Hackers remotely tampered with refrigeration systems at more than 100 supermarkets and food shops across Europe overnight into Monday, November 2, 2026, switching freezers and coolers into defrost mode and forcing stores to throw out chilled and frozen food.
Retailers in Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia reported affected stores, and Finland’s Kesko group said it was investigating irregular temperatures at a few smaller shops. The wave follows the October 11 to 12 cyberattack that hit roughly 700 French supermarkets, which BreachNews covered last month.
Belgian chains report dozens of affected stores
Belgium was hit hardest. Ahold Delhaize said it identified an IT incident affecting refrigeration systems in several dozen stores, mainly in Belgium with a few in Luxembourg. Delhaize told VRT NWS that around 40 locations were affected and that temperatures in some units climbed to 15°C. Delhaize also reported that 4 of its Luxembourg stores were affected.
- Carrefour Belgium: confirmed a cyberattack affecting about 15 of its 700 stores, mainly freezer sections, and said all stores stayed open.
- Colruyt Group: said about 5 independently run Spar shops were affected, while Colruyt’s own stores were not.
- Intermarché Belgium: said about 15 stores were affected, but alarms sounded quickly enough for staff to act.
- IKEA Belgium: said its store in Mons was hit.
The operator of a Proxy Delhaize in Hoepertingen reportedly estimated its losses at €60,000. Belgium’s federal prosecutor’s office opened an investigation, and the Centre for Cybersecurity Belgium (CCB) said it was aware of the incident.
Refrigeration installer points to the French playbook
Stephan Moelans, CEO of Belgian refrigeration installer Sabcobel, which manages Delhaize’s systems, told the Belga news agency that the attack began around midnight and that attackers remotely switched evaporators into defrost mode. He said it was the same mechanism used in France and that his company counted about 20 affected installations out of the hundreds it manages. Moelans told AFP that about 10% of Sabcobel’s installations had not yet been secured after the French attack.
He added that a software update alone is not enough and that installations need physical changes.
Freezers set to +50°C in Sweden
In Sweden, ICA confirmed that a limited number of stores connected outside its central network were affected, but told AFP it could not confirm a cyberattack was the cause. An ICA store in Sjöbo told TV4 its freezers had been set to +50°C and that goods worth hundreds of thousands of kronor had to be discarded. Affected ICA stores were reported in Skåne, Öland, Värmland and Stockholm.
Coop Sweden confirmed a cyber incident at 7 of its more than 800 stores, after earlier citing 6 stores around Gävle. Coop said units ranged from fully shut down to partly working, and in one case a system began generating heat. Axfood said a home delivery warehouse in Västra Frölunda was affected through an external refrigeration supplier, disrupting online grocery deliveries in the Gothenburg area. Sweden’s National Cyber Security Centre said it was in contact with those affected.
Ireland, the Netherlands and Estonia
Musgrave Group confirmed to The Irish Times that a cyber incident affected refrigeration in 13 SuperValu stores, limited to a specific model. Chilled and frozen products were pulled from sale as a precaution, and the company later said the issue had been fully resolved.
In the Netherlands, a Danfoss spokesperson told NOS that systems at at least 17 businesses, mostly butcher shops and small neighborhood stores, were attacked. The spokesperson said those systems were not on a secured network and still used a default password.
Estonian chain Selver said 1 store was hit. Its refrigeration partner Kitman Coldtech told ERR that attackers accessed an older Danfoss controller and set a freezer to +50°C, but the change was caught within about 10 minutes and no goods were lost.
Internet-exposed controllers remain the weak point
After the French attacks, France’s CERT-FR issued alert CERTFR-2026-ALE-012 on compromises of remote refrigeration controllers, naming Danfoss AK-SM and AK-SC series units and Copeland and Dixell XWEB supervisors. The CCB repeated the warning in an October 13 advisory, saying targeted management interfaces appeared to be exposed to the public internet and that attack campaigns were likely still underway.
Both agencies advised removing internet exposure, allowing access only through a VPN or protected network, updating firmware, changing default passwords, setting Danfoss units to “Strict” security mode and checking defrost settings. They warned that a factory reset alone will not protect end-of-life devices that stay online.
Danfoss has said most equipment affected in France was legacy hardware that no longer receives security updates. CISA has published advisories for Danfoss AK-SM 8xxA controllers and Copeland XWEB Pro supervisors, including authentication bypass flaws. No authority has publicly linked Monday’s attacks to a specific CVE.
Attackers and motive still unknown
No group had claimed responsibility for either wave at time of publication, and no ransom demand has been reported. Danfoss told Danish broadcaster DR that incidents in several countries involved its products and matched the French attacks. Copeland did not answer NOS questions about the attacks.
EU agriculture commissioner Christophe Hansen called the repeated attacks “extremely concerning” and “a deliberate attempt to disrupt our food supply chain.” Retailers using remotely managed refrigeration should confirm no controller is reachable from the internet and that overnight temperature alarms reach someone who can act.
