Key takeaways
- A suspected cyberattack overnight into November 2, 2026 raised temperatures in supermarket fridges and freezers in Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia, according to the BBC.
- The incident follows an October 11 to 12 attack on about 700 French supermarkets, and no group has claimed responsibility for either one.
- Investigators and retailers point to internet-exposed refrigeration controllers that had not been updated, not to a breach of retailers' central networks.
- It is not established whether the French and the new attacks share a perpetrator, and experts quoted by Reuters said the method appeared easy to carry out.
A suspected cyberattack overnight into Monday, November 2, 2026, pushed up temperatures in refrigerators and freezers at dozens of supermarkets and smaller shops in six European countries, according to the BBC as relayed by Around Prague. The affected stores are in Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia. The episode matters because it is the second such wave in three weeks and shows that routine commercial equipment can be used to disrupt food supply across borders.
What is the cyberattack on European supermarket freezers?
Retailers and equipment suppliers describe remote tampering with refrigeration controllers, the devices that let service firms monitor and set temperatures from afar. The Associated Press reported that an ICA Kvantum store in Sjöbo, southern Sweden, said its units had been hacked and set to 50 degrees Celsius, and that it was discarding the affected stock.
In Sweden, the retail chain Coop told Aftonbladet that six of its stores were affected, according to Reuters via NBC News. In Belgium and Luxembourg, Ahold Delhaize and Colruyt reported an overnight IT incident. Colruyt said five Spar shops operated under its franchise system had their fridge systems attacked, Reuters reported.
Stephan Moelans, chief executive of the Belgian refrigeration firm Sabcobel, which operates Delhaize’s systems, told the Belga news agency the incident was a cyberattack in which evaporators were switched to defrost mode, Reuters said. In Ireland, SuperValu said 13 of its 223 stores were affected, limited to one specific model of refrigeration equipment.
Scale varies by source. The Record, citing retailers, reported that more than 50 stores had been identified in Belgium and over a dozen in Ireland, Estonia, the Netherlands and Luxembourg. Local reports cited by the BBC put the losses at food worth millions of euros.
How does this connect to the French attack?
The pattern echoes an attack on French supermarkets on the night of October 11 to 12. French Economy Minister Roland Lescure told the National Assembly on October 13 that about 700 of the country’s 10,000 supermarket locations had been affected, according to trade outlet ACHR News. France’s CERT-FR confirmed that refrigeration controllers from Danfoss, Copeland and Dixell were among the equipment involved.
France’s prime minister, Sébastien Lecornu, instructed the national cybersecurity agency ANSSI to investigate and to coordinate with other European countries, Wikipedia’s summary of the incident states. The Paris prosecutor’s office opened its own investigation, per AFP.
Whether the two waves are linked is unresolved. The Record reported that no group has claimed Monday’s hack or the October one, and that it is not known whether the same perpetrators were involved.
Who is behind the cyberattack?
No government or law enforcement agency has named a perpetrator. CNN reported that no ransom demand has been made public in the French case, a point a source told Reuters had puzzled investigators, according to a Clash Report summary.
Analysts are cautious. Félix Aimé of the security firm Sekoia said a lone hacker or a hacktivist group could not be ruled out. Ken Munro of Pen Test Partners suggested it could be “kids messing around,” and three cyber experts told Reuters the attack appeared easy to carry out, according to Around Prague’s summary. Another outlet noted that security experts regard state actors such as Russia or Iran as capable of this kind of sabotage, but that is a general assessment and not an attribution, per Trending Topics.
Separately, Reuters reported last week that the Pentagon suspected refrigeration failures at US military grocery stores were caused by a cyberattack, Ynet reported. No link to the European incidents has been established in the sources reviewed.
Why were the freezers vulnerable?
The common thread is exposure, not a breach of retailers’ own corporate systems. ICA said the affected stores’ connections operated outside its central network, according to Cyberpress. John Billow, head of Sweden’s national cybersecurity centre, told Reuters that Sweden has many exposed operational technology devices that authorities have urged owners to update or patch.
Supermarkets often outsource refrigeration to service providers and may not control the security of the devices, Trending Topics noted. It also reported that an estimated 4,500 Danfoss controllers remained reachable online after the French attack. Sabcobel’s Moelans said most of its customers had moved to secure internet connections for controlling units after the French incident.
The UK’s National Cyber Security Centre said it was working with international partners and industry to understand the incident, per Around Prague. For a separate cyber story in the current news cycle, see Russia Cyber Attack: Fake Nuclear Alerts Hit Both Sides.
What to watch
- Attribution: any claim of responsibility, or a statement from ANSSI, Sweden’s national cybersecurity centre or prosecutors on whether the French and November 2 incidents are linked.
- Patching orders: advisories or deadlines for Danfoss, Copeland and Dixell controller owners in more countries.
- Further waves: reports from additional countries or chains, given that ANSSI had warned in October that attacks were probably continuing.
- Cost figures: retailer and insurer estimates of losses, including in Belgium and Sweden.
- EU coordination: whether European governments formally raise the incidents as a critical-infrastructure issue.
Frequently asked questions
Which countries were hit by the supermarket freezer cyberattack on November 2, 2026?
According to the BBC, as relayed by Around Prague, affected stores are in Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia. France was hit in a similar attack on the night of October 11 to 12, when about 700 supermarkets were affected, according to the French economy minister.
Who is responsible for the European supermarket freezer hack?
No one has been identified. The Record reported that no group has claimed Monday's attack or the earlier French one, and it is unknown whether the same perpetrators were involved. Experts quoted by Reuters said the method appeared easy to carry out, and no government has named a suspect.
How did hackers overheat the supermarket freezers?
Reports describe remote access to refrigeration controllers that were reachable over the internet. The Belgian firm Sabcobel said units were switched into defrost mode, and Swedish stores reported temperatures of 50 degrees Celsius or higher. Officials say many exposed controllers had not been updated, though the exact flaw exploited remains unclear.
Sources
- Freezers at supermarkets in several European countries hit by apparent cyberattacks (AP via WRAL)
- European supermarkets hit by new fridge cyberattack (Reuters via NBC News)
- European supermarkets hit by new fridge cyber attack (Reuters via The Standard)
- Second wave of suspected cyberattacks hits supermarket freezers across Europe (The Record)
- Supermarket Freezer Hack Spreads to Six Countries: The Key Numbers (Around Prague, citing BBC)
- Hackers target refrigerators in Ireland and European countries in new wave of cyber attacks
- Massive Cyberattack Targets Refrigeration Systems at French Supermarkets (ACHR News)
- Freezer Hack: After France, Cyberattacks Hit Supermarkets in Sweden and Belgium (Trending Topics)
Top image: Arild Vågen / Wikimedia Commons (CC BY-SA 4.0)
This article was produced by the Intelligence Report Desk. Sources are linked below.
