Cyberattacks are no longer just about stolen passwords, compromised emails, or locked computer systems. A series of incidents across Europe has demonstrated how cybercriminals can potentially interfere with the physical equipment businesses depend on every day.
On 2 November 2026, supermarkets in Sweden, Belgium, Estonia, and other European countries experienced suspected cyberattacks affecting refrigeration systems. Attackers reportedly manipulated temperature controls remotely, forcing businesses to remove products and discard potentially spoiled food.
The incidents followed a major cyberattack in France just three weeks earlier, where hundreds of supermarkets experienced similar disruptions.
For businesses in New Zealand, these events raise an important question: If attackers can remotely interfere with supermarket refrigeration systems in Europe, what other connected business systems could be vulnerable?
The answer extends far beyond supermarkets.
What Happened in Sweden? A Cyberattack With Real-World Consequences
In early November 2026, supermarkets across several European countries reported unexpected changes to refrigeration temperatures.
At an ICA supermarket in Sjöbo, southern Sweden, refrigeration settings were reportedly changed to 50°C, leading staff to dispose of affected products.
Other affected retailers included Coop in Sweden, Carrefour and Delhaize in Belgium, and supermarket operators in Estonia and neighbouring countries.
Unlike conventional ransomware attacks, which typically involve encrypting files and demanding payment, these incidents targeted equipment responsible for physical business operations.
Refrigeration systems increasingly rely on connected software that enables remote monitoring, maintenance, and temperature adjustments. While these capabilities improve operational efficiency, poorly secured remote access can also create opportunities for attackers.
Sweden’s National Cyber Security Centre acknowledged the incidents on 2 November and began coordinating with affected organisations and European cybersecurity counterparts.
The full extent of the incidents, the attackers’ identities, and whether every affected business experienced the same attack method remain under investigation.
The immediate business impact, however, is clear: a cybersecurity incident can cause physical damage, inventory losses, operational disruption, and financial consequences without requiring attackers to steal a single customer record.
France Experienced a Similar Cyberattack Just Three Weeks Earlier
The incidents in Sweden closely resemble a large-scale refrigeration cyberattack that affected French supermarkets overnight on 11–12 October 2026.
According to reporting by Le Monde, hundreds of supermarkets across France experienced manipulated refrigeration controls, resulting in significant food losses.
Affected retailers included Intermarché, Carrefour, E.Leclerc, Monoprix, and Coopérative U.
Investigations identified refrigeration control software associated with Danish manufacturer Danfoss as an important element of the affected systems. Danfoss noted that many affected installations used obsolete products that no longer received security updates.
Attackers reportedly changed defrost settings, increased temperatures, and extended defrost cycles, delaying detection and increasing potential losses.
In one reported case, a supermarket operator estimated approximately €21,000 in lost inventory.
The French incident illustrates a particularly concerning cybersecurity risk: technology designed to improve business efficiency can become an operational vulnerability when security maintenance and access controls are neglected.
Although the Swedish and French incidents share important technical and operational similarities, investigators have not conclusively established that the same attackers were responsible.
A Wider Pattern: Cyberattacks Are Moving Beyond Traditional IT Systems
The incidents in France and Sweden are not isolated examples of the broader cybersecurity challenges facing businesses worldwide.
Several recent developments demonstrate how interconnected systems, third-party technology, and inadequate security monitoring can create significant vulnerabilities.
1. Sweden’s Miljödata Breach: Third-Party Security Risks
In August 2025, Swedish IT service provider Miljödata suffered a cyberattack that reportedly affected personal information relating to approximately 2.2 million individuals.
The compromised information included identity details, contact information, and sensitive personal records.
In October 2026, Sweden’s privacy regulator announced a SEK 1.8 million administrative fine after identifying deficiencies in security controls, including inadequate monitoring.
This incident highlights the importance of assessing the cybersecurity practices of external technology providers.
Businesses may maintain strong internal security policies while remaining exposed through suppliers, contractors, or software platforms.
2. France’s Government Cyberattacks: Identity and Monitoring Weaknesses
France’s national cybersecurity agency, ANSSI, published findings in September 2026 concerning cyberattacks against the country’s public finance administration.
The investigation identified weaknesses involving stolen credentials, insufficient strong authentication, exposed applications, and gaps in security monitoring.
These weaknesses contributed to unauthorised access and data exfiltration.
Although this was a different type of attack from the supermarket refrigeration incidents, the underlying lesson is similar: insufficient visibility and poorly controlled access can allow threats to develop without timely intervention.
3. New Zealand’s Own Cybersecurity Warnings
New Zealand is not immune to these risks.
The National Cyber Security Centre’s 2025 Cyber Threat Report specifically warns about operational technology, legacy systems, third-party dependencies, and internet-exposed equipment.
The NCSC identified numerous operational technology devices in New Zealand accessible from the public internet, with owners potentially unaware of the exposure.
It also reported observing techniques associated with attacks against IT helpdesks and supply chains within New Zealand.
These findings reinforce that the vulnerabilities highlighted by the European incidents are relevant to local organisations.
What Do These Cyberattacks Have in Common?
Although the incidents involved different organisations, countries, and attack methods, several recurring cybersecurity weaknesses deserve attention.
Internet-connected business systems. Equipment and applications that can be accessed remotely create additional potential entry points if connections are not properly secured.
Outdated technology. Unsupported software, unpatched devices, and legacy systems can remain vulnerable to known security weaknesses.
Third-party access. Vendors, maintenance contractors, and external IT providers may require access to critical systems. Without appropriate controls, these relationships can introduce additional risk.
Insufficient monitoring. Organisations may not detect suspicious behaviour quickly enough to prevent damage or limit disruption.
Operational dependence on technology. When critical systems fail, the consequences can extend beyond IT departments to customer service, inventory, revenue, and business continuity.
These similarities do not establish that the attacks were coordinated. They demonstrate how recurring security weaknesses can expose organisations in different industries and countries.
Could a Similar Cyberattack Happen in New Zealand?
Yes. The technical conditions that can enable these types of attacks are not unique to Europe.
New Zealand businesses increasingly depend on connected technology to manage daily operations.
Examples include:
- Retail and hospitality: Refrigeration, point-of-sale systems, inventory platforms, and connected building controls.
- Healthcare: Patient management systems, connected medical equipment, and sensitive records.
- Manufacturing and logistics: Industrial controllers, warehouse automation, and temperature-controlled storage.
- Professional services: Microsoft 365, cloud applications, identity management, and client information systems.
- Construction and property management: Building management systems, access controls, and remote monitoring equipment.
For an Auckland business, a cyber incident might involve compromised employee credentials, disruption to cloud services, unauthorised access to a supplier’s system, or interference with connected operational equipment.
The precise risks vary by industry, but the underlying concern remains the same.
A business does not need to be a multinational corporation to experience a serious cybersecurity incident.
In fact, smaller organisations may face additional challenges because they often operate with limited internal IT resources, ageing infrastructure, and insufficient security monitoring.
Seven Cybersecurity Measures New Zealand Businesses Should Prioritise
The recent European incidents provide an opportunity for businesses to reassess their cybersecurity readiness before an incident occurs.
1. Identify All Connected Devices and Systems
Maintain an accurate inventory of computers, servers, network equipment, cloud applications, and internet-connected operational technology.
Businesses cannot effectively protect systems they do not know exist.
2. Review Remote Access and Third-Party Permissions
Restrict remote access to authorised users and approved service providers.
Where remote connectivity is necessary, use secure access methods, strong authentication, and appropriate monitoring.
Avoid exposing operational equipment directly to the public internet.
3. Update and Replace Vulnerable Technology
Apply security patches promptly and identify unsupported software or hardware.
Where immediate replacement is impractical, introduce compensating security controls and develop a replacement plan.
4. Strengthen Identity Security
Implement multifactor authentication, review privileged accounts, and promptly remove access when employees or contractors leave.
Identity protection is particularly important for cloud platforms such as Microsoft 365.
5. Introduce Continuous Security Monitoring
Cybersecurity should not depend entirely on employees noticing something unusual.
Appropriate monitoring, endpoint detection, and security response capabilities can help organisations identify suspicious activity earlier.
6. Separate Critical Operational Systems
Where appropriate, isolate operational technology from ordinary business networks.
Network segmentation can help limit the movement of attackers between systems and reduce the potential impact of a compromise.
7. Prepare and Test an Incident Response Plan
Every business should understand what happens when a critical system becomes unavailable.
Identify responsible personnel, establish communication procedures, maintain tested backups, and prepare recovery processes.
For businesses operating refrigeration, industrial, or other physical control systems, incident response planning should also consider equipment safety and manual operating procedures.
Why Managed IT and Cybersecurity Should Work Together
The European refrigeration incidents demonstrate why cybersecurity cannot be treated as a separate concern from everyday IT operations.
A secure business environment requires coordinated management of devices, networks, user identities, applications, third-party access, and operational dependencies.
For small and medium-sized businesses, maintaining this level of oversight internally can be challenging.
A managed IT services provider can help establish consistent security practices, maintain technology infrastructure, identify potential vulnerabilities, and coordinate responses to emerging threats.
At CorIT Tech, we help Auckland and New Zealand businesses strengthen their IT environments through managed IT services, cybersecurity monitoring, Microsoft 365 management, endpoint protection, and strategic technology planning.
Our approach focuses on identifying risks, improving visibility, and helping businesses maintain secure, reliable technology environments.
For organisations with specialised industrial or operational technology, effective protection may also require coordination with equipment manufacturers and qualified OT security specialists.
The Global Cyber Threat Is a Local Business Concern
The incidents in Sweden, France, and other European countries are a reminder that cybersecurity threats can cross borders and affect industries in unexpected ways.
An attack does not need to compromise a company’s financial database to create serious damage.
Disrupted equipment, unavailable systems, lost inventory, and interrupted operations can all have significant financial consequences.
For New Zealand businesses, the appropriate response is not panic. It is preparation.
Understanding where critical systems are exposed, maintaining effective security controls, and establishing clear incident response procedures can make a meaningful difference.
Cybersecurity is no longer simply about protecting information. It is about protecting the continuity of the business itself.
Protect Your Business With CorIT Tech
Could your business identify suspicious activity before it interrupts critical operations?
Are your connected systems, Microsoft 365 environment, employee accounts, and third-party access arrangements properly secured?
CorIT Tech helps Auckland businesses review their IT environments, strengthen cybersecurity controls, and build more resilient technology operations.
Don’t wait for a cybersecurity incident to expose a weakness in your business.
Speak With CorIT Tech About Your Cybersecurity and Managed IT Needs
CorIT Tech — Managed IT Services and Cybersecurity Solutions in Auckland, New Zealand.
