A cyberattack targeting remotely managed refrigeration equipment has disrupted more than 115 retail locations across Europe, leaving supermarkets with malfunctioning freezers and spoiled food. Attackers reportedly changed temperature settings and activated defrost functions, forcing stores to remove products that could no longer be safely sold.
The incidents were reported on November 2, 2026, affecting businesses in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. Several major supermarket chains confirmed disruptions, although investigators have not established whether the incidents were part of a coordinated campaign or separate attacks exploiting similar weaknesses.
Among the affected retailers, Ahold Delhaize reported refrigeration problems at approximately 40 locations in Belgium and Luxembourg. Carrefour confirmed disruptions at 15 Belgian stores, while Sweden’s Coop and ICA reported seven and at least four affected outlets, respectively. Ireland’s SuperValu identified problems at 13 stores.
The consequences varied between locations. Some refrigeration units stopped operating entirely, while others continued running at incorrect temperatures. Coop reported that one affected system began generating heat instead of cooling.
At an ICA supermarket in Sweden, a manager said attackers had remotely increased refrigeration settings to 50°C (122°F). Staff were unable to restore the correct temperature, resulting in the disposal of frozen products.
Belgian retailers also faced significant disruption. According to local reporting, some Ahold Delhaize store managers received warnings about the problems at approximately 4 a.m. Refrigerated trucks were brought in at certain locations to preserve stock while technicians worked on the affected equipment.
Refrigeration technology provider Sabcobel was identified as a supplier to several impacted businesses. Its director, Stephan Moelans, said attackers had exploited the same vulnerability involved in similar incidents in France during October. Technicians began disconnecting affected installations overnight to prevent further interference.
The earlier attacks in France affected hundreds of supermarkets and reportedly involved Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers. Attackers manipulated the equipment remotely, activating defrost cycles and raising storage temperatures.
The latest incidents have renewed attention on security weaknesses in internet-connected industrial control systems. Such equipment allows retailers to monitor and manage refrigeration remotely, but exposed management interfaces can also provide opportunities for unauthorized access.
Despite the disruption, several retailers said their stores remained open. Carrefour reported that none of its hypermarkets were affected, while Coop stated that the situation at its seven impacted locations had been contained.
No hacking group has publicly claimed responsibility.