Fridge cyberattacks hit 3 German supermarkets: How likely are further attacks?

German supermarkets have now recorded three cases of cyberattacks on fridges and freezers. Here’s what we know about the likelihood of further attacks, who might be behind the attacks and their motives.

Edeka, REWE and CAP-Markt hit by cyberattack

Around midnight on Sunday, November 2, a branch of Edeka in Reisbach, Bavaria, was hit by a cyberattack on its fridges and freezers, according to a report by Bayerischer Rundfunk (BR).

Hackers turned the fridge and freezer temperatures up to 50 degrees celsius, forcing staff returning to the Edeka Ernst branch on Monday morning to throw away huge amounts of defrosted and warm food. The supermarket said it would restock fridges and freezers by Tuesday morning.

A REWE branch in Raesfeld, North Rhine-Westphalia, was also affected, with staff arriving Monday morning to find fridge and freezer temperatures at 50 degrees. A CAP-Markt branch in Volmarstein, also in North Rhine-Westphalia, is the third affected supermarket. There, fridges and freezers were only turned up to 10 degrees, though it is currently unclear whether this was due to a cyberattack or a technical fault.

These appear to be among the first fridge and freezer cyberattacks in Germany, following attacks in recent weeks across the Netherlands, Sweden, Ireland, Estonia, Belgium, Finland, Luxembourg, France, Italy and Portugal.

Around 400 supermarkets across France were affected, along with 17 small branches in the Netherlands, around 15 Carrefour branches in Belgium, 13 supermarkets in Ireland, around six Coop branches in Sweden, and just one supermarket in Estonia.

How likely are further cyberattacks on German supermarkets?

The attacks targeted software from the engineering firm Danfoss, which allows supermarkets to remotely manage fridges and freezers. The Danish company has said the affected cold units were running security software that had not been updated, increasing vulnerability to hacks.

The risk of further attacks varies by country and supermarket. Speaking to Berliner Morgenpost, an “insider who operates several large [supermarket] branches” explained that German supermarkets are less vulnerable to widespread attacks than those in neighbouring France.

This is because the German supermarket industry is more decentralised. For example, Edeka and REWE branches are run by individual independent retailers under the Edeka or REWE brand. Each retailer can choose which fridge and freezer system it uses.

“Such a scenario would be more realistic [at Lidl and Aldi],” the insider noted. These German supermarkets are centrally managed. Aldi and Lidl refused to comment on the risk to their cooling units.

Who is behind the fridge and freezer hacks?

It is currently unclear who is behind the cyberattacks. However, speaking to BR, experts suggested that since hackers made no financial demands of supermarkets, sabotage is a likely motivation.

Speaking to the Guardian about the Europe-wide attacks, Rafe Pilling, senior director for threat intelligence at cybersecurity company Sophos, said he believed there to be two plausible actors. 

“The two most plausible attribution scenarios for me are some kind of state-based signalling and demonstration of capability or some kind of lone-wolf hacker that is conducting these attacks for their own personal reasons,” Pilling said.

He added that the state-linked actor scenario was most likely, namely one connected to North Korea, China or Russia. European intelligence bodies have long warned that Russian sabotage against Western European infrastructure is varied in nature and likely to increase in coming months. 

Germany has logged over 165 suspected sabotage cases so far in 2026, on airports and critical infrastructure such as substations. Of course, not all of these cases can be definitively tied to Russia.

What is the motivation behind the attacks?

So why are frozen pizzas and cheese aisles the target? “The retail sector is an easy target because retail chains operate a large number of refrigeration controllers, building management systems, access control systems and till systems,” Tom Hegel of cybersecurity firm SentinelOne told BR.

Supermarkets are also an effective sabotage target due to just-in-time logistics. Empty supermarket shelves can be psychologically distressing for civilians, and “disruptions become noticeable after just a few days,” security expert Christopher Kunz of Heise told Berliner Morgenpost.

“The attack on [Dutch supermarket] Albert Heijn took place on Sunday afternoon; there are now many empty shelves. Highly perishable goods will be sold out within a day if they are not restocked,” Kunz explained.

EU Agriculture Commissioner Christophe Hansen said that while food security is not currently at risk in Europe, the attacks were “deeply worrying”, should be taken “very seriously” and were a “deliberate attempt to disrupt our food supply chain and undermine consumer confidence”.

The European Commission and German police are now investigating the recent cases.