Second Wave of Cyberattacks Disables Refrigerators and Freezers in European Supermarkets

A second wave of cyberattacks on supermarket refrigeration systems struck stores across seven European countries on 2 November 2026, forcing the disposal of spoiled food.

The attacks raised temperatures in refrigerators and freezers by switching evaporators to defrost mode. Affected retailers included Delhaize in Belgium and Luxembourg (around 40 stores), ICA and Coop in Sweden, Carrefour in Belgium (15 of 700 stores), SPAR stores operated by Colruyt, SuperValu in Ireland (13 stores), and shops in the Netherlands, Estonia, and Finland. One IKEA store in Belgium was also hit. Sweden’s national cybersecurity centre is investigating, along with company security teams.

The method matches an attack in France roughly three weeks earlier that affected hundreds of stores and caused large quantities of food to be thrown away. Belgian manufacturer Sabcobel, which supplies some of the units, confirmed that the evaporators had been remotely set to defrost. No group has publicly claimed responsibility. The European Union described the incidents as a deliberate attempt to disrupt the food supply chain and undermine consumer confidence.

Store staff transferred remaining frozen goods into shopping carts or other containers while the units warmed. Owners reported being woken in the early morning by employees who found the systems compromised. Coop in Sweden said seven of its roughly 800 stores were affected and identified Danfoss as one of its refrigeration suppliers. Most stores remained open after isolating the compromised units and discarding affected stock.

The attacks exploit internet-connected appliance management software that controls temperature settings. Once access is obtained, an attacker can issue commands that override normal operation without needing physical presence. The repeated use of the same technique across multiple countries and chains suggests either a common vulnerability in widely used control systems or coordinated targeting of similar equipment.

Food safety rules require the disposal of products that have spent time above safe temperature thresholds. The financial cost falls on the retailers and, ultimately, on insurance or higher prices. No injuries or contamination of remaining stock have been reported beyond the temperature excursions themselves. The disruption is measured in spoiled inventory and temporary empty freezer cases rather than in closed stores.

National cybersecurity agencies in Sweden and Belgium are examining the incident. Retailers have begun isolating control systems from wider networks and reviewing remote-access credentials. The earlier French attack did not produce a public arrest or attribution; the second wave indicates that whatever access method was used has not been fully closed.

For supermarket operators, the incidents demonstrate that refrigeration controllers are now part of the attack surface. Many units were installed with remote management features for energy efficiency and maintenance. Those same features allow remote temperature changes if authentication is weak or if credentials are compromised. The scale across seven countries on a single day shows the reach of the vulnerability or the coordination of the attackers.

As of 2 November, the confirmed effects are limited to the listed chains and countries, the defrost-mode method, the disposal of food, and the ongoing investigations. Further technical details on the entry point will depend on forensic work by the companies and national agencies.