Cyberattack Strikes Supermarket Freezers Again, Leaving Large Amounts of Food Spoiled
A new wave of cyberattacks has disrupted supermarket refrigerators and freezers across several European countries, forcing retailers to remove chilled and frozen food from sale.
The incidents occurred overnight into Monday, November 2, 2026, and affected businesses in Belgium, Luxembourg, Sweden, Ireland, Estonia, Finland and the Netherlands. Retailers reported interference with refrigeration systems and changes to cooling controls, while authorities began investigating the attacks.
The latest incidents follow a separate attack on refrigeration systems at hundreds of French supermarkets on October 12. The two events are being reported as separate waves, and there is no established connection between them.
Several European retailers reported disruptions
The impact varied from one retailer to another.
Carrefour said 15 of its 700 Belgian stores were affected. Colruyt Group said five of its Spar franchise shops in Belgium were affected, while IKEA confirmed one affected Belgian store and said it could not rule out disruption elsewhere.
Ahold Delhaize reported affected refrigeration systems in Belgium and Luxembourg. Trade reporting put the number of Delhaize locations at around 40, although that figure was attributed to trade reporting rather than presented as a final company count.
In Sweden, ICA acknowledged an incident involving refrigeration and freezer systems at a limited number of stores. Reuters later reported seven affected Coop stores out of 800, while earlier reporting cited six, making the count a developing figure.
Ireland was also affected. Musgrave said refrigeration systems at 13 SuperValu stores were involved, requiring some chilled and frozen products to be withdrawn from sale.
Some stores lost large amounts of food
The refrigeration problems had a direct effect on supermarket inventory.
Retailers discarded food, withdrew chilled and frozen products and temporarily lost the use of some refrigeration cases. Reuters photographs showed empty refrigeration shelves at a Delhaize Shop & Go in Linkebeek, near Brussels.
Individual businesses also described significant losses.
In Stockholm, ICA franchise sales manager Engla Ingwall told Reuters that the store’s freezers reached 50 degrees Celsius. “Everything is destroyed,” she said, describing the effect on her store.
Another ICA Kvantum branch in Sjöbo separately reported that its systems had been remotely set to 50 degrees Celsius. Those reports concern specific stores and should not be treated as a temperature reached by every affected freezer.
South of Antwerp, Belgium, business owner Luc De Laet reported refrigerators reaching 18 degrees Celsius and estimated that his business suffered approximately €15,000 in meat losses.
The attacks targeted cooling controls
This was not simply a case of supermarket websites going offline.
The reported incidents involved systems that control physical refrigeration equipment. Attackers were reportedly able to alter cooling settings, including switching evaporators into defrost mode. That can cause refrigeration units to warm instead of maintaining their normal cooling operation.
Network-connected refrigeration controllers can allow authorized employees to monitor and adjust temperatures remotely. When management interfaces are exposed or inadequately secured, they can also create opportunities for unauthorized changes.
Some affected systems used Danfoss temperature-control technology, which was also identified in reporting about the earlier French incident. That does not mean every affected retailer used the same equipment.
Danfoss said equipment involved in the French incident had outdated firmware or had reached the end of its supported life. The company said it released a patch after a vulnerability was disclosed and was working with customers on fixes. Those comments relate to the French incident rather than establishing the cause of every November attack.
The November attacks are different from the October incident
The October 12 attack in France involved refrigeration systems at hundreds of supermarkets and was accompanied by reports of food losses and fires.
Those consequences should not automatically be attached to the November incidents.
The November wave affected multiple countries and involved refrigeration disruptions, but the precise access method has not been established for every incident. The reporting does not identify one vulnerability, password, or manufacturer as the cause of the entire wave.
Investigators still do not know who is behind it
Authorities are investigating the attacks.
Belgium’s prosecutor’s office opened a criminal investigation, while Sweden’s National Cybersecurity Center was also investigating. No group had claimed responsibility in the reporting reviewed.
Belgium’s Center for Cybersecurity spokesperson Katrien Eggers said, “It is not known who is behind this attack, and it may never be determined,” according to Reuters.
Cybersecurity specialists have discussed possibilities including sabotage or state-linked activity, but those possibilities do not establish who carried out the attacks or why.
What shoppers should know
The immediate consumer effect has been the removal of affected chilled and frozen products from sale.
The incidents do not establish a Europe-wide food shortage, a related foodborne-illness outbreak or that unsafe products were sold to customers. There is also no final independently verified financial loss or measured total weight of spoiled food from the November incidents.
European Agriculture Commissioner Christophe Hansen said food security was not currently at risk while acknowledging that the food waste and impact on businesses were real.
For now, the story is one of disrupted refrigeration systems, discarded food and an investigation that is still unfolding. The attacks have affected supermarkets across several European countries, but who carried them out and whether the November incidents were connected to the earlier French attack remain unanswered.
