European Supermarkets Hit by Coordinated Cyberattacks on Refrigeration Systems

What Happened

On Monday, November 2, 2026, dozens of supermarkets across Belgium, Sweden, and Ireland experienced widespread disruptions to their refrigeration and freezer systems, attributed to suspected cyberattacks. In Belgium, approximately 40 Delhaize supermarkets and 15 Carrefour stores were affected, with one Delhaize branch in Hoeilaart reporting an estimated €100,000 loss in produce. Simultaneously, several ICA and Coop shops in Sweden, including at least six Coop and four ICA stores, reported their refrigeration temperatures were remotely set to as high as 50°C (122F) or 55°C. An ICA branch in Sjöbo, southern Sweden, explicitly stated on social media that its 'refrigerators and freezers have been hacked overnight.' Additionally, 13 SuperValu shops in Ireland were impacted by the same incident. These events follow a similar, larger-scale cyberattack that affected around 700 French supermarkets on October 11 and 12, where refrigeration systems were also compromised, leading to spoiled food and investigations into reported fires.

The attacks caused significant operational issues, forcing stores to empty freezers and discard millions of euros worth of food. An employee at an ICA branch in Odengatan, Stockholm, was photographed disposing of bags of spoiled food. While some stores, like the ICA branch in Sjöbo, managed to reopen after temporary closures, the immediate financial and logistical impact was substantial. National cybersecurity agencies in both Belgium and Sweden have confirmed they are actively monitoring the situation, though no specific group has claimed responsibility for any of the incidents, and investigators have not yet confirmed a direct link between the attacks in the different countries.

What the Evidence Establishes

The evidence establishes a pattern of targeted cyberattacks against internet-connected refrigeration systems within European supermarket chains. Multiple independent reports from the BBC and News9live confirm that stores in Sweden (ICA, Coop), Belgium (Delhaize, Carrefour), and Ireland (SuperValu) experienced simultaneous refrigeration failures on November 2, 2026. These failures were characterized by temperature settings being remotely altered to extreme highs, specifically 50°C to 55°C, rendering stored food unsafe for consumption. The scale of the damage is significant, with local media reports indicating millions of euros worth of food discarded across the affected regions.

The mechanism of attack appears to exploit vulnerabilities in modern supermarket refrigeration systems that utilize internet-connected controllers for remote monitoring and maintenance. If attackers gain unauthorized access to these controls, they can manipulate temperature settings or activate defrost functions, leading to rapid spoilage. The prior incident in France in October 2026, which affected approximately 700 supermarkets including Carrefour, Intermarché, Monoprix, and Coopérative U, also involved compromised refrigeration systems. Security concerns from the French incident specifically highlighted remotely accessible refrigeration controllers, including equipment supplied by Danish manufacturer Danfoss, and the use of older software lacking security updates. While no direct link has been confirmed between the French, Belgian, Swedish, and Irish incidents, the similar modus operandi strongly suggests a coordinated or technically related campaign.

Where the Accounts Conflict

While the core facts of widespread refrigeration system disruptions due to suspected cyberattacks are consistent across reports, some minor discrepancies exist regarding the precise number of affected stores and specific temperature readings. The BBC reported 'around 40 Delhaize supermarkets in Belgium and Luxembourg' and 'several ICA and Coop shops in Sweden,' alongside 'thirteen SuperValu shops' in Ireland. News9live, citing various sources, stated 'around 60 stores reportedly affected' in Belgium, 'at least six Coop and four ICA stores' in Sweden, and 'approximately 700 supermarkets affected' in France. The Financial Times, as cited by News9live, reported 'at least four ICA stores were affected, with temperatures reaching as high as 55°C in some cases,' while the BBC noted one ICA store in Sweden reported temperatures set to 50°C.

A more significant area of conflict or, more accurately, an absence of corroboration, lies in establishing a definitive link between the attacks across different countries. Both the BBC and News9live explicitly state that 'it is not clear who is behind the attack' and 'there is currently no confirmed evidence that the attacks in Sweden, France and Belgium were conducted by the same individuals.' Despite the striking similarities in methodology and target, investigators have not publicly confirmed a single actor or group responsible for all incidents. This lack of confirmed attribution and linkage represents a critical gap in the overall understanding of the campaign's scope and origin, leaving open the possibility of multiple, unrelated but technically similar attacks, or a single, sophisticated actor operating under different guises.

Context and Stakes

These cyberattacks on European supermarket refrigeration systems highlight a critical vulnerability in modern food supply chains, which increasingly rely on internet-connected operational technology (OT) and industrial control systems (ICS). The use of remote monitoring and maintenance for refrigeration units, while efficient, introduces significant attack surfaces that, if exploited, can directly impact physical operations and public health. The incidents underscore the broader trend of cyber warfare extending beyond traditional IT networks to critical infrastructure, including sectors like food distribution, energy, and healthcare, as evidenced by the mention of nuclear attack warnings and hospital hacks in the News9live report.

The stakes are substantial, encompassing significant financial losses for retailers due to spoiled inventory and forced closures, potential food safety concerns for consumers, and a broader erosion of trust in the security of essential services. The reported use of older software that no longer receives security updates, as noted in the French incident, points to a systemic issue within the deployment and maintenance of IoT devices in commercial settings. This creates a fertile ground for malicious actors to exploit known vulnerabilities. The attacks serve as a stark warning to businesses across all sectors that rely on remote monitoring and maintenance, emphasizing the urgent need to secure operational technology to protect not just data, but physical assets and the continuity of vital services.

What to Watch Next

Investigators will focus on identifying the specific vulnerabilities exploited in the internet-connected refrigeration controllers and determining if a common software or hardware platform, such as those from Danish manufacturer Danfoss, was universally compromised. The national cybersecurity agencies of Belgium and Sweden, along with their French and Irish counterparts, are expected to intensify their collaborative efforts to attribute the attacks and share threat intelligence. Retailers, particularly those affected, will likely accelerate audits of their operational technology security protocols and potentially implement emergency manual override procedures for critical systems like refrigeration. The broader cybersecurity community will be monitoring for any public claims of responsibility from hacker groups, which could shed light on the motives, whether financial, geopolitical, or disruptive in nature.

Furthermore, the response from manufacturers of IoT refrigeration systems will be critical. Companies like Danfoss, whose equipment was implicated in the French attacks, may issue urgent security patches or advisories. The European Union may also consider new regulations or guidelines for critical infrastructure cybersecurity, specifically targeting the security of operational technology in the food sector. Consumers should watch for any official food safety warnings or recalls, although the immediate response has focused on discarding spoiled goods. The coming days will reveal the extent of inter-agency cooperation and the speed with which specific technical details of the exploits are identified and mitigated across the affected regions.

Bottom Line

A series of suspected cyberattacks has severely disrupted supermarket refrigeration systems across Belgium, Sweden, and Ireland, mirroring a larger incident in France last month. These attacks, which remotely manipulated temperatures to spoil millions of euros worth of food, underscore the escalating vulnerability of critical infrastructure reliant on internet-connected operational technology. While no perpetrators have been identified and a direct link between all incidents remains unconfirmed, the consistent methodology points to a sophisticated and potentially coordinated campaign targeting the European food supply chain.

The incidents highlight a systemic cybersecurity challenge, particularly concerning older, unpatched software and remotely accessible control systems. The immediate consequences include substantial financial losses for retailers and potential food safety risks, while the long-term implications involve increased pressure on governments and businesses to fortify the security of their operational technology. The ongoing investigations by national cybersecurity agencies will be crucial in identifying the specific exploits and actors involved, shaping future cybersecurity policies, and determining the resilience of Europe's essential services against such disruptive digital threats.