Hackers Set Supermarket Freezers to 122°F
Supermarket freezer cyberattacks sound like a strange side road in technology news until the temperature display says 122 degrees and employees start throwing food away. That happened in Europe this week. Also today: federal regulators say a payment processor hid the real cost of its contracts, attackers used DaySmart accounts to send messages and create bookings, and NIST has published a cybersecurity guide for people who work for themselves.
Hackers set supermarket freezers to 122°F
Refrigeration and freezer systems at supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia were disrupted Monday by what several companies described as cyberattacks or IT incidents. The Associated Press reported that some stores had to discard food after temperatures rose. One Swedish ICA store said attackers set its equipment to 50 degrees Celsius, or 122 degrees Fahrenheit. In Ireland, 13 SuperValu stores removed chilled and frozen products from sale as a precaution. The parent company said the incident was resolved later Monday.
BleepingComputer counted more than 115 affected locations across grocery chains and independent stores. The incidents don’t appear identical in every country, and investigators haven’t established whether one coordinated attacker hit them all. Some stores lost product. An Estonian store caught the temperature change within minutes and avoided damage. That difference is the useful part of the story.
A refrigeration controller is operational technology. It doesn’t merely record a temperature; it controls compressors, fans and defrost cycles that physically change the temperature. Connecting that controller to a network makes remote monitoring and maintenance easier. It also creates a path from an internet connection to the food in the case. Reports link at least some incidents to older Danfoss control systems, but the exact entry method remains unknown. A vendor involved in Belgium said some installations also need physical changes, not just a software update.
I don’t think the lesson is “never connect a freezer to the internet.” Remote alarms probably helped some stores respond quickly. The lesson is that the connection needs boundaries: no direct exposure to the public internet, tightly controlled vendor access, supported controllers, useful logs, independent temperature alarms and a way for staff to take over locally. If a controller is too old to secure, the upgrade decision belongs in the same budget as the compressor it operates. It isn’t office IT just because it has an IP address.
This is another example of the problem behind the infrastructure businesses rely on but rarely think about. A store can recover its network and still lose a freezer full of inventory. Recovery planning has to include the physical process, the people who notice it failing and the time available before the damage becomes expensive.
Technology is rarely just about the technology
Some of the most important technology stories aren’t product launches at all. They’re about health, privacy, education, law, accessibility, work, and what happens when technology reaches ordinary people. Browse more Raymond Tec News for the stories worth understanding without the hype.
The payment-processing quote left out the expensive parts
The Federal Trade Commission and Washington state say Riverside Payments and affiliate Cascade Equipment Leasing promised small businesses payment-processing savings of 40 to 60 percent while omitting fees and burying long contract terms. According to the FTC’s complaint and proposed settlement, the quote sheets left out activation, batch, inactivity and data-security compliance fees. The processing agreement ran for three years, renewed automatically and included a $695 early termination charge. The equipment lease lasted a year longer and renewed separately.
These are allegations resolved through a stipulated order, not findings from a completed trial. The proposed order imposes a $32.1 million judgment that will be suspended after $600,000 is paid because the defendants say they can’t afford the full amount. If a court approves it, Riverside customers must be notified that they can cancel during a 60-day window without the early termination penalty.
The broader lesson is less dramatic and more useful: compare the total cost of accepting a card, not just the advertised processing rate. Ask for every recurring, per-transaction and conditional fee. Price the terminal lease separately from the processing contract. Check the initial term, renewal term, cancellation method and deadline. A quote that excludes the fees responsible for the difference isn’t a comparison. It’s a sales prop with arithmetic on it.
Business IT goes well beyond the website
Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.
DaySmart says attackers gained unauthorized access to some customer accounts and used them to send spam text messages. In a November 2 incident update, the appointment-software provider said it had blocked the access and had not seen further attacker activity. Messaging remains disabled on affected accounts while the company finishes security work and contacts those customers.
The attackers also created unauthorized online bookings on a small number of accounts. DaySmart says they may use placeholder names such as “Test 123” or “Pentest User.” The company hasn’t publicly explained the access method or full scope, so there’s no basis yet to blame stolen passwords, a platform vulnerability or anything else.
If DaySmart contacts your business, review recent bookings, cancel the ones you can’t verify and follow its account-specific instructions. Tell clients not to trust an unexpected link merely because the message came from the number or conversation they recognize. That’s the practical danger here: the attacker borrowed the business’s identity, not just its software.
Technical discovery & auditing
The public page doesn’t tell you much about the machinery behind it. Raymond Tec audits inherited and long-running projects to uncover the plugins, integrations, data, dependencies, and old decisions that determine what the next change will really involve.
NIST wrote a security guide for businesses with no IT department
The National Institute of Standards and Technology released Small Business Cybersecurity: Non-Employer Firms, a plain-language guide for sole proprietors, freelancers, single-member LLCs and other businesses with no paid employees beyond the owner. It translates parts of the NIST Cybersecurity Framework into actions that don’t assume prior security knowledge or an enterprise budget.
The recommendations aren’t exotic: inventory the devices, accounts and data the business depends on; replace default passwords; keep software updated; maintain backups; and plan what happens when something fails. The guide explains why each step matters, how to begin and how the process can mature as the business grows. It also includes editable worksheets and hypothetical examples for a lawyer, artisan and consultant.
That sounds basic because it is basic. It’s also the work that gets skipped when sales, client calls, bookkeeping and support all belong to the same person. I’d start with the inventory worksheet. You can’t protect an account you forgot exists, patch a laptop you no longer track or restore data you never decided to back up.
Keeping a website running is its own job. Raymond Tec provides website security and maintenance, including updates, backups, monitoring, access cleanup, recovery planning, and help when something has already gone sideways.
Sources / Further Reading
- Associated Press: Supermarket freezers hit by apparent cyberattacks (November 3, 2026)
- BleepingComputer: Refrigeration systems disrupted across Europe (November 2, 2026)
- ERR: Estonian freezer controller raised to 50°C (November 2, 2026)
- FTC: Riverside Payments proposed settlement (November 2, 2026)
- DaySmart: Unauthorized text messages incident (updated November 2, 2026)
- NIST: Cybersecurity guide for solopreneurs (November 2, 2026)
- NIST CSWP 50 publication page and worksheets (November 2, 2026)
Photo by Haberdoedas on Unsplash.
