German Supermarkets Hit by Refrigeration Cyberattack

German supermarket chains Edeka, CAP and REWE confirmed on 3 November 2026 that hackers had taken over their refrigeration and freezing systems, forcing staff to discard large quantities of defrosted food. The incident marks a sharp escalation in a Europe-wide cyberattack targeting the cold chain, following similar disruptions in France, Belgium, Sweden, Ireland, the Netherlands and other countries.

What Happened: German Supermarkets Hit by Refrigeration Hack

Around midnight on Sunday 2 November, an Edeka branch in Reisbach, Bavaria, had its cooling units remotely set to 50°C, while a REWE store in Raesfeld, North Rhine-Westphalia, suffered the same fate. An Edeka market in Lilienthal reported 70°C at the fresh-food counter and 30°C inside cold rooms, leading to the disposal of an entire container of food. CAP-Märkte in Wuppertal and Wetter-Volmarstein were also affected. Police in Oldenburg and Landshut have opened investigations into data espionage and data alteration.

The attacks mirror the October French supermarket hack that struck up to 700 stores on 11–12 October, and the second European wave that hit Belgium, Sweden, Ireland, Luxembourg, Estonia, Finland, Portugal and the Netherlands overnight into 2 November.

How Hackers Took Over Cooling Systems

Vulnerable Internet-Connected Controllers

The compromised devices are small internet-connected boxes that let installers monitor freezers and cold rooms remotely. In most cases, the affected equipment came from Danish manufacturer Danfoss or Italian-American firm Copeland. Danfoss confirmed that its controls were involved and pointed to outdated software lacking security updates. Security researchers had previously warned that Danfoss AK-SM800 and AK-SC355 controllers, as well as Copeland/Dixell XWEB devices, were exposed to the internet with weak default credentials.

By sending commands to these controllers, attackers triggered defrost cycles with extreme temperature setpoints. In some French stores, temperatures reached 50°C to 95°C, causing equipment to melt and, in at least one case, starting a fire. The result is spoiled food, financial losses and significant operational disruption. Retailers were advised to disconnect cooling systems from the public internet and connect only through a secured network.

Why Sabotage Is Suspected

No group has claimed responsibility, and no ransom demands have been made. Experts therefore suspect sabotage rather than extortion. Possible actors range from state-linked groups to a lone-wolf hacker, according to European security analysts. The deliberate targeting of food supply chains rather than financial gain has alarmed officials across the EU.

Timeline of the Europe-Wide Cold-Chain Attacks

• 11–12 October 2026: Up to 700 French supermarkets hit, including Intermarché, Netto, Carrefour and Monoprix.
• 2 November 2026: Second wave strikes Belgium, Sweden, Ireland, Luxembourg, Estonia, Finland, Portugal and the Netherlands, affecting over 100 shops.
• 3 November 2026: German supermarkets Edeka, CAP and REWE confirm their cooling systems were compromised.

Impact and Official Response

EU Agriculture Commissioner Christophe Hansen described the attacks as "a deliberate attempt to disrupt our food chain and undermine consumer confidence." EU agencies held emergency talks to coordinate a response, while Italy's government convened intelligence services and cyber experts after Monday's wave. The director of Italy's National Agency for Cybersecurity stressed that "timely information exchange is essential to prevent and respond to cyberattacks."

The European Commission is now focusing on food supply chain resilience, urging retailers and logistics operators to review their preparedness plans. Although EU food security is not currently at risk, the incidents have caused substantial food waste and tangible business impacts, with a Belgian butcher alone losing an estimated €15,000 of meat.

FAQ: German Supermarket Cyberattack

Which German supermarkets were affected?

Edeka, CAP and REWE confirmed that their refrigeration systems were compromised. At least two Edeka stores, a REWE market and two CAP-Märkte were hit, with temperatures reaching up to 70°C at some locations.

How did hackers take over cooling systems?

Hackers exploited internet-connected refrigeration controllers from Danfoss and Copeland. Many devices ran outdated software, used default passwords or were directly exposed to the internet without proper security.

Who is responsible for the supermarket hacks?

No individual or group has claimed responsibility. Because no ransom was demanded, investigators suspect sabotage. European authorities have not publicly attributed the attacks to any specific actor.

What should retailers do to protect refrigeration systems?

Danfoss and Copeland have advised supermarkets to disconnect cooling and freezing systems from the public internet and connect only through a secured network. Applying firmware updates and changing default credentials are critical steps.