Connected Infrastructure Under Attack: Europe’s Supermarket Cyber Incidents Highlight IoT Security Risks

Cyberattacks targeting supermarket refrigeration systems demonstrate how vulnerable connected industrial equipment can become. As IoT deployments expand, securing the networks and infrastructure supporting these devices is becoming increasingly important.

A Growing Threat to Connected Infrastructure

A series of cyberattacks targeting commercial refrigeration systems at supermarkets and other retail businesses across Europe has highlighted the growing security risks associated with connected industrial equipment.

In October 2026, hundreds of supermarket locations in France were reportedly affected by attacks that compromised refrigeration management systems. The incidents involved equipment from manufacturers including Danfoss, Copeland and Dixell. Attackers manipulated refrigeration settings, causing temperatures to rise dramatically, resulting in spoiled food, financial losses and temporary operational disruption. Some reports also described localized fires.

Further incidents were reported in early November, with businesses in several other European countries affected. Although the incidents shared similarities, their geographical spread and attribution should be treated carefully: not every reported incident has been independently linked to the same campaign.

The attacks demonstrate that vulnerabilities in seemingly routine industrial equipment can have consequences extending well beyond IT systems, potentially disrupting physical operations and essential supply chains.

Exploiting Weaknesses in Industrial IoT Systems

The reported attacks did not necessarily require sophisticated zero-day vulnerabilities or advanced artificial intelligence. Rather, they highlighted weaknesses associated with exposed management interfaces, inadequate authentication and insufficiently protected industrial control systems.

Commercial refrigeration equipment increasingly incorporates remote monitoring and management capabilities. These allow manufacturers, maintenance providers and supermarket operators to monitor temperatures, adjust settings and manage installations across multiple locations.

However, connecting operational technology (OT) to external networks also creates additional potential entry points.

Management interfaces exposed directly to the public internet, outdated software, weak credentials and inadequate network segmentation can provide opportunities for attackers to gain unauthorized access.

This is not unique to refrigeration. Similar risks exist across industrial automation, building management, energy infrastructure, logistics and other environments increasingly dependent on connected devices.

The Cellular IoT and Mobile Network Dimension

An important wider consideration is the role of cellular connectivity in the growing industrial IoT ecosystem.

Businesses increasingly use cellular M2M and IoT connectivity to link geographically dispersed equipment, sensors, monitoring systems and industrial gateways. Mobile networks provide a practical way to connect installations where fixed connectivity is unavailable, impractical or insufficiently flexible.

These connections introduce additional security considerations.

For example, poorly configured cellular routers, publicly accessible management interfaces, inadequate access controls or insufficient network isolation can expose industrial devices to unauthorized access. Such weaknesses are possible in cellular deployments, although there is no established evidence that cellular gateways or mobile operator networks were the entry point in the European supermarket incidents.

Security therefore needs to extend beyond the connected device itself to include the communication infrastructure supporting it.

Measures such as private Access Point Names (APNs), VPNs, network segmentation, strong authentication and restricted management access can help reduce exposure. Their effectiveness depends on correct implementation and must be complemented by appropriate security controls at device, application and network levels.

Protecting the Mobile Network Infrastructure

As cellular connectivity becomes increasingly important to industrial IoT, mobile network operators and IoT service providers have a growing responsibility to secure the infrastructure that enables these devices to communicate.

This involves more than protecting individual connections. Mobile networks must also safeguard their underlying signaling infrastructure, which supports communication, authentication, roaming and interconnection between networks.

Signaling protocols such as SS7 and Diameter, alongside the 4G and 5G signaling architecture, are essential components of mobile connectivity. Vulnerabilities or malicious activity involving these systems can create risks for operators and their customers.

Integrated signaling security, traffic monitoring and protection mechanisms are therefore important elements of a comprehensive mobile network security strategy.

For operators supporting large-scale IoT deployments, maintaining control over signaling traffic and securing network interfaces becomes increasingly relevant as the number and diversity of connected devices grow.

Geopolitical Tensions and Cybersecurity Attribution

The incidents have also acquired a geopolitical dimension. The French government has publicly accused Iran’s Islamic Revolutionary Guard Corps of involvement in the October attacks and has raised the matter through diplomatic channels, including summoning the Iranian ambassador and seeking European-level sanctions.

Iran has rejected the allegations.

These statements represent the French government’s attribution and should be distinguished from independently established technical findings. Furthermore, the attribution of the October incidents should not automatically be extended to the subsequent attacks reported elsewhere in Europe.

The developments nevertheless illustrate how cyberattacks against commercial and industrial infrastructure can become matters of national security, particularly when they affect essential services and supply chains.

A Broader Approach to IoT and Network Security

The European supermarket incidents provide a reminder that the expansion of connected infrastructure must go hand in hand with stronger security.

Protecting industrial IoT environments requires a layered approach, combining secure device configurations, updated software, strong authentication, restricted remote access and effective network segmentation. Cellular connectivity should be deployed with appropriate isolation and access controls, while operators must also protect the mobile network infrastructure carrying the traffic.

For telecommunications operators, signaling security is an important part of this wider picture.

BroadForward develops intelligent signaling software for mobile network routing, interworking and security. Its portfolio includes signaling firewalls and security solutions covering SS7, Diameter and 4G/5G networks, helping operators protect their signaling infrastructure as connectivity requirements evolve.

As industrial IoT, mobile connectivity and operational technology become increasingly interconnected, securing not only the devices but also the networks enabling their communication will be essential to building resilient digital infrastructure.