On the night of Monday, 2 November 2026, a new wave of cyberattacks targeting supermarket refrigeration systems was recorded in several European countries. Hackers remotely altered equipment settings, raising temperatures in refrigerators and freezers to 50 °C and higher. This led to food spoilage and the need for large-scale disposal of goods.
The attacks were reported in Belgium, Sweden, Luxembourg, Ireland, Estonia, the Netherlands, and, according to some reports, Finland. In Belgium, around 40 Delhaize stores were affected (along with several in Luxembourg), as well as Carrefour, Spar, and other outlets. In Sweden, problems occurred at ICA and Coop stores. In Ireland, 13 SuperValu stores were hit. At one Belgian Delhaize location, losses from spoiled products alone were estimated at around €100,000.
According to companies that service refrigeration equipment (including Sabcobel in Belgium), the attackers switched evaporators to defrost mode. Stores were forced to discard meat, dairy products, frozen goods, and other perishable items. Many outlets remained open but with a limited selection of fresh and frozen products.
This is the second such attack in recent weeks. In mid-October (around 11–12 October), a similar incident affected up to 700 supermarkets in France, including the Intermarché, Netto, Coopérative U, Carrefour, Leclerc, and Monoprix chains. At that time, hackers also remotely raised the temperature in thousands of refrigeration units (mainly manufactured by the Danish company Danfoss, as well as Copeland/Dixell) to 50 °C and higher. Products defrosted and spoiled, and fires were reported in some stores. Losses were estimated in the tens of millions of euros. The Paris prosecutor’s office opened an investigation, and France’s cybersecurity agency ANSSI joined the inquiry.
Experts note that the vulnerability is linked to internet-connected refrigeration controllers used for remote maintenance. Many of the affected devices are older models that no longer receive security updates. No one has yet claimed responsibility for the attacks, and it is unknown whether the October and November incidents were carried out by the same perpetrator or group. Authorities in several countries (including Belgium and Sweden) are monitoring the situation.
