By Sofwan Mahmood
PREPAREDNESS | CYBERSECURITY
Europe’s supermarket refrigeration attacks are a warning about how exposed everyday infrastructure has become. For Malaysia, the right response is preparation, clear communication and stronger protection of essential systems, not panic buying.
Information verified as at 6 November 2026
When a cyberattack reaches the supermarket freezer
Most people think of a cyberattack as stolen banking details, leaked personal data or a government website knocked offline. The past four weeks in Europe have shown something different: attackers reaching into the machines that keep food cold.
On the night of 11 to 12 October, refrigeration systems at hundreds of supermarkets in France were remotely tampered with. Temperatures rose sharply, food had to be thrown away and some fires broke out (Reuters). A second wave struck overnight on 1 to 2 November. Reuters reported on 3 November that stores in eight European countries had been forced to discard large quantities of food (Reuters). The list has grown since then, and Euronews now reports that supermarkets in at least 10 EU countries, as well as the United Kingdom, have been affected (Euronews). No official total has been published.
Malaysians should pay attention. Supermarkets are one link in a longer chain that runs from farms and importers through processors, cold stores, transporters and wholesalers to the household kitchen. A failure at one point can travel.
But one distinction matters above all. The European incidents are documented. As at the date of writing, no Malaysian retailer, and no Malaysian authority, has reported a similar attack on refrigeration systems in this country. The sensible response is vigilance, not speculation.
What happened in Europe
These attacks targeted operational technology (OT): the hardware and software that monitor and control physical equipment. In a supermarket, that covers refrigeration and freezer controllers, temperature sensors, building management systems and the remote-maintenance links that contractors use to service them.
France’s national cybersecurity agency, ANSSI, has said it is aware of compromised remote refrigeration controllers from Danfoss’s AK-SM and AK-SC ranges, as well as Copeland and Dixell XWEB systems (PBS NewsHour/AP). Danfoss has said that most of the affected systems were older products that no longer receive software or security updates (PBS NewsHour/AP). It has also advised that such systems should not be directly accessible from the internet (Reuters).
In the November wave, Euronews reported incidents at retailers in Belgium, Sweden, Estonia, the Netherlands, Luxembourg, Finland and Ireland, and said Belgium’s federal prosecutor had opened an investigation (Euronews). Irish wholesaler Musgrave said refrigeration systems at 13 of its SuperValu stores had been affected and that chilled and frozen products were removed from sale (Reuters). The attacks have also reached beyond retail: France’s health ministry said cold-storage units used by regional blood banks were targeted on 2 November, although early detection meant there were no operational consequences (The National).
On 4 November, the European Commission, the EU cybersecurity agency ENISA, Europol’s European Cybercrime Centre and the EU’s networks of national incident-response teams and cyber-crisis authorities issued a joint statement. They advised organisations to take immediate action to reduce exposure in the affected systems and said cooperation and rapid information-sharing at European level were essential (ENISA).
Who is responsible remains unknown. Authorities have not publicly disclosed how the attackers got in, and no perpetrator has been identified (Reuters). Claims of responsibility have circulated online, but no authority has verified them.
The lesson is not simply that a fridge can be hacked. It is that an ordinary piece of commercial equipment, left exposed, can become a way into a physical business. A supermarket’s cybersecurity cannot stop at its payment terminals, customer database and email. It has to cover the machines that keep food safe.
Where Malaysia stands
Malaysian retailers rely increasingly on connected systems for stock control, logistics and, in some cases, refrigeration. How connected those systems are varies widely from one operator to the next.
The Star asked several retailers about their exposure. Econsave Cash and Carry general manager Mas Imran Adam said some of the company’s freezers are connected to the internet and that it had introduced password protection to prevent unauthorised access. “At the moment, there are no issues but we are keeping a close watch on this and will remain vigilant,” he told The Star (The Star). Angsana Mall Johor Baru chief operating officer Imran Salleh said the mall’s refrigeration system “is also not accessible to external parties” (The Star).
In Penang, Mydin Mohamed Holdings head of marketing Hussain Karim Ally said the company’s freezer operations do not rely heavily on Internet of Things technology. Sunshine Group’s Bryan Wong said its freezers run on standalone systems without internet connectivity (The Star).
These comments show that operators are aware of the risk. They are not a national assessment. There is no published audit showing how many Malaysian supermarkets or cold stores use internet-connected refrigeration controls, or how well those systems are secured.
The government has stepped up its own posture. On 4 November, the National Cyber Security Agency (NACSA) raised the National Cyber Security Threat Level from Low to Medium. The National Security Council described the move as a precautionary measure to keep the country’s essential services protected (The Star). Entities operating national critical information infrastructure have been instructed to strengthen their preparedness, including through 24-hour monitoring, security updates and service continuity plans (Free Malaysia Today). The Malaysian Communications and Multimedia Commission (MCMC) has also said it is working with the National Security Council, NACSA and other agencies to monitor developments (The Star).
A day before the threat level was raised, Prime Minister Datuk Seri Anwar Ibrahim told the Dewan Rakyat that Malaysia is “certainly among those considered potential targets” of cyberattacks. He cited the country’s strength in digital technology and data centres and its stance on Palestine and Gaza (Sinar Daily). He did not identify any attackers or the nature of the threat (The Edge).
Neither statement links Malaysia to the European refrigeration attacks, and neither reports an attack on a Malaysian retailer. A raised threat level, as one expert told the New Straits Times, “does not necessarily mean that Malaysia is currently experiencing a major cyberattack or that an attack is imminent” (New Straits Times).
Disruption is not the same as shortage
Public anxiety can move faster than any actual disruption. When people read that supermarket fridges overseas have failed, it is natural to wonder about the food supply at home. It helps to separate three different situations.
A refrigeration failure at a store means some perishable stock is lost. That is an operational and food-safety problem for that business.
A distribution failure, affecting several warehouses, cold stores or transport hubs, could reach beyond individual shops.
A national shortage would require a far wider breakdown, across production, imports, inventories and distribution.
These are connected, but they are not the same thing.
On 2 November, Deputy Prime Minister Datuk Seri Dr Ahmad Zahid Hamidi said Malaysia had sufficient food supply capacity for at least six months and saw no need for emergency stockpiling. “We know that we have the capacity to sustain food security for at least six months,” he said, adding: “We are not in a state of emergency and, Insya-Allah, we are far from such a situation” (Bernama). He was responding to reports that several countries had advised their citizens to keep emergency supplies, rather than to the supermarket attacks specifically (Bernama).
His statement is a government assurance, not a published audit of every food category. Even so, nothing in the European incidents points to an imminent shortage in Malaysia.
What Malaysia’s cyber incident data shows
CyberSecurity Malaysia’s Cyber999 Incident Response Centre handled 2,715 incidents in the second quarter of 2026, up 24.09% from 2,188 in the first quarter. That is the most recent quarterly report available (CyberSecurity Malaysia).
| Incident category | Q2 2026 | Q1 2026 |
| Fraud | 2,314 | 1,829 |
| Data breach | 175 | 124 |
| Intrusion attempt | 91 | 81 |
| Intrusion | 51 | 64 |
| Malicious codes | 34 | 28 |
| Spam | 32 | 31 |
| Vulnerabilities report | 17 | 26 |
| Denial of service | 1 | 5 |
| Total | 2,715 | 2,188 |
Source: CyberSecurity Malaysia, Cyber999 Q2 2026 Cyber Incident Summary Report.
The report also recorded 12 ransomware incidents in the quarter, the same as in Q1, and observed no significant or severe incidents (CyberSecurity Malaysia).
These numbers need careful reading. They cover only incidents reported to and handled by Cyber999 involving Malaysian IP addresses and domains, and they exclude financial losses and the aftermath of incidents (CyberSecurity Malaysia). They are not a count of every cyber incident in Malaysia, and nothing in them shows that supermarkets or refrigeration systems have been targeted here.
What they do show is a steady volume of fraud, intrusion and data-breach activity across Malaysian networks. The European incidents give organisations one more reason to ask whether their security reviews cover the equipment on the shop floor as well as the computers in the office.
Why operational technology needs more attention
For years, corporate cybersecurity has focused on protecting information: firewalls, antivirus software, secure email, access controls and payment security. All of that still matters.
But as digital controls spread into physical operations, businesses also have to protect the systems that run machinery and regulate conditions. In a supermarket, that means refrigeration, ventilation, temperature monitoring and building management.
If refrigeration controls are compromised, the consequences can include:
Loss of temperature-sensitive stock.
Financial losses from disposal and clean-up.
Temporary closure of chilled and frozen sections.
Pressure on suppliers and distribution.
Higher maintenance and replacement costs.
Possible food-safety risks if affected products are not identified and withdrawn.
The European cases point to familiar weaknesses: legacy equipment that can no longer be updated, default or weak passwords, outdated software and remote connections exposed to the open internet (Reuters). None of these is unique to Europe.
Cybersecurity has to move beyond the IT department and become part of operational risk management and corporate governance.
Should Malaysians stock up on food?
No. On the evidence available, there is no reason for panic buying.
Reasonable household preparedness is always sensible, but keeping a modest emergency supply is very different from buying in bulk because of an unverified message.
Keep shopping according to your household’s normal needs.
Maintain a modest supply of drinking water and non-perishable food for short-term emergencies.
Avoid buying excessive quantities of rice, cooking oil, canned goods and other essentials.
Follow official announcements on any confirmed disruption or product recall.
Check the condition of chilled and frozen products when you buy them.
The National Security Council’s general food-safety guidance advises keeping cooked, perishable food refrigerated below 5ยฐC, keeping cooked food above 60ยฐC before serving, and not leaving food at room temperature for more than two hours (MKN). This advice applies whether or not there is a cyber incident.
Where a store reports a refrigeration failure, it is for the retailer and the food-safety authorities to decide whether the affected products remain fit for sale.
What authorities and retailers should do
Consumers have a part to play, but most of the responsibility lies with the businesses and institutions that run essential services. The European incidents suggest five areas for review.
A. Map the exposure
Supermarkets, hypermarkets, cold-storage operators and food distributors should identify which refrigeration and building-management systems are connected to the internet, who has remote access to them, and through which suppliers.
B. Secure operational technology
Refrigeration controls should not be exposed to the public internet unless there is a clear need. Where remote access is required, it should go through secure channels, with strong passwords, current software and network separation. Equipment that can no longer be updated should be isolated or replaced.
C. Monitor independently
Temperature alarms should not depend entirely on the same system that controls the equipment. A separate alert can catch abnormal readings before large losses occur.
D. Plan for continuity
Operators should have arrangements for alternative storage, emergency maintenance, product assessment and supplier coordination when equipment fails.
E. Communicate clearly
If a store suffers a confirmed incident, management should say promptly and accurately which outlets are affected, whether food safety is at risk, which products have been withdrawn, when operations will resume, and where customers can find verified updates.
Rumours are a risk too
During any cyber incident, inaccurate information can do as much damage as the attack. A photo of empty shelves, an unverified WhatsApp forward or an exaggerated headline can create the impression of a national emergency when only a handful of outlets are affected. That can trigger unnecessary buying, disrupt normal trade and erode public confidence.
Journalists, publishers, influencers and ordinary social media users all share responsibility here. Before sharing claims about supermarket cyberattacks:
Do not say a Malaysian supermarket has been hacked unless the operator or a relevant authority has confirmed it.
Do not attribute an attack to any country, group or individual without credible, official evidence.
Do not present isolated refrigeration failures as a national food shortage.
Do not share photos or videos from overseas as though they were taken in Malaysia.
Keep official statements, confirmed incidents and expert opinion clearly separate.
There are legal consequences as well. Section 233 of the Communications and Multimedia Act 1998 makes it an offence to knowingly transmit, through network services, communications that are false or grossly offensive, among other categories, with intent to annoy, abuse, threaten or harass another person. Amendments that came into force on 11 February 2025 replaced the word “offensive” with “grossly offensive” (The Law Partnership; AmCham Malaysia). Section 505(b) of the Penal Code also covers statements, rumours or reports made with intent to cause, or likely to cause, fear or alarm to the public. It provides an exception where the person had reasonable grounds to believe the statement was true and acted without that intent (Penal Code, Act 574).
Not every honest mistake is an offence; the elements of each provision and the circumstances matter. Publishing unsupported allegations against identifiable people or companies can also expose the publisher to defamation claims.
The safest course for any publisher is the oldest one: verify, attribute, keep the documents, and keep fact and opinion apart. Responsible reporting does not mean avoiding difficult subjects. It means getting them right.
Crisis communication belongs in cyber preparedness
Cybersecurity is usually treated as a technical job, and crisis communication as a separate corporate or government function. That separation no longer makes sense.
A refrigeration incident can quickly become a question of public relations, consumer confidence and food safety. Even a technically contained incident can cause wide anxiety if people receive conflicting information.
A coordinated response would have:
Cybersecurity authorities establish the technical facts.
Food-safety authorities assess any risk to consumers.
Retailers explain the operational impact.
Government agencies issue consistent public updates.
Media organisations verify information before publishing.
Managing information during a crisis matters as much as managing the incident itself.
Conclusion: preparedness is the best defence against panic
Europe’s supermarket attacks show that cyber threats now extend well beyond data theft and fraud, into the systems that store food and medicine.
For Malaysia, this is a chance to strengthen the retail and food-distribution sector before anything comparable happens here. The government has raised its threat level as a precaution and is monitoring developments. Businesses should review the security of their operational technology. Consumers should stay informed through official channels.
As at 6 November 2026, there is no verified basis for saying that the refrigeration attacks have reached Malaysian retailers, or that the national food supply is under threat from them. Malaysians can carry on with their normal shopping while keeping sensible household supplies.
The lesson from Europe is not that the shelves are about to empty. It is that the infrastructure behind everyday life is increasingly connected, and that connection has to be protected.
Malaysia does not need a rush to stockpile groceries. It needs a cyber-resilient retail sector, a government that communicates clearly, and a public able to tell genuine risk from rumour.
Prepare, protect and stay informed. Do not panic.
Sources
PBS NewsHour/AP: https://www.pbs.org/newshour/world/heres-what-to-know-about-another-cyberattack-on-european-supermarket-fridges
Euronews: https://www.euronews.com/2026/11/02/cyberattack-hits-belgian-supermarket-fridges-and-freezers
Reuters: https://www.reuters.com/business/european-retailers-hit-by-supermarket-fridge-hack-2026-11-02/
The National: https://www.thenationalnews.com/news/europe/2026/11/04/blood-banks-among-victims-of-european-cyber-attacks/
The Star: https://www.thestar.com.my/news/nation/2026/11/05/retailers-bumping-up-security-following-hack
The Star: https://www.thestar.com.my/news/nation/2026/11/05/staying-cool-but-cautious
Free Malaysia Today: https://www.freemalaysiatoday.com/category/nation/2026/11/05/hamzah-urges-govt-to-keep-data-encryption-keys-in-its-hands
The Star: https://www.thestar.com.my/news/nation/2026/11/06/mcmc-on-higher-alert
Sinar Daily: https://www.sinardaily.my/ampArticle/742959
The Edge: https://theedgemalaysia.com/node/824308
New Straits Times: https://www.nst.com.my/news/nation/2026/11/1571583/expert-warns-single-cyberattack-could-disrupt-multiple-critical
Bernama: https://www.bernama.com/en/general//news.php?id=2628960
CyberSecurity Malaysia: https://www.cybersecurity.my/portal-main/advisories-details/16acf41b-a6d5-11f1-b812-0050568ccc16
MKN: https://www.mkn.gov.my/web/ms/2024/07/30/panduan-makanan-selamat/
The Law Partnership: https://law-partnership.com/wp-content/uploads/public_files/Key%20Updates%20to%20the%20CMA%202025.pdf
AmCham Malaysia: https://amcham.com.my/41059-2/
Penal Code, Act 574: https://lom.agc.gov.my/ilims/upload/portal/akta/LOM/EN/Penal%20Code%2018%20Dis%202018.pdf
More Stories
Apabila Kebenaran Menjadi Ketakutan: Antara Keberanian, Kelemahan dan Tanggungjawab Menentang Kemungkaran
Dasar Pandang ke Timur 2.0: Malaysia Perlu Belajar daripada Jepun, Korea dan China dalam Era AI
Majlis Perundingan Melayu (MPM): Hampir Dua Dekad Perjuangan, Apakah Hala Tuju Bangsa Melayu Seterusnya?