Hackers Turn Supermarket Freezers Into Ovens Across Six European Countries in Second Wave of Attacks

Hackers turned supermarket freezers into ovens across six European countries overnight, remotely switching refrigeration systems into defrost mode and pushing temperatures as high as 50 degrees Celsius, in what retailers and cyber-security agencies are treating as a coordinated cyber-attack on the food supply chain. Dozens of stores in Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia were hit in the early hours of Monday, 2 November, forcing shops to throw away vast quantities of chilled and frozen food, close some branches and call in national cyber-security agencies.

The attack struck while the stores were empty. According to the BBC, refrigeration and freezer systems in dozens of supermarkets stopped keeping food cold overnight, and staff arriving in the morning found cabinets warming up instead of holding their usual freezing temperatures. The Belgian refrigeration company Sabcobel, which operates systems for the Delhaize chain, said the affected units had their evaporators switched into defrost mode, causing them to warm up — the same method believed to have been used in last month’s attack on hundreds of French supermarkets.

It is the second wave of a campaign that first surfaced three weeks ago, and it landed despite explicit warnings. After the French attack in October, France’s national cyber-security agency issued an emergency alert naming the vulnerable equipment, retailers were told to disconnect their refrigeration controllers from the internet, and one industry estimate suggested that around 4,500 of the affected controllers were still openly reachable online across Europe. The overnight attacks suggest that warning was not heeded fast enough — or that the fix is far harder than a software update.

No group has claimed responsibility for either attack, and no authority has named a culprit. Both Belgium’s and Sweden’s national cyber-security agencies said they were monitoring the incident, and the UK’s National Cyber Security Centre said it was working with international partners and industry to understand what had happened, while confirming that no incidents had been reported in Britain.

What happened overnight

The first alarms went off in the small hours of Monday morning. The Antwerp butcher chain De Laet & Van Haver said its alarms sounded at around 3 a.m. after its refrigeration settings were changed remotely, according to reports cited by specialist outlets. Store managers in Belgium were warned at around 4 a.m. that temperatures were rising, and in Sweden one ICA store in Stockholm was hit at 2 a.m. but the intrusion was only noticed at 5:30 a.m.

By the time staff reached their shops, the damage was done. In several places, freezers that should have held food at minus 18 degrees or colder had climbed to around 15 degrees, and in some cases the temperature reportedly rose as high as 50 degrees Celsius — 122 degrees Fahrenheit — hot enough to cook the food inside rather than preserve it. Food-safety rules leave no room for argument in such cases: chilled and frozen stock that has warmed beyond safe limits cannot be sold, and must be destroyed.

Millions of euros worth of food had to be thrown away, according to local media reports cited by the BBC. One Delhaize branch in Hoeilaart, in Flanders, told the Belgian news website Het Laatste Nieuws that it had lost 100,000 euros worth of produce — and its manager stressed that the figure did not even include the further losses from closing the shop. At an ICA store in Stockholm, staff were photographed throwing destroyed refrigerated goods out of powerless freezers, and the ICA Kvantum branch in Sjobo, in southern Sweden, wrote on its Facebook page that its fridges and freezers had been hacked overnight and set to 50 degrees, adding that it was working to discard the affected items.

Stephan Moelans, the chief executive of Sabcobel, told the Belga news agency that the incident was a cyber-attack and that the company had been “working all night and morning to disconnect the affected units from the network”. He said that since the French attack in early October, the company had been working to protect its customers’ fridges against the vulnerability — but that the units needed physical modifications, not just software updates. “The simplest solution is to manage the fridges over a secure internet connection. Most of our customers switched to that after the attack in France,” he added.

The six countries, store by store

The heaviest impact so far appears to be in Belgium and Luxembourg, where around 40 Delhaize supermarkets reported problems with their refrigeration, according to the BBC. Ahold Delhaize, the Dutch retail group behind the chain, described what happened as an information-technology incident affecting fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg. Its spokesperson, Sarah De Meester, told Belgian media that distribution centres were operating normally and that there had been no disruption to deliveries to stores, but that “in the affected stores, the range of fresh and frozen products is temporarily somewhat limited”.

Carrefour, the French-owned supermarket group, said the incident had only affected 15 of its more than 700 Belgian stores, adding that measures had been taken immediately to ensure all shops remained open. The Colruyt Group, which operates Spar stores in Belgium under a franchise system, told the Reuters news agency that five of its shops had their fridge systems attacked. Ahold Delhaize had already reported a separate cyber-security incident to police in the Netherlands last month, although no link between the two episodes has been confirmed.

In Sweden, the ICA Group said a limited number of its stores were affected overnight by an incident that hit refrigeration and freezing systems. Its spokesperson, Gustaf Nilsson, told the Swedish news agency TT that the affected shops were ones operating outside the group’s central network, and declined to give a specific number. The Coop chain said that six of its stores in central Sweden had problems with their fridges and freezers, according to TT, although the chain later told the BBC that seven of its roughly 800 Swedish stores were hit. Sweden’s national cyber-security centre is handling several incidents across the country, and its head, John Billow, acknowledged that Sweden has a large number of exposed operational-technology devices that need updating or patching.

In Ireland, thirteen SuperValu supermarkets were affected, according to the BBC. The Musgrave Group, which owns the chain, confirmed the disruption to Irish media. In the Netherlands, the Danish manufacturer Danfoss told Dutch public radio that the freezing and cooling systems of at least 17 companies had been attacked overnight, including butcher shops and small local stores. And in Estonia, a refrigeration equipment maker said one of its clients had been hit by a cyber-attack in which attackers accessed a computer controlling refrigeration and turned the temperature up to 50 degrees Celsius, according to the public broadcaster ERR. Jann Mutso, the chief executive of Kitman Coldtech, declined to say which store’s cooling system had been affected but said the attack was stopped within about ten minutes and there was no significant damage. The Selver chain said one of its outlets was affected.

The pattern was unmistakable: the same night, the same method, across six countries at once. Investigators in France had already established that the October attack was not the work of a single opportunist. Whether the two waves share the same perpetrator has not been confirmed by any authority, but the shared technique and the simultaneous timing across several countries point to a single campaign or a single tool, even though there is no evidence yet of a common perpetrator.

The same trick as France

The French precedent is the key to understanding what happened overnight — and why it happened again. On the night of 11 to 12 October, attackers took control of the refrigeration controllers at up to 700 French supermarkets out of roughly 10,000 nationwide, according to the French government, in what the Associated Press described as a large-scale attack that led to heavy losses of chilled and frozen food and underlined the vulnerability of internet-connected systems.

The chains hit in France read like a roll call of the country’s retail sector: more than 300 Intermarché and Netto stores, over 100 from Coopérative U, 80 Carrefour stores and around 30 Monoprix outlets, along with Leclerc stores. Hackers remotely overrode the settings on thousands of freezers, fridges and chiller cabinets, pushing temperatures from as low as minus 27 degrees to well over 50 degrees. At one store in Normandy, fridges showed 80 degrees. Intermarché counted 150 outlets with refrigerators at 50 degrees for six hours, and all the food went in the trash. The head of Intermarché’s parent company, Les Mousquetaires, put the losses at tens of millions of euros in a single day. Two stores in Alsace reported a combined loss of 270,000 euros, and individual stores reported losses ranging from tens of thousands of euros to more than 130,000 euros.

Investigators in France found that the attackers had disabled alarm systems before adjusting thermostats or stretching defrost programmes by hours. In the French case, defrost cycles that normally last about an hour were stretched to eight hours, delaying the alerts that would have warned staff. The Paris prosecutor’s office opened a formal investigation, citing food losses and fires among the damage, and the prime minister, Sébastien Lecornu, instructed France’s national cyber-security agency, ANSSI, to investigate. ANSSI later confirmed that supermarkets using controllers from two other companies had also been targeted.

France’s national computer emergency response team, CERT-FR, issued an alert on 12 October — CERTFR-2026-ALE-012 — warning of “numerous compromises” of controllers made by the Danish company Danfoss, specifically the AK-SM and AK-SC series, and extended the alert the following day to Copeland XWEB and Dixell XWEB systems. The alert was updated on 13 and 16 October, and CERT-FR said the campaigns were probably still ongoing. That last warning now reads as prophetic.

The vulnerable machines at the heart of the attack

At the centre of both attacks are small grey boxes that most shoppers never notice: refrigeration controllers, which run a supermarket’s entire cold chain and are often operated remotely over the internet by maintenance firms. Most supermarket cold aisles are connected to the internet to allow remote maintenance and alerts for system failures — a convenience that has become a doorway.

The Danfoss controllers named in the French alert are, in many cases, old machines. Danfoss said most of the affected devices were discontinued models with no further updates: the AK-SM 800 has had no support since May 2021, and the AK-SC 355 was retired in 2016. In early August, the security firm Claroty had published research on flaws in Danfoss AK-SM 800A controllers and Copeland XWEB Pro supervisors, which were later fixed with updates — although it remains to be established whether those very flaws were exploited in the attacks. Danfoss said it had identified security flaws last year and had “long recommended” that customers install updates, and released a patch for the current AK-SM 800A series last year. Anyone who did not update remained vulnerable.

The scale of the exposure is striking. After the attack in France, one report estimated that around 4,500 Danfoss controllers were still openly reachable on the internet in supermarkets across Europe. Danfoss said most of the affected units were older products and that it was working with customers on firmware updates and on ending direct exposure to the internet. CERT-FR advised operators to disconnect the controllers from the internet or reach them only through a virtual private network. That the same method worked again three weeks later, across six countries, shows how slowly that advice is being implemented — and how hard it is to implement. As Sabcobel’s chief executive pointed out, many of these units need physical modifications, not just software updates: a technician must visit each store, and in some cases each cabinet, to make the change.

There is also a transatlantic echo that investigators will be watching. Reuters reported on 29 October that the Pentagon was investigating a possible cyber-attack behind freezer failures at no fewer than six grocery stores on American military bases — the commissaries run by the Defense Commissary Agency for service members, their families and veterans — after refrigeration failures between August and October 2026. The Pentagon has acknowledged a possible refrigeration disruption and is investigating a suspected cyber-attack, but it has not confirmed that anyone accessed the stores’ systems, and no group or state has been named as responsible. Nobody has yet shown that the American incidents are connected to the European attacks, but the similarity of the target — food refrigeration, hit remotely — is impossible for investigators to ignore.

Analysis: Why It Matters

1. The food chain is now a cyber target

For years, cyber-security debates have centred on banks, hospitals, power grids and government networks. This attack adds a new item to that list: the cold chain that keeps a continent fed. Supermarkets are not soft targets by accident; they are soft targets by design. Their refrigeration systems were built for efficiency and remote maintenance, not for hostile environments, and they sit on the internet in their thousands, running equipment that in some cases predates the smartphones in shoppers’ pockets. The attackers did not need to breach a bank’s vault or a hospital’s records. They needed only to find a controller that nobody had patched, and to turn a dial. The result was the same kind of disruption that a far more sophisticated attack might achieve — shelves emptied, food destroyed, stores closed — at a fraction of the effort. Every country that relies on internet-connected refrigeration now has to ask the same question France asked in October and Belgium is asking today: how many of our freezers are one login away from being turned into ovens?

2. A fix that needs a screwdriver, not a patch

The most telling detail in the whole episode may be the one offered by Sabcobel’s chief executive: the affected units need physical modifications, not just software updates. That single sentence explains why the attack worked again three weeks after the first wave. A software patch can be pushed to thousands of machines overnight. A physical modification requires a technician, a ladder, a store visit and a maintenance window — multiplied across thousands of stores in a dozen countries, in the middle of the busiest trading period of the year. The controllers at the heart of the attacks are, in many cases, end-of-life products: the AK-SM 800 has had no support since 2021, the AK-SC 355 since 2016. They cannot be patched into safety; they must be replaced, reconfigured or taken off the internet entirely. That is a slow, expensive and disruptive job, and it is the job that now has to be done while the attackers are still active. The gap between a CERT alert and a fully remediated estate is measured in months, and the attackers have shown they are happy to work inside that gap.

3. No ransom, no claim — the hardest kind of attack to deter

Perhaps the strangest feature of both attacks is what did not happen: nobody demanded money, and nobody claimed credit. There was no ransom note, no data theft, no political message. In France, too, there was neither a claim nor a ransom demand — a detail that surprised investigators and leaves open the questions of who is behind the attacks and why. That absence matters, because it removes the usual levers of response. A ransomware gang can be negotiated with, traced through its payments and, sometimes, disrupted. A state actor leaves diplomatic traces. An attacker who simply breaks things and walks away leaves investigators with almost nothing: no motive to analyse, no payment to follow, no message to answer. The possibilities range from a criminal group testing a tool for sale, to a state actor probing European infrastructure, to simple vandalism at industrial scale. Until an attribution is made, every theory will circulate — and every theory will be wrong in some detail. The silence is itself the message: the target was chosen because it was there, and because it worked.

4. The cost lands on shoppers and small shops

The bill for these attacks will not be paid by the people who launched them. It will be paid by retailers, by insurers, by farmers whose produce was destroyed, and ultimately by shoppers. A single Delhaize branch lost 100,000 euros of produce in one night; the French attack cost tens of millions of euros in a single day, with individual stores losing more than 130,000 euros each. Small shops are the most exposed: the Dutch reports listed butcher shops and small local stores among the victims, and a family butcher cannot absorb a six-figure loss the way a multinational chain can. Beyond the money, there is the waste. Tonnes of meat, dairy and frozen food — food that was produced, transported and refrigerated at considerable cost — went into skips on a single morning, at a time when European households are already squeezed by food prices. And there is a quieter cost: trust. A shopper who finds the frozen aisle empty, or reads that freezers were remotely set to 50 degrees, may reasonably wonder what else in the store is connected, and who else can reach it.

5. A warning the whole connected world should hear

The supermarket freezer is only the latest example of a much larger problem: the internet of things has outrun the security of things. The same pattern — an old controller, a default password or an unpatched flaw, a remote connection that nobody remembered — has already appeared in water systems, in building controls and in industrial equipment. The European attacks are distinctive because they hit something so ordinary, so close to daily life, and did it so visibly. They also arrived alongside other reminders: the suspected freezer failures at American military commissaries, and the fake nuclear alerts that hit Russian and Ukrainian emergency apps on the same weekend, show that the infrastructure people rely on in a crisis is itself becoming a target. The lesson is not that supermarkets should go offline — remote monitoring genuinely prevents food waste and catches failures early. The lesson is that anything connected to the internet must be treated as exposed to the internet, with the maintenance, patching and monitoring that implies. The freezers were connected because it was convenient. They were attacked because it was possible. Until the first of those facts changes, the second will keep happening.

What to Watch Next

1. Attribution: whether Belgian, Swedish or French investigators name a perpetrator or a method — and whether the two waves are formally linked. Any attribution will reshape the diplomatic and law-enforcement response.
2. The CERT-FR follow-up: whether France’s cyber-security agency updates its October alert with new indicators, and whether other European agencies issue their own warnings naming the equipment involved in the 2 November attacks.
3. The remediation race: how quickly retailers and maintenance firms disconnect vulnerable controllers from the internet or move them behind secure connections — and whether any further stores are hit while the work is under way.
4. The American investigation: whether the Pentagon’s inquiry into the commissary freezer failures confirms a cyber-attack, and whether any technical link to the European incidents emerges.
5. The cost and the claims: the final tally of destroyed food and closed stores across the six countries, and whether insurers and regulators treat the episode as a systemic failure of connected-equipment security rather than a series of isolated incidents.

Sources

• BBC News — “Shop freezers in six European countries hit by suspected cyber-attack” (2 November 2026)
• Associated Press — “Supermarket freezers across Europe hit by apparent cyberattacks” (2 November 2026)
• Bitcomme — “Supermarket freezers across Europe hit by second suspected cyber-attack” (2 November 2026)
• iFynx — “Supermarket Cyber Attack: Fridges Hacked in Belgium & Sweden” (2 November 2026)
• Europe Says — “Freezer Hack: After France, Cyberattacks Hit Supermarkets in Sweden and Belgium” (2 November 2026)