Connected to save energy. Connected to reduce emissions. Connected well enough for someone else to take control.

The Smart Freezer That Forgot Its Purpose

European supermarkets have discovered an unfortunate consequence of connecting their refrigeration equipment to the internet.

Someone else can potentially control it.

On November 2, 2026, supermarkets and other retailers across Sweden, Belgium, Luxembourg, Ireland and Estonia reported refrigeration disruptions resembling the cyberattack that struck hundreds of French supermarkets three weeks earlier.

Freezer temperatures climbed. Refrigeration equipment entered defrost cycles. Employees began removing meat, dairy products and frozen goods that could no longer be safely sold.

At one Swedish ICA supermarket, freezer temperatures reportedly reached 50°C (122°F).

Carrefour reported 15 affected Belgian stores, while Delhaize, Coop, Colruyt, Spar and other retailers experienced disruptions. In Ireland, 13 SuperValu stores were affected. Even an IKEA store in Belgium reported problems involving its refrigeration systems.¹

The incidents followed the October 12 cyberattack against French retailers.

French Finance Minister Roland Lescure told Parliament that approximately 700 of the country's 10,000 supermarkets had been affected.

The Paris prosecutor's office opened an investigation into the attack, which caused substantial food losses and reports of fires involving refrigeration equipment.²

The attackers did not necessarily compromise every individual freezer.

They accessed centralized systems capable of managing multiple refrigerated units.

That distinction is important.

And it makes this story considerably more significant than a malfunctioning supermarket freezer.

Welcome to the Internet of Frozen Things

Modern commercial refrigeration equipment increasingly relies on electronic controllers to monitor temperatures, coordinate defrost cycles, issue alarms and manage operating conditions.

Some systems can be monitored and adjusted remotely.

This technology falls within the broader category of operational technology, or OT, and the industrial Internet of Things.

France's national cybersecurity response team, CERT-FR, identified compromised refrigeration controllers including the Danfoss AK-SM and AK-SC series, along with Copeland XWEB and Dixell XWEB supervisory systems.

Its October 12–16 security alert warned operators against exposing management interfaces directly to the public internet.

The agency recommended removing internet exposure, using protected remote connections, updating supported firmware and replacing default passwords.³

A single controller may manage multiple refrigeration cabinets.

Compromise the supervisory equipment, and an attacker may gain the ability to interfere with several appliances.

The problem is not simply that refrigeration equipment contains electronics.

It is that insecure connectivity provides another pathway for interference.

A mechanical thermostat cannot receive unauthorized instructions from an internet connection it does not possess.

A connected controller can, if its security is breached.

And Europe's supermarkets have now experienced the consequences.

Connect to the Internet to Eliminate Food Waste

Danish refrigeration manufacturer Danfoss has spent years promoting connected refrigeration technology as a means of improving efficiency, reducing operating costs and limiting environmental impacts.

Its Smart Store programme advertises solutions intended to improve food safety while reducing energy consumption and supporting decarbonization.

Among its advertised benefits is one particularly unfortunate promise:

"Connect to the internet to eliminate food waste and reduce service costs."⁴

There is considerable irony in that statement today.

Remote monitoring can help technicians identify equipment problems before food spoils. Automated controls can reduce unnecessary electricity consumption. Centralized management can improve operating efficiency.

These are genuine technological benefits.

But connectivity introduces an additional responsibility.

The systems must be secured, maintained and capable of protecting their essential functions from unauthorized interference.

Otherwise, equipment promoted partly for preventing food waste can become a means of destroying it.

And perhaps the most revealing part of this story is that the security concerns were not entirely new.

Danfoss Had Documented Earlier Attacks

In October 2025, a full year before the current incidents, Danfoss published a Tech Insider newsletter discussing cybersecurity vulnerabilities and the discontinuation of service for several legacy refrigeration controllers.

The company acknowledged that its equipment had previously been targeted.

According to Danfoss, 16 Russian supermarkets using AK-SM 800 controllers were targeted by cyberattacks in 2022.

The company also reported that 40 Israeli stores were hacked in 2022, with the affected installations lacking adequate firewall or VPN protection.

Additional vulnerabilities were documented in 2023, and Danfoss advised customers to replace unsupported products or install available security updates.⁵

The manufacturer explained that changing cybersecurity requirements had influenced its decision to end service for older systems.

Independent cybersecurity researchers at Claroty also investigated refrigeration-control vulnerabilities.

In August 2026, Claroty published research involving Danfoss and Copeland management platforms, identifying weaknesses that could potentially expose equipment to unauthorized access or manipulation.

The company reported that corrected firmware had been made available for the Danfoss vulnerabilities it examined.⁶

The precise method used by the attackers in the French incidents has not been publicly established.

It would therefore be premature to claim that any particular published vulnerability was responsible.

Nevertheless, the wider history establishes something important.

The danger of inadequately secured, internet-connected refrigeration equipment was known years before the October 2026 attacks.

This raises questions about manufacturers, installers, maintenance contractors and retailers.

Who was responsible for securing the equipment?

Who ensured that outdated systems were replaced?

And why were sensitive control interfaces still accessible through inadequately protected networks?

The Paris Agreement, Net Zero and Europe's Digital Agenda

The relationship between smart technology and Europe's environmental ambitions is not speculation.

The Paris Agreement, adopted in 2015, established an international framework for limiting global temperature increases and reducing greenhouse gas emissions.

It does not require supermarkets to connect their refrigeration equipment to the internet.

Nor does it mandate any particular vulnerable controller or remote-management platform.

Nevertheless, the European Union has explicitly identified digital technology as an important part of its energy transition.

The European Commission's digital-energy strategy promotes smart meters, interconnected equipment, data sharing, remotely controlled devices and flexible electricity consumption.

Its policy materials identify investment in Internet of Things devices, connected infrastructure and digital energy systems as instrumental to achieving Europe's energy and climate objectives.⁷

On June 3, 2026, the Commission published its strategic roadmap for digitalization and artificial intelligence in energy.

The roadmap promotes electricity-grid optimization, greater energy efficiency in buildings and industry, and flexible electricity demand to support decarbonization.⁸

The practical direction is clear.

Europe wants an energy system in which electricity generation, distribution and consumption can increasingly be monitored, coordinated and optimized through digital technology.

Household appliances, industrial equipment, heating systems and electricity networks can become participants in that wider system.

These technologies may reduce energy consumption and improve reliability when properly designed and maintained.

But they also introduce questions about data security, external control, software maintenance and dependence on communications networks.

A system can become more energy-efficient without necessarily becoming more resilient.

There is no evidence that European climate policy caused the supermarket attacks or required the affected retailers to expose their controllers to the public internet.

But there is a documented relationship between Europe's decarbonization ambitions and the promotion of connected energy-management technology.

That relationship deserves scrutiny when connected systems fail.

The Environmental Cost of Destroyed Food

The refrigeration attacks also raise an environmental question.

What is the carbon footprint of the food destroyed?

Food does not magically appear on supermarket shelves.

It requires agricultural production, processing, packaging, transportation and refrigeration.

When food is discarded, the resources used to produce and distribute it have already been consumed.

According to the United Nations Environment Programme, food loss and waste account for approximately 8–10% of global greenhouse gas emissions.⁹

That figure describes the worldwide problem. It is not a calculation of emissions caused by the European cyberattacks.

The combined environmental cost of these incidents has not yet been established.

A proper assessment would require reliable information about the quantities of food destroyed, replacement requirements, additional transportation, equipment damage and energy savings normally provided by the refrigeration technology.

Such an assessment might still demonstrate substantial environmental benefits from connected refrigeration.

But those benefits should be assessed alongside the risks and consequences of system failure.

If a technology is promoted partly through its environmental benefits, the environmental costs of foreseeable failures should also be part of the accounting.

That is not opposition to energy efficiency.

It is an argument for measuring efficiency honestly.

Europe Tells Its Citizens to Stock Up

There is another development that deserves attention.

Across Europe, governments have been advising citizens to maintain emergency supplies of food, water, medications and other necessities.

On March 26, 2025, the European Commission presented its Preparedness Union Strategy, proposing guidelines to support a minimum of 72 hours of household self-sufficiency during emergencies.¹⁰

Several European countries recommend longer periods.

Sweden advises households to maintain food supplies for at least seven days.

Norway increased its recommended preparedness period from three days to one week in May 2024.

Germany recommends working toward ten days of food and drink, although authorities emphasize that even three days of supplies are a useful starting point.

Denmark recommends three days of emergency supplies.

And in October 2026, the United Kingdom launched its Be Ready campaign, encouraging households to prepare for three days of disruption.¹¹ ¹² ¹³ ¹⁴ ¹⁵

The announcements cover a range of possible emergencies, including severe weather, electricity failures, natural disasters, cyberattacks, sabotage and armed conflict.

Most of these recommendations predate the October and November refrigeration attacks.

They are not evidence that governments anticipated these particular incidents.

Nevertheless, they reveal that European authorities recognize the possibility of serious disruptions to essential services.

And the contrast is worth examining.

While governments encourage greater digitalization and interconnected energy management, they are also advising citizens to prepare for situations in which the services they depend upon may become unavailable.

Those positions are not necessarily contradictory.

Preparedness is sensible even in a well-designed infrastructure system.

But the warnings raise an obvious public question.

If governments recognize that essential systems may fail badly enough to require households to stockpile food and water, how much attention are they giving to preserving the independent operation of those systems in the first place?

The Threat They Warn About—and the Vulnerability They Built

The language surrounding European preparedness frequently emphasizes geopolitical instability.

Russia occupies a prominent place in that discussion.

The European Commission's Preparedness Union Strategy explicitly identifies Russia's war against Ukraine, state-sponsored cyberattacks, sabotage and foreign interference among Europe's security concerns.¹⁶

Those threats should not be dismissed.

Cyber-sabotage and attacks against civilian infrastructure are documented security concerns.

However, no perpetrator has been publicly identified in the European supermarket refrigeration attacks, and no evidence establishes that Russia was responsible.

The distinction matters.

A foreign adversary may exploit a security weakness.

But that does not mean the foreign adversary created the weakness.

In the refrigeration incidents, the relevant technical vulnerabilities involved exposed management interfaces, unsupported equipment, insecure configurations and weaknesses in remote-access protections.

These are questions of engineering, maintenance, procurement and institutional responsibility.

They existed regardless of who might eventually exploit them.

The geopolitical framing of a threat can explain why governments are worried about hostile actors.

It does not explain why essential equipment was operated in a manner that made interference possible.

Governments can warn citizens about foreign sabotage without allowing that warning to overshadow accountability for vulnerabilities within their own infrastructure.

The public deserves to understand both sides of the problem.

Who might attack?

And why are the systems vulnerable?

When Food Security Becomes National Security

There is a more fundamental issue beneath the refrigeration attacks.

Food security.

Few necessities are more important to social stability than reliable access to food.

History provides numerous examples of food shortages, severe price increases and supply disruptions contributing to political unrest.

Research published by the International Monetary Fund in 2011 found an association between rising international food prices and increased demonstrations, riots and conflict in lower-income countries.

The same study did not find comparable significant effects in higher-income countries.¹⁷

That distinction matters when considering modern Europe.

The current refrigeration incidents have caused serious losses for affected businesses, but they have not produced widespread famine or demonstrated an immediate threat to Europe's overall food supply.

European officials have stated that food security is not currently at risk.

Nevertheless, the larger strategic vulnerability deserves consideration.

Food supplies depend on electricity, transportation, refrigeration, communications, payment systems and functioning distribution networks.

Disrupt enough of those systems for long enough, and the consequences could extend well beyond the original technical failure.

A society does not need to be attacked with nuclear weapons for essential services to become targets of deliberate disruption.

Cyber-sabotage may offer hostile actors opportunities to interfere with infrastructure without conventional military force.

That does not mean future conflict will necessarily take the form of cyberattacks or civil insurrection.

Nor does it establish that the supermarket incidents were intended to provoke starvation or unrest.

But the ability to disrupt essential civilian systems is a security concern in its own right.

The Healthcare Question

Supermarkets are not the only institutions dependent on refrigeration and connected systems.

Hospitals, pharmacies, laboratories and public-health facilities rely on controlled temperatures to preserve vaccines, medications, blood products and biological materials.

A failure involving medical refrigeration can create consequences far more serious than financial losses.

There is no verified evidence that the vulnerabilities exploited in European supermarkets have also compromised hospital refrigeration systems.

Nevertheless, the security of medical cold-chain infrastructure deserves careful attention.

And healthcare has already experienced serious consequences from other forms of cyberattack.

On June 3, 2024, ransomware attackers compromised Synnovis, a pathology provider supporting hospitals and clinics in southeast London.

According to NHS England, the attack disrupted laboratory services and delayed more than 11,000 outpatient appointments and elective procedures.¹⁸

A separate example involves connected medical devices.

In January 2025, the U.S. Food and Drug Administration warned that certain Contec and Epsimed patient monitors contained vulnerabilities that could permit unauthorized remote access or manipulation.

In July 2025, the FDA announced that corrective software was available.

The correction removed the affected devices' networking functionality, leaving them usable for local monitoring.

The FDA reported no known injuries or deaths resulting from exploitation of those vulnerabilities.¹⁹

That response illustrates an important principle.

Sometimes the appropriate way to protect an essential device is to remove an unnecessary external connection.

Future Bayman's Paradox reporting will examine these issues in greater detail, particularly the relationship between connected medical technology, essential services and emergency preparedness.

The Power Grid Has Already Been Targeted

Cyberattacks against physical infrastructure are not hypothetical.

On December 29, 2025, attackers targeted energy infrastructure in Poland, including more than 30 wind and solar installations and combined heat-and-power facilities.

Poland's national cybersecurity authority, CERT Polska, described a deliberately destructive campaign against industrial-control systems.

At the renewable-energy installations, the attacks disrupted communications with electricity distribution operators, although the facilities continued producing electricity.

A separate attack temporarily stopped a steam turbine and water-treatment equipment at a heating-and-power facility serving approximately 50,000 residents.

Operators prevented a wider interruption to heating supplies.²⁰

The incidents demonstrate that digital interference can affect physical energy infrastructure.

They do not establish that all renewable-energy installations are equally vulnerable or that any compromise would automatically cause a major blackout.

But they provide a documented example of the risks associated with inadequately protected industrial-control technology.

Electricity generation, heating, refrigeration and water treatment perform different functions.

Yet each may depend on computerized control systems whose security is essential to safe operation.

When the Power Company Controls Your Thermostat

External control of equipment does not always involve hacking.

On August 30, 2022, approximately 22,000 Colorado households experienced temporary restrictions on their internet-connected thermostats during an electricity-demand emergency.

The residents had voluntarily enrolled in Xcel Energy's AC Rewards programme.

Under the programme, the utility could adjust participating thermostats to reduce electricity demand.

During the August event, which involved extreme heat and an unexpected outage at a major power plant, participants temporarily lost the ability to override those adjustments.²¹

This was not a cyberattack.

It was an authorized utility response carried out through a demand-management programme.

But it demonstrated something important.

An outside organization possessed the technical ability to override household temperature preferences—and exercised that ability.

That raises questions about consent, emergency overrides and the extent of external authority over essential household equipment.

The issue becomes especially significant for people with medical needs or those dependent on electric heating and cooling.

Not every connected thermostat or heat pump operates under such an arrangement.

But the Colorado incident demonstrates why the difference between owning a device and retaining control over its operation deserves attention.

The same wider questions arise with connected vehicles, building-management platforms and other digitally managed infrastructure.

A Cold Night in Newfoundland

These concerns are not limited to Europe.

Newfoundland and Labrador is increasingly encouraging households to convert from oil heating to electric systems, including heat pumps.

Not every heat pump is connected to the internet, and many retain independent local controls.

Nevertheless, ordinary electric heat pumps still depend on a functioning electricity supply.

A prolonged outage in the middle of a Newfoundland winter presents consequences that go far beyond inconvenience.

The same electricity system supports hospitals, communications, medical equipment and other essential services.

Meanwhile, Muskrat Falls and the Labrador Island Link rely on sophisticated electrical-control and protection technology.

These systems are not equivalent to internet-connected supermarket controllers, and there is no verified evidence that they possess the same vulnerabilities.

But the general questions about resilience, emergency operation and cybersecurity are legitimate.

What happens when a household has no independent heating source and the electrical system fails?

What protections exist for people dependent on electrically powered medical equipment?

And how would proposed industrial wind developments withstand deliberate attacks against their control systems?

These questions will form the basis of a forthcoming Bayman's Paradox investigation into Newfoundland's heat pumps, electricity infrastructure, healthcare and the cybersecurity implications of major energy projects.

Why I Never Trusted the Internet of Things

I have questioned the wisdom of the Internet of Things and so-called smart technology for years. My concern was never simply that electronic equipment might malfunction. Mechanical equipment can fail too. What bothered me was the growing assumption that connecting more and more appliances and essential services to external networks automatically represented progress. Refrigeration, heating, vehicles and medical equipment were becoming increasingly dependent on software and communications infrastructure that their owners might neither understand nor control. I saw little reason to celebrate that dependency simply because it promised convenience, energy savings or lower emissions. The European refrigeration attacks are not proof that every connected product is inherently unsafe, but they are a very real demonstration of the vulnerability I have long questioned. When did making essential equipment remotely controllable become an unquestioned improvement?

My second concern is what happens after these vulnerabilities are exploited. Governments and corporations may respond to digital disruptions by introducing additional regulations, monitoring requirements, mandatory security measures or greater centralized control. Some safeguards will undoubtedly be necessary. But I remain skeptical of the assumption that every failure involving an interconnected system should be answered by surrendering still more independence to centralized institutions. There is no established evidence that the European refrigeration attacks were orchestrated to justify restrictions on citizens. Nevertheless, genuine emergencies can create pressure for expanded institutional powers, and the public has every right to question whether those powers are necessary, proportionate and temporary. I am not convinced that less individual control is automatically the price we must pay for a smarter future.

The Real Cost of a Smart Future

The European refrigeration attacks have exposed a problem considerably larger than spoiled groceries.

They raise questions about food security, environmental accounting, critical infrastructure, healthcare and the increasing dependence of ordinary people on connected technology.

The same systems promoted for energy efficiency and reduced emissions can introduce additional vulnerabilities when their security is inadequate.

That does not mean connectivity must be abandoned.

It means that essential infrastructure should be designed to remain safe, resilient and accountable even when networks fail or malicious actors attempt to interfere.

The pursuit of net-zero objectives should not overshadow the consequences of losing reliable access to food, electricity, heating or medical care.

Nor should warnings about foreign adversaries obscure the responsibility of manufacturers, operators and governments to address weaknesses within their own systems.

If European authorities believe the threat of essential-service disruption is serious enough to justify household stockpiling recommendations, then the preservation of reliable, independently operable infrastructure deserves equal attention.

The public should be asking who can access these systems, who maintains them, who bears responsibility when they fail and whether their essential functions can continue when external connections are unavailable.

In its pursuit of a smarter, greener future, Europe may have overlooked one rather important engineering principle: never make a system easier to control without asking who else might gain control of it.

After all, what good is a smarter freezer if it no longer knows whose instructions to follow?

Related Bayman's Paradox Articles

Off Target: How the Paris Agreement Keeps Running After 1.5°C Is Gone

https://baymansparadox.com/post/off-target-how-the-paris-agreement-keeps-running-after-15c-is-gone

GFANZ and the Paris Agreement: ESG Pressure, Financial Levers, and the Bypass of Sovereignty

https://baymansparadox.com/post/gfanz-and-the-paris-agreement-esg-pressure-financial-levers-and-the-bypass-of-sovereignty

Behind the Green Curtain: How Global Contracts and Climate Branding Drove the Wind and Hydrogen Push in Newfoundland

https://baymansparadox.com/post/behind-the-green-curtain-how-global-contracts-and-climate-branding-drove-the-wind-and-hydrogen-push-in-newfoundland

References