A second wave of cyberattacks against European supermarket refrigeration systems has turned a cybersecurity weakness into a direct product-loss event. On 2 November, retailers in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland reported refrigeration incidents. Freezer temperatures in some locations were reportedly driven as high as 50°C, forcing stores to remove fresh and frozen goods from sale.
The incidents followed the October attack on hundreds of French supermarkets. The pattern matters: connected refrigeration is no longer only an operational technology issue. When a remote attacker can alter a defrost cycle or temperature setting, cyber risk becomes food-safety risk, inventory risk and business-interruption risk within hours.
The most dangerous delay is between manipulation and discovery
A refrigeration controller may continue to communicate while the physical environment is already moving outside safe limits. If the controller itself is compromised, relying exclusively on its dashboard or alarms creates a single point of trust.
This is where an independent condition-monitoring layer becomes valuable. Sensefinity's Sensorice uses separate sensors to measure temperature and humidity and sends data through a gateway to the cloud. Configurable alerts can notify responsible teams by email or SMS when thresholds are crossed.
Sensorice does not identify malware or attribute an attack. Instead, it detects the physical consequence that operations teams need to act on: an unexpected temperature rise, a sustained excursion or a pattern that does not match normal refrigeration behaviour.
An operational hedge against cyber-physical loss
Cybersecurity controls should prevent unauthorised access. Sensorice addresses a different question: if prevention fails, how quickly can the business see the physical impact and intervene?
When deployed separately from the refrigeration controller and its management network, Sensorice can provide an additional source of condition data. That separation matters during an incident because the alert does not have to depend on the same controller that may have been manipulated.
A practical workflow can be configured around four steps:
Measure: Sensorice records the real temperature and humidity around the protected goods.
Detect: thresholds, persistence rules and escalation levels distinguish a short fluctuation from a developing excursion.
Alert: store, maintenance, facilities, food-safety and security teams receive timely notifications by email or SMS.
Act and document: teams isolate the affected equipment, move stock, verify product condition and retain a time-stamped record of the event and response.
This creates an operational hedge against cyber risk. It cannot stop an attacker from reaching a vulnerable controller, but it can reduce the time between manipulation and human intervention. In a cold-chain incident, that interval can determine whether stock is transferred in time or discarded.
Alerts need context, ownership and escalation
A temperature alert alone is not a response plan. Retailers need rules that connect each sensor to the correct cabinet, room, product category and responsible team.
Sensorice deployments can support:
warning and critical thresholds for each refrigeration zone;
alerts based on both temperature and duration, reducing noise from brief door openings;
escalation when the first contact does not acknowledge an alert;
monitoring across multiple stores from one operational view;
time-stamped reports for maintenance, food-safety review and incident investigation;
comparison between independent sensor readings and the refrigeration control system.
The objective is not to generate more alarms. It is to produce the right alarm early enough for a named person to make a decision.
Better evidence for continuity, claims and risk management
The European incidents also show why retailers need reliable records after the immediate crisis. Insurers, auditors, suppliers and food-safety teams may need to establish when temperatures started rising, how long goods were exposed, who was warned and what corrective action followed.
Sensorice data can contribute to that evidence trail. It can help separate unaffected stock from goods requiring quarantine or disposal and provide a factual timeline for maintenance and incident-response teams.
This does not guarantee insurance coverage or replace the terms of a cyber or property policy. It can, however, strengthen the evidence used to demonstrate monitoring, escalation and loss-mitigation measures.
Sensorice complements — it does not replace — OT cybersecurity
The first priority remains securing the refrigeration environment: remove unnecessary public internet exposure, replace default credentials, patch supported controllers, retire unsupported equipment, restrict remote access, segment networks, monitor administrative activity and maintain a tested isolation plan.
Sensorice should be treated as a compensating operational control and an independent source of physical truth. It does not detect malware, prevent ransomware, identify an attacker or replace network and operational-technology security.
Its role is narrower and immediately practical: identify dangerous physical change, alert the people who can intervene and preserve a record of what happened.
From connected refrigeration to resilient refrigeration
The second European wave shows that the issue is not confined to one retailer or one country. Any organisation that stores temperature-sensitive goods should assume that a connected controller can fail, be misconfigured or be manipulated.
Resilience comes from not trusting a single signal. A refrigeration controller operates the equipment. An independently deployed Sensorice layer verifies the condition around the goods and can raise timely alarms when reality diverges from expectations.
Sensefinity can help retailers, cold stores, food distributors and pharmaceutical operators assess sensor placement, alert thresholds, escalation paths and reporting requirements for a pilot deployment.
Sources and product information