Europe's Supermarket Freezer Attacks Spread to Seven Countries

At a Selver supermarket in Estonia, a freezer was set to 50C. The cabinet warmed by only about 2 to 3 degrees before the problem was fixed, roughly ten minutes later, according to the refrigeration supplier Kitman Coldtech, which spoke to Estonian broadcaster ERR. No stock was damaged. It is the mildest known case in a week of attacks on the systems that keep European supermarket food cold.

Related reading: Hackers Forced French Supermarket Fridges to Heat to 50C Overnight · Apple Warned German Lawmakers of Mercenary Spyware. Germany Cannot Say If It Worked.

The rest of the picture is worse. Overnight into Monday 2 November 2026, attackers changed settings on internet-connected refrigeration controls at stores in Belgium, Luxembourg, Sweden, Ireland and Estonia, with the Netherlands and Finland named in wider reporting. Euronews put the total at seven countries. Nobody has claimed the operation. Nor has anyone established whether it is the same campaign that hit France in October.

The count is smaller than the map

Start with the chains that gave numbers, because the numbers are the only solid ground here. Delhaize described an "IT incident" that limited its fresh and frozen range at several dozen stores, mostly in Belgium and a few in Luxembourg. The BBC put the Delhaize figure at about 40 stores. Carrefour said 15 of its more than 700 Belgian stores were affected and called it a cyberattack on its refrigeration with very limited impact, CNBC reported.

Below those two, the counts get small and specific. Intermarché had fridge problems at 10 to 15 stores. Spar, whose Belgian stores are run by independent owners under Colruyt Group, had five stores attacked. One IKEA store, in Mons, was hit by a cyber incident affecting fridges and freezers, and the company said no other Belgian IKEA store was affected. The Hacker News compiled those figures from company statements.

Sweden supplies the widest range. ICA reported a limited number of stores operating outside its central network, and did not confirm a cyberattack. Coop gave two different numbers for the same event: 6 stores to the Swedish news agency TT and to AFP, and 7 to Reuters and Bloomberg, out of about 800. In Ireland, Musgrave's SuperValu had 13 stores affected, with some chilled and frozen products removed from sale.

Read the list as a floor rather than a census. Some companies gave ranges, some declined to give any number, and the figures count stores, not the number of controllers or cabinets involved. A single store can hold dozens of units. The totals also moved between outlets within a day, as Coop's 6 and 7 show. The plausible reading is that the confirmed cases are the ones retailers were willing to describe in public, not the full set of stores that lost cold storage that night.

Two ways to warm a cabinet

The mechanics were simple, which is part of why they worked. A refrigeration controller is a small computer that runs a store's fridges and freezers. Many are connected to the internet so contractors can monitor them and fix faults remotely, The Hacker News noted. An attacker who reaches one can change what it does without touching a single cabinet.

In Belgium, the attackers switched cooling units into defrost mode, according to Stephan Moelans, chief executive of the refrigeration contractor Sabcobel, which manages Delhaize's systems. Defrost mode exists to clear ice off a unit's coils. In these attacks it heated the cabinets instead of keeping food cold. Elsewhere the method was blunter: someone raised the temperature setpoint. An ICA store in Sjöbo, in southern Sweden, said its fridges and freezers were set to 50C and staff were throwing out affected goods, the AP reported.

The human timeline is tight. Engla Ingwall, sales manager at an ICA franchise store in Stockholm, told Reuters the attack happened at 2 a.m. and was noticed hours later. "Everything is destroyed," she said.

"There has been a cyberattack and all our freezers reached 50 degrees (Celsius)." Engla Ingwall, sales manager at an ICA franchise store in Stockholm

Luc De Laet, who owns a Belgian butchery chain, told Reuters that an employee woke him at 3:30 a.m. He found fridges turned up as high as 18C and estimated that about €15,000 of meat was ruined. "It's very scary," he said. "They are hacking the system that is doing the registration of the temperature, and they can program it at a distance."

Not every retailer used the same word

The language matters for anyone trying to size the incident. Delhaize called it an "IT incident". ICA did not confirm a cyberattack at all. Coop described an incident in which someone tampered with refrigeration without permission. Carrefour was the clearest: it called the incident a cyberattack on its refrigeration. Belgium's federal prosecutor opened a criminal investigation, according to VRT, as cited by The Hacker News. The case is now a law enforcement matter as well as a retail one, which tends to make companies more careful about what they say and slower to publish numbers.

The French run-up, and why it is not a replay

This is the second wave in three weeks. In October 2026, attackers forced refrigeration systems at hundreds of French supermarkets into prolonged defrost, and some cabinets reached about 50C. TechPastWeek covered that attack when it happened. The French wave caused food losses and fires, according to police. Nothing in the reporting on this wave suggests fires or damage on that scale, and it should not be described as if it does.

What the two events share is a vendor. Danfoss, the Danish maker of refrigeration controls, said its products were involved in this wave, as they were in the French attack three weeks earlier, The Hacker News reported. What they may also share is a gap in guidance. CERT-FR, part of France's national cybersecurity agency, published an alert in October 2026 with the most detailed operator advice available. Danfoss's security advisory page listed no advisory about these attacks when The Hacker News checked on 3 November.

Who did it: an open question with several theories

No one had claimed responsibility. It was not known whether the attacks were linked to the French wave, according to The Hacker News, CNBC and the BBC. Sweden's national cybersecurity centre said it could not speculate on who was behind the incidents and was working on several cases affecting grocery stores. Its head, John Billow, told CNBC that Sweden had identified "quite a lot of exposed operational technology devices" that needed updating or patching.

The motive is a guess dressed as analysis. Tom Hegel, a researcher at SentinelOne, told CNBC that attacks of this kind are usually extortion-based, politically motivated or run by nation-states, and that the absence of financial demands in the supermarket cases pointed toward sabotage. That is an expert assessment, not a finding. Moscow has repeatedly denied involvement in sabotage or hybrid operations, and Reuters could not establish who was behind the attacks or whether they were connected to the French incidents. Nothing in the public record names a culprit.

Why the controllers are reachable in the first place

Refrigeration controls sit in the part of a company's technology that most security teams see last. They are operational technology, built for uptime and remote maintenance, often installed by contractors and left on a network so a technician can adjust a setpoint without driving to the store. That convenience is the attack surface. A device that a contractor can reach from outside is a device someone else may reach too.

Food retail adds pressure. Margins are thin, cold-chain rules are strict, and a chain with hundreds of sites wants central visibility over energy use and equipment faults. Centralising that control saves money and creates a single logical path into many stores. The Estonian case shows how small the physical effect can be when a controller is caught early. The Belgian butchery shows the other end, where a few hours of warmth turns stock into waste.

No CVE, no advisory, no shared root cause

Three things that usually anchor a security story are missing. No CVE has been published for the attacks, and there is no vendor advisory describing what to fix. And there is no confirmed shared root cause across the affected countries. Danfoss confirmed its products were involved but, as of 3 November, had not published guidance on the attacks.

Without those, defenders are left with the basics: find the controllers, check who can reach them, and remove the ones that do not need to be on the public internet. Billow's remark about exposed operational technology devices suggests the inventory problem is large. It also suggests the fix is unglamorous and slow, which is usually the case with industrial equipment that was never designed to be patched every month.

What would settle the open questions

Attribution first. A claim of responsibility, an indictment or a joint statement from investigators would change the story from an unexplained disruption into a named operation. Until then, the sabotage reading stays an inference from the lack of ransom demands.

Then the counts. National loss totals have not been published, and the €15,000 butchery figure is one owner's estimate. If regulators or insurers start publishing aggregate numbers, the scale will become clearer than a sum of company statements.

Watch the vendors, too. A Danfoss advisory, or a CERT-FR update that names affected models and firmware, would tell thousands of store operators whether their equipment is in scope. And watch whether the French and November waves are formally linked. That answer decides whether Europe is dealing with one campaign or two, and whether the next wave is already scheduled.

Cover image: "Glass door freezer display cabinets ... in Spar Supermarket in Tjøme, Norway" by Wolfmann, CC BY-SA 4.0, via Wikimedia Commons.