Cyberattacks Switch European Supermarket Freezers to Defrost Mode Across Seven Countries

Dozens of supermarkets in seven European countries reported on 2 November 2026 that refrigeration and freezer units had been switched to defrost mode, causing temperatures to rise and spoiling food. Affected chains include Delhaize in Belgium and Luxembourg (around 40 stores), ICA and Coop in Sweden, SuperValu in Ireland (13 stores), and smaller numbers of shops in the Netherlands, Estonia and Finland. Carrefour reported 15 of its 700 Belgian stores affected; IKEA noted one Belgian location.

Sabcobel, a Belgian manufacturer of some of the units, stated that the evaporators were forced into defrost mode, the same method used in an attack that hit hundreds of French supermarkets last month. Sweden's national cybersecurity centre is investigating. Individual stores reported losses: one Delhaize branch in Hoeilaart, Flanders, estimated €100,000 in spoiled produce, not counting the cost of temporary closure.

The attacks target connected commercial refrigeration systems that can be reached through the internet or local networks. Once access is obtained, a command switches the evaporator from cooling to defrost, raising the internal temperature above safe levels for frozen and chilled goods. The food must then be discarded. Stores have moved remaining stock into temporary cold storage or closed affected departments while technicians reset the units.

This is the second wave within weeks. The French incident last month affected a larger number of stores and used the same technical approach. No group has claimed responsibility for either attack. The pattern suggests either the same actors expanding the target set or copycat activity using publicly known methods against poorly segmented industrial control systems.

Supermarket groups have not published full technical details of the intrusion path. Some units are manufactured by Sabcobel and similar suppliers and are managed through centralized monitoring platforms. If those platforms or the individual controllers lack strong authentication or network isolation, a single compromised credential or exposed interface can affect multiple stores.

The immediate cost is the value of discarded food plus lost sales during cleanup. The Hoeilaart example of €100,000 at one store gives a lower bound; larger hypermarkets would face higher figures. Across dozens of stores the aggregate loss runs into the low millions of euros before counting reputational effects or temporary closures.

National cybersecurity agencies in Sweden and Belgium have opened inquiries. No arrests have been announced. The practical defense for remaining stores is to isolate refrigeration controllers from general store networks, require multi-factor authentication on management interfaces, and monitor for unexpected mode changes. Those steps take time to implement across existing fleets.

The incidents demonstrate that operational technology in retail—specifically temperature control—can be disrupted at scale with relatively simple commands once access is gained. The food waste is measurable and immediate. The same class of systems exists in warehouses, restaurants, and pharmaceutical cold chains; the supermarket cases provide a public example of the consequence when those systems are reachable.