Cyberattack raises temperatures in supermarket freezers across seven European countries

Supermarket refrigerators and freezers in at least seven European countries malfunctioned on 2 November 2026 after temperatures were remotely raised, in some cases to 50 degrees Celsius. The incident affected stores in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland. It followed a similar attack in France in October that hit hundreds of shops and caused losses estimated in the tens of millions of euros.

Around 40 Delhaize stores in Belgium and Luxembourg were hit. Carrefour reported 15 of its Belgian stores affected. ICA and Coop in Sweden, SuperValu in Ireland (13 stores), and smaller numbers of shops in the other countries also reported problems. Sabcobel, a Belgian manufacturer of some of the units, said evaporators were switched to defrost mode. One ICA store in Sjöbo posted that its freezers had been set to 50C. A Delhaize manager in Hoeilaart estimated losses of €100,000 in produce at a single branch.

EU agriculture and food commissioner Christophe Hansen described the repeated incidents as a deliberate attempt to disrupt the food supply chain and undermine consumer confidence. No group has publicly claimed responsibility. The method appears to exploit internet-connected refrigeration controllers that were insufficiently secured. In the French case last month, roughly 700 stores were affected according to the Paris prosecutor’s office.

Stores discarded spoiled frozen and chilled goods. Some closed temporarily. Distribution centres continued to operate, and deliveries to unaffected stores were not interrupted. National cybersecurity centres in several countries opened investigations. Retailers said security teams were examining the remote access points used by the attackers.

The attacks highlight the exposure of operational technology in retail. Refrigeration systems that can be controlled over the internet offer convenience for maintenance but create a pathway for disruption if authentication is weak. Food waste from a single wave of such incidents already runs into the millions of euros. A second wave within weeks suggests the vulnerability has not been fully closed across the sector.

Authorities have not identified the perpetrators. Speculation has included state-linked actors, but no public evidence has been presented. The immediate commercial cost is the discarded stock and temporary loss of sales. Longer-term effects will depend on whether retailers and equipment makers can isolate the controllers and whether further incidents occur. Consumers in the affected cities faced empty freezer aisles and limited fresh ranges for at least a day.