cash was stolen. The damage was entirely physical.

That is the point. Cyber attacks on smart devices no longer stay digital.

The first wave hit France on October 12. The Paris prosecutor's office described it as a "large-scale" attack on connected refrigeration systems across several major food retailers, causing fires and food losses. The French prime minister ordered the national cybersecurity agency, ANSSI, to investigate.

Three weeks later, a second wave struck six more European countries overnight. Around 40 Ahold Delhaize stores in Belgium and Luxembourg were affected, along with 13 SuperValu branches in Ireland, and stores belonging to ICA and Coop in Sweden. One Delhaize supermarket in Hoeilaart, Belgium, discarded approximately €100,000 worth of food. An ICA store in Sjöbo, Sweden, posted publicly that its fridges and freezers had been "hacked and they set the temperature at 50 degrees."

The attackers did not need physical access. They logged into internet-connected refrigeration controllers remotely and changed the temperature settings, forcing units to release hot air instead of cold. In some cases the hardware overheated badly enough to catch fire.

Investigators have not formally identified the attackers. The Israeli incident response firm Profero — which previously investigated a related attack on an Israeli food processing plant in which hackers destroyed industrial refrigeration compressors — attributed the campaign to an Iranian military group called Cyber Isnaad Front. NPR reported Profero's findings, citing forensic evidence linking the group to earlier influence operations targeting the 2024 US elections. That attribution has not been officially confirmed by any government authority.

The immediate harm is obvious: food ruined, stores closed, supply chains disrupted. But food safety is a direct public health concern. Frozen meat, fish, dairy and ready meals that spent hours at or above ambient temperature — and were then restocked or sold before the attack was detected — pose a contamination risk. Shoppers have no way of knowing whether cold-chain integrity was maintained.

The physical scale of damage is also telling. Commercial refrigeration systems were not traditionally considered a cybersecurity concern. They were bought, installed and left running. Awais Rashid, professor of cybersecurity at the University of Bristol, told Al Jazeera that many of these systems are remotely managed, often by third parties, and have not received the software updates that would close known vulnerabilities.

That is the gap attackers are exploiting: not sophisticated intrusions, but unlocked doors left open for years.

No UK chains have reported attacks so far. But the same equipment used in the European incidents is in British stores. The Telegraph reported that Danfoss — the Danish engineering company whose controllers were central to the French and November 2 attacks — also supplies refrigeration systems to Tesco and Sainsbury's.

UK Cyber Defence, a specialist firm, told trade publication The Grocer that Britain has over 800 refrigeration and building controllers accessible on the open internet. These span manufacturers including Danfoss, Carel and Copeland. The firm found 15 Danfoss units in the UK reachable directly from the internet and said it was "highly unlikely that they have been patched." Most were connected via consumer broadband or mobile data, not corporate retail infrastructure — typically put there by a maintenance contractor seeking quick remote access.

The scale is smaller than France, where UK Cyber Defence identified roughly 2,967 exposed Danfoss controllers. But exposed and unpatched is exposed and unpatched regardless of volume.

In August 2026, the UK's National Cyber Security Centre issued a formal alert about the increased targeting of operational technology — hardware and software used to monitor and control physical processes. The NCSC identified "a broader pattern of disruptive cyber activity targeting internet-exposed systems and edge devices affecting all sectors."

Separately, the NCSC warned this week that Britain needs to be prepared for an AI-powered attack on critical national infrastructure within two years.

Operational technology now runs far beyond supermarket freezers. Water treatment, electricity distribution, building access control, traffic management and heating systems all increasingly rely on internet-connected controllers. When those controllers use default passwords or run unpatched firmware — both common — they are discoverable and accessible to automated scanning tools within minutes of being connected.

The same vulnerabilities exploited in commercial settings exist in home automation. A smart thermostat, boiler controller, security camera or smart plug running old firmware with a factory password is a potential entry point.

The basics close the majority of attack paths:

The European attacks are a useful reminder that smart devices are not passive gadgets. Connected to the internet with weak security, they become remote controls — and someone else can be holding them.