Cyberattacks on *refrigeration units* hit European supermarkets twice in three weeks

When the fridge becomes the target

A refrigeration unit doesn't look like critical infrastructure until someone switches it to defrost mode from the other side of the world. That's what happened to supermarkets in Belgium, Luxembourg and Sweden this week, and to stores in France three weeks earlier ^[1][2]. The attackers didn't steal data or demand a ransom. They spoiled food.

The pattern is the same across countries. Someone gets into the building management system, finds the refrigeration controls and starts defrosting. Stock is ruined, stores close for the day and the incident makes the news. For the operators, the hard questions come later: when did you know, and when did you report it?

The 24-hour rule

Under Sweden's Cybersecurity Act, which implements NIS2, essential and important entities must send an early warning within 24 hours of becoming aware of a significant incident ^[3]. The clock starts when you know, not when it suits you. It's like when you lose your bank card: the question isn't when the fraudster used it, but when you noticed it was gone.

That's harder than it sounds when a chain of refrigeration units starts defrosting in the middle of the night. Someone has to spot it, work out it's not a fault, escalate it and decide it counts as significant. Each of those steps happens at a particular time, and each one matters if a supervisor later asks why the warning went out after 30 hours instead of 24.

The evidence question

The trouble with incident timelines is that they get written by the people who have to report them. A note that says "incident detected 02:14" is easy to make after the fact, and easy to challenge. An auditor or a supervisor who sees it a month later has to decide whether to trust it.

That's the evidence question. It isn't about whether the response was good or the report was complete. It's about whether the timeline holds up when someone questions it.

What this means for you

If your organisation falls under the Cybersecurity Act, or under DORA, CRA or any other regime with incident deadlines, the first question to ask is simple: could we show when we became aware of an incident, in a way nobody could quietly change afterwards?

That means:

• Logging the first detection, whether it's an alert, a phone call or someone noticing that the freezers are warm.
• Recording the decision to escalate, with the time and who made it.
• Keeping a copy of each report as it was sent, so you can show what you said and when you said it.
• Asking who could edit those records, and whether an auditor would accept them as they are.

The deadline is 24 hours from awareness. The question is whether you can prove when awareness happened.

Sealing the timeline as it happens

This is a strong fit for a digital witness. The thing to seal is each step of the incident as it happens: the first detection note, the decision to escalate and each report as it is sent. You seal a fingerprint, not the content, so the note itself never leaves your systems.

Sealing happens at each step. When the incident is spotted at 02:14, that note gets sealed at 02:14. When the early warning goes out at 18:30, that version gets sealed at 18:30. If a supervisor asks six months later why it took 16 hours, anyone you share the records with can check that they're the ones written on the day. Change a single character in a sealed record and the fingerprint won't match.

What it shows is when each step was recorded, in a way nobody can quietly rewrite afterwards. What it doesn't show is that the report was complete, that the response was adequate or that the incident was handled well. It just makes the timeline checkable.

You seal through WitniumChain's REST API, SDK or MCP server. The content stays with you, the fingerprint goes on the chain and you get a witness ID back. To check, you calculate the fingerprint again and compare it with the sealed one. The first 2,000 witnesses a month are free. Read the docs to see how it works.

How it would work

1. The on-call engineer logs the first detection note and seals it.
2. The incident manager decides to escalate and seals that decision.
3. The early warning is drafted, sealed and sent within 24 hours.
4. Each later report (incident notification, final report) is sealed as it goes out.
5. When the supervisor asks, the organisation shares the sealed records and the witness IDs, and the supervisor checks them.

What to watch

The Cybersecurity Act's incident reporting duties apply from 15 January 2026 ^[3]. The Cyber Resilience Act, which will cover connected hardware and software, has similar deadlines and applies from 11 September 2026 ^[4]. Both count the hours from when you knew.

For anyone running connected systems, the question is the same: when something goes wrong, can you show when you found out?

Sources

1. Help Net Security, "Cyberattacks on refrigeration units hit European supermarkets", 2 November 2026, https://www.helpnetsecurity.com/2026/11/02/european-supermarkets-refrigeration-units-cyberattacks/
2. The Record, "Cyberattacks on grocery store freezers spread across Europe", 2 November 2026, https://therecord.media/cyberattack-grocery-freezers-europe
3. Cybersecurity Act (2025:1506), implementation of NIS2, https://data.riksdagen.se/dokument/sfs-2025-1506.html
4. Cyber Resilience Act, Regulation (EU) 2024/2847, Article 14, https://eur-lex.europa.eu/eli/reg/2024/2847/oj