Cyberattacks targeting supermarket refrigeration systems disrupted more than 100 stores across Europe on Monday, November 2, 2026, forcing retailers to discard food and temporarily empty refrigerated shelves. Stores in Belgium, Luxembourg, Sweden, Ireland, Estonia and the Netherlands reported problems, while Finnish retailers investigated similar temperature-control failures.
Some refrigeration units reportedly reached 50 degrees Celsius, or 122 degrees Fahrenheit, after their settings were remotely altered. The incidents affected major grocery chains, including Delhaize, Carrefour, ICA, Coop and SuperValu, along with smaller independent retailers.
The disruptions followed a similar attack in France in October that affected hundreds of supermarkets. European authorities are investigating the latest incidents, although no group has claimed responsibility and investigators have not confirmed whether the attacks across different countries were coordinated.
Belgium and Luxembourg Report Widespread Disruptions
Belgium was among the hardest-hit countries, with approximately 40 Delhaize stores experiencing refrigeration problems. Several affected locations were in neighboring Luxembourg, where the company also operates supermarkets.
In Hoeilaart, near Brussels, a Delhaize supermarket was forced to empty refrigerated sections after temperatures rose unexpectedly. Products including frozen pizzas, ice cream and other temperature-sensitive foods could no longer be offered for sale.
The store reported losses exceeding €100,000, according to local reporting. Such losses can mount quickly when an incident affects several large refrigeration units at once, particularly when fresh meat, dairy products and frozen goods must be discarded.
Ahold Delhaize, the Dutch-based parent company, confirmed an information technology incident involving refrigeration systems. The company said it had taken immediate measures to keep its stores operating and limit disruption to customers.
The retailer also reported that its distribution centers continued functioning normally. Deliveries to stores were not interrupted, although some locations temporarily had reduced supplies of chilled and frozen products.
Carrefour Belgium confirmed problems at approximately 15 of its more than 700 stores. The retailer described the incident as a cyberattack targeting refrigeration equipment and said its overall impact was limited.
Five independently operated Spar stores associated with Colruyt Group also reported refrigeration failures. Other affected retailers included Intermarché and an IKEA location in Mons, Belgium.
The variety of businesses involved showed that the problem extended beyond a single supermarket chain. Retailers using connected refrigeration equipment appeared particularly vulnerable when temperature-control systems were exposed to unauthorized access.
Hackers Target Refrigeration Controls Rather Than Store Computers
The attacks appear to have focused on systems used to monitor and regulate commercial refrigeration equipment. These systems allow operators to adjust temperatures, schedule defrosting cycles and receive alerts when cooling equipment malfunctions.
Internet-connected controls are widely used because they allow technicians to manage refrigeration systems remotely. A supermarket may operate dozens of refrigerated cabinets and freezers, making centralized monitoring useful for reducing energy costs and preventing equipment failures.
However, remote access can become a security weakness when devices are not adequately protected. Attackers who gain control of refrigeration settings may be able to raise temperatures without entering a store or physically damaging equipment.
In Belgium, industrial refrigeration company Sabcobel reported that some affected systems had been switched into defrost mode. This prevented the equipment from maintaining the low temperatures needed to protect food.
Sabcobel chief executive Stephan Moelans said technicians began responding during the early morning hours. Teams worked to disconnect affected installations from network connections and restore normal operation.
The company had already begun security work following the October attacks in France. However, some installations had not yet received the necessary protections when the latest incidents occurred.
The company’s experience demonstrates the difficulty of securing connected equipment across many locations. Even when a vulnerability becomes known, applying updates and changing access settings can require coordinated work across individual stores.
Swedish Supermarkets Report Temperatures of 50°C
Sweden experienced similar problems, with supermarket chains ICA and Coop confirming refrigeration disruptions at several locations. In some cases, store employees arrived to discover that cooling equipment was running far above safe temperatures.
An ICA supermarket in Sjöbo, southern Sweden, reported that its refrigeration settings had been changed to 50 degrees Celsius. Staff began removing affected products because the equipment could no longer maintain safe storage conditions.
Another ICA location in Stockholm experienced serious losses after its freezers were affected overnight. Store employees discovered the problem several hours after the reported intrusion.
The incident demonstrated how quickly food losses can accumulate when an attack occurs outside normal operating hours. Refrigeration equipment can remain compromised for hours before employees arrive and identify the problem.
Coop reported that several of its approximately 800 Swedish stores were affected. The company confirmed that the incidents involved cyber interference and said repairs had restored normal refrigeration operations at affected locations.
One store reportedly experienced equipment producing heat instead of cooling. That unusual behavior illustrated how manipulation of temperature controls can create problems beyond a conventional power failure.
Sweden’s national cybersecurity center began examining incidents involving grocery refrigeration systems. Officials also warned that many operational technology devices remained exposed to cyber threats and needed updated security protections.
The investigations focused on how attackers gained access and whether similar weaknesses were present in other businesses using connected industrial equipment.
Ireland, Estonia and Finland Also Investigate Failures
The disruption extended to Ireland, where Musgrave Group confirmed problems at 13 SuperValu supermarkets. Some stores temporarily removed chilled and frozen products as a precaution while technicians investigated the failures.
The company said the refrigeration problems had been resolved by Monday afternoon and that restocking was underway. The incident nevertheless caused inconvenience for shoppers who encountered empty refrigerated displays.
In Estonia, refrigeration technology supplier Kitman Coldtech reported that attackers gained access to a computer controlling cooling equipment. Temperatures were reportedly raised to 50 degrees Celsius before technicians intervened.
Chief executive Jann Mutso said the company responded within minutes and prevented significant damage. The Selver supermarket chain confirmed that one of its locations had been affected.
Finland also reported unusual refrigeration temperatures at a small number of grocery stores operated within the Kesko network. The company began investigating whether the failures were connected to a cybersecurity incident.
Unlike some incidents in Belgium and Sweden, the cause of the Finnish problems had not been established. Investigators therefore cautioned against assuming every refrigeration malfunction was part of the same attack.
Additional reports emerged from smaller stores and butcher shops in the Netherlands. Together, the incidents demonstrated the geographic reach of the disruptions across northern and western Europe.
October Attack in France Raises Security Concerns
The November incidents followed a major refrigeration cyberattack in France on October 12. French authorities reported that hundreds of supermarkets and independent retailers experienced unauthorized changes to cooling controls.
Some systems were forced into extended defrosting cycles, while others reportedly reached temperatures above 50 degrees Celsius. Refrigerated food became unsafe for sale, forcing businesses to discard products and arrange emergency repairs.
Major French retailers affected included Intermarché, Carrefour, E. Leclerc and Coopérative U. The financial damage reached millions of euros across affected businesses, although investigators have not established a final combined loss figure.
French prosecutors opened an investigation into the October incident. The country's national cybersecurity agency, ANSSI, also examined the vulnerabilities that allowed attackers to manipulate refrigeration equipment remotely.
Some of the affected equipment used controllers supplied by Danish industrial technology company Danfoss. The company said it had previously identified security weaknesses and recommended updates to customers.
Investigators have not established whether the same attackers were responsible for the French incident and the November disruptions. Similar attack methods may indicate that multiple groups discovered or exploited the same weaknesses.
That uncertainty makes it difficult to determine whether Europe is experiencing one coordinated campaign or several separate incidents involving vulnerable equipment.
European Officials Warn About Food Supply Disruption
European Commissioner for Agriculture and Food Christophe Hansen condemned the attacks, describing them as deliberate efforts to disrupt food supplies and weaken consumer confidence.
Hansen said the incidents were causing real financial losses and food waste, although the European Union's overall food security was not considered immediately threatened.
The distinction matters because the attacks primarily affected refrigeration equipment in individual stores rather than the entire food distribution network. Retailers continued receiving deliveries, but some could not safely store or sell particular products until repairs were completed.
The incidents also created additional costs beyond the food that had to be discarded. Businesses faced equipment inspections, emergency technician visits, replacement stock orders and potential interruptions to normal operations.
Cybersecurity specialists say commercial refrigeration systems present attractive targets because they combine remote digital access with equipment that performs essential physical functions. A successful intrusion can create immediate financial damage even without stealing customer information.
Security researchers are examining whether the attacks were intended to cause disruption, demand ransom payments or achieve another objective. No confirmed motive has been established, and there is no verified evidence linking the incidents to a particular country or organization.
Retailers Work to Restore Systems and Prevent Further Attacks
Affected businesses began isolating vulnerable refrigeration controls, restoring temperatures and replacing products that could no longer be sold safely. Several chains reported that most of their stores continued operating despite localized disruptions.
The incidents have increased attention on cybersecurity protections for operational technology, including refrigeration controllers, heating systems and other connected equipment.
Industry specialists recommend limiting direct internet exposure, installing available security updates and separating building-control networks from broader corporate systems. Reliable monitoring can also help technicians identify abnormal temperature changes before substantial food losses occur.
For retailers, restoring cooling equipment is only the first stage of recovery. Stores must verify that temperatures are stable, inspect affected stock and determine which products can safely return to shelves.
European investigators continue examining the incidents while businesses review their refrigeration security. The central unanswered questions are who gained access to the systems, whether the attacks were coordinated and how many additional installations may remain vulnerable.