In the early hours of Monday, 2 November 2026 (around 01:00 GMT, according to Reuters), attackers raised the temperature of fridges and freezers in supermarkets across Europe. Stores in Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia reported incidents. Some units reached 50°C, and shops had to throw away chilled and frozen food. It is the second such wave in less than a month, after attackers hit refrigeration controllers at nearly 700 French supermarkets in October.
Who was hit (company figures): Delhaize says an "IT incident" affected refrigeration in several dozen stores, mostly in Belgium and a few in Luxembourg. Carrefour Belgium says 15 of its more than 700 stores were affected, Colruyt five Spar franchise shops, and IKEA its store in Mons. In Ireland, Musgrave says 13 SuperValu stores were affected. In Sweden, ICA says a "limited number" of stores using an outside supplier were hit, while its central systems were not. Coop told Swedish media six stores were affected; Reuters reports seven of about 800. A Belgian butcher told Reuters it lost about €15,000 of meat.
How it was done: the CEO of Sabcobel, which runs Delhaize's refrigeration systems, said the evaporators were switched to defrost mode. In Estonia, the manufacturer Kitman Coldtech said attackers accessed a computer that controls one client's refrigeration and set it to 50°C. Reuters says Danfoss temperature-control technology was used in at least some affected units, and Danfoss says it is helping customers apply fixes. The exact entry point has not been published. Sweden's national cybersecurity centre says many internet-exposed operational technology devices in the country need updates or patches.
Who is behind it is unknown. No group has claimed the attacks, and Reuters could not determine whether they are linked to the French incident. A spokesperson for Belgium's Centre for Cybersecurity said the attackers may never be identified. EU Agriculture Commissioner Christophe Hansen called it a deliberate attempt to disrupt the food supply chain. A SentinelOne researcher said the lack of ransom demands points to sabotage rather than extortion.
Background from October: the French attack targeted Danfoss controllers (including AK-SM 800A and StoreView panels) as well as Copeland XWEB and Dixell units, many of them reachable from the internet, outdated or no longer updated. France's CERT-FR issued alert CERTFR-2026-ALE-012. Danfoss released firmware R4.3.1. According to The Register, Coalition counted at least 2,624 refrigeration controllers with internet-facing login pages before that attack.
