A new wave of cyberattacks has targeted supermarket refrigeration systems across Europe, causing refrigerators and freezers to heat up and putting large quantities of food at risk. The incidents were reported overnight between Sunday, November 1, and Monday, November 2, 2026, affecting supermarkets and local businesses in Belgium, Sweden, Estonia, Ireland, the Netherlands, Luxembourg and Finland. Attackers reportedly gained remote access to refrigeration control systems and changed temperature settings, disrupting normal cooling operations. Several affected stores were forced to remove chilled and frozen products from their shelves or throw away food that was no longer safe to sell.
In Belgium, several major supermarket chains reported problems with their refrigeration equipment. Ahold Delhaize reported incidents at several dozen stores, while Carrefour confirmed that 15 of its more than 700 Belgian stores were affected. Around five Spar stores operated under Colruyt Group and 10 to 15 Intermarché locations also reported refrigeration issues. One IKEA store in Mons was affected as well. According to refrigeration company Sabcobel, attackers remotely switched cooling units into defrost mode, a function normally used to remove ice but which caused the equipment to warm up instead of keeping food cold.
The attacks also spread to other European countries, affecting several well-known retailers. In Sweden, ICA and Coop reported problems with refrigeration and freezer systems, with some units reportedly set to temperatures as high as 50°C. In Ireland, 13 SuperValu stores operated by Musgrave were affected, forcing the company to remove chilled and frozen products as a precaution. Estonia also reported an incident at one Selver supermarket, where an attacker accessed an older refrigeration control system. The issue was resolved within approximately 10 minutes, and no products were damaged. In the Netherlands, at least 17 businesses, including butcher shops and smaller stores, were reportedly affected.
One particularly concerning incident involved a Belgian butcher shop operated by De Laet & Van Haver, where refrigeration temperatures reportedly increased to around 18°C. The owner estimated that approximately €15,000 worth of meat was spoiled because of the incident. Meanwhile, Musgrave confirmed that the situation at its affected SuperValu stores had been resolved and that restocking was underway. Several of the affected refrigeration systems were manufactured by Danfoss, a Danish company that produces industrial cooling controls. Reports also indicated that some equipment from other manufacturers, including Copeland, was involved. Investigations suggest that outdated software, exposed internet connections and unchanged default passwords may have made some systems vulnerable.
The incidents have raised serious concerns about the cybersecurity of internet-connected industrial equipment. Refrigeration control systems allow contractors to monitor temperatures and manage equipment remotely, but poorly secured connections can also provide attackers with an entry point. Security recommendations from France’s national cybersecurity agency, CERT-FR, include removing unnecessary internet exposure, checking system configurations and securing remote access through protected networks or VPN connections. Operators are also advised to update firmware, replace default passwords and use stronger security settings. Devices that have already been compromised may require a restart or factory reset, followed by proper reconfiguration. Older systems that no longer receive security updates are particularly vulnerable.
The latest incidents follow a similar cyberattack reported in France in October 2026, when hundreds of supermarkets experienced disruptions to their refrigeration systems, resulting in significant food losses. Although some companies have reported similar attack methods across the affected countries, there is currently no confirmed evidence that all incidents were carried out by the same attackers. No individual or group has claimed responsibility for the latest wave of attacks. Belgium’s federal prosecutor’s office has opened a criminal investigation, while cybersecurity authorities in other affected countries are monitoring the situation and sharing information. The incidents highlight how cyberattacks targeting industrial control systems can move beyond digital disruption and directly affect businesses, food supplies and everyday consumers.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
