Second wave of refrigeration cyberattacks hits over 115 supermarkets across Europe

On 2 November 2026, a second wave of refrigeration-system cyberattacks struck more than 115 supermarkets and food shops across at least nine European countries, in a near-repeat of the operational-technology sabotage that had hit hundreds of French stores three weeks earlier. Overnight into Monday, attackers remotely changed temperature settings on internet-connected refrigeration controllers — shutting units down, raising their set points, or forcing them into defrost mode — so that chilled and frozen stock warmed up and had to be thrown away.

Belgium was hardest hit. Ahold Delhaize said refrigeration at "several dozen stores" — around 40, mostly in Belgium with a handful in Luxembourg — was affected by what it called an "IT incident," while Carrefour reported 15 of its more than 700 Belgian locations disrupted, stressing that "not a single hypermarket is among them." Colruyt counted five franchised Spar shops and Intermarché around 15 stores in Belgium, and an IKEA store in Mons was also affected. Beyond Belgium, SuperValu pulled chilled and frozen products from 13 Irish stores running one particular refrigeration model, ICA and Coop reported impacts at a limited number of Swedish stores, Kesko noted temperature disruptions at smaller Finnish stores, Selver confirmed one store in Estonia, and refrigeration vendor Danfoss said at least 17 Dutch businesses — mainly butcher shops and neighbourhood grocers — were hit. Coop-branded supermarkets in Sicily and seven Intermarché stores in Portugal were also reported affected.

How the attack worked

As in the French campaign, the attackers abused refrigeration controllers whose management interfaces were reachable from the internet, in several cases forcing the units' evaporators into prolonged defrost. Stephan Moelans, chief executive of Belgian refrigeration vendor Sabcobel, said the intruders exploited "the same vulnerability as the attacks in France last month," and that technicians had begun disconnecting affected units at around 1 a.m. Security researcher Kevin Beaumont said every freezer hit that day had a management interface exposed online. Some units were reportedly set as high as +50°C (122°F), and at one ICA store staff said the settings could not be changed back. Moelans cautioned that a software update alone would not fix the weakness, because many of the affected end-of-life devices also require physical modification.

Investigation and attribution

The Belgian federal prosecutor's office opened an investigation, and officials did not immediately explain how the attackers gained access or whether the stores were struck in a single coordinated operation or picked off individually. No group claimed responsibility, and investigators had not confirmed whether the November wave was linked to October's attacks on roughly 700 French supermarkets, which CERT-FR had tied to internet-exposed Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers often still using documented factory-default credentials. EU agriculture commissioner Christophe Hansen called the repeated incidents "deeply concerning" and a deliberate attempt to disrupt the food supply chain and erode consumer trust, while adding that the bloc's food security was not currently threatened. Chains reported destroying significant quantities of spoiled food — one estimate put Delhaize's losses at around €100,000 — though no comprehensive financial tally was published.