Supermarket refrigerators and freezers across nine European countries were disrupted by suspected cyberattacks on November 2, 2026. Retailers reported unusually high temperatures in their cooling systems, with some equipment reportedly reaching 50°C, forcing stores to remove chilled and frozen products from sale and discard spoiled food.
The incidents affected businesses in Belgium, Sweden, Ireland, the Netherlands, Estonia, Luxembourg, Finland, Italy and Portugal. Several major retail chains confirmed disruptions, while cybersecurity authorities and law enforcement agencies began examining the incidents.
The attacks highlight a growing problem for modern businesses: infrastructure that was traditionally considered mechanical is increasingly connected to the internet and remotely controlled. A compromised refrigeration system can now become a cybersecurity incident with direct consequences for physical operations, food safety and supply chains.
What happened inside European supermarkets?
The reported incidents involved unauthorized changes to refrigeration systems. Instead of attacking payment terminals or stealing customer information, attackers manipulated equipment responsible for maintaining safe temperatures in refrigerators and freezers.
In several locations, cooling units were reportedly switched into defrost mode or had their temperature settings increased. Some Swedish stores reported temperatures reaching approximately 50°C, far beyond the conditions required for storing frozen products.
The consequences varied between retailers, but affected businesses had to inspect their equipment, remove potentially unsafe products and arrange replacement stock.
According to reporting by Euronews, Reuters and Associated Press, the affected businesses included:
- Belgium: Delhaize, Carrefour, Intermarché and Colruyt-affiliated Spar stores reported refrigeration problems. IKEA also confirmed an incident at its Mons location.
- Sweden: ICA and Coop reported problems involving refrigeration systems. Coop confirmed seven affected stores to Reuters.
- Ireland: Musgrave reported that refrigeration systems in 13 SuperValu stores were affected.
- Estonia: One Selver supermarket was reportedly affected after an attacker accessed a computer controlling refrigeration equipment.
- Netherlands: At least 17 businesses, including butcher shops and smaller food retailers, reportedly experienced disruptions.
- Luxembourg: Several Delhaize locations experienced refrigeration-related incidents.
- Finland: Several smaller grocery stores belonging to the Kesko group reported irregular temperatures.
- Italy: AFP reported incidents involving four Coop supermarkets in Sicily and another business in Tuscany.
- Portugal: Seven Intermarché stores reported incidents involving refrigeration management systems.
The figures represent reports from different retailers and media organizations, rather than a single independently verified total. The full financial impact and number of affected refrigeration units remain unclear.
How can hackers control supermarket refrigerators?
Modern commercial refrigeration systems are more sophisticated than conventional household appliances. Large supermarkets operate networks of refrigerators, freezers, temperature sensors and electronic controllers that regulate cooling cycles throughout their stores.
Many installations also support remote monitoring. This allows technicians and refrigeration service providers to check equipment, adjust settings and diagnose problems without physically visiting every location.
Although this arrangement improves operational efficiency, it introduces cybersecurity risks. If an attacker gains unauthorized access to a management computer or remotely accessible controller, they may be able to change the settings governing refrigeration equipment.
The technology involved typically includes several interconnected components:
- Temperature sensors: Measure conditions inside refrigeration units and communicate readings to control systems.
- Electronic controllers: Regulate compressors, cooling cycles and automatic defrost operations.
- Remote management software: Allows technicians to monitor equipment and modify operational settings.
- Network connections: Enable communication between refrigeration controllers and external management systems.
- Monitoring and alarm systems: Help identify temperature changes and equipment failures.
Not every component necessarily connects directly to the public internet. However, remotely accessible management systems can create an entry point if their security is insufficient.
Cybersecurity publication BleepingComputer reported that attackers remotely changed temperature settings and, in some cases, activated defrosting systems. The publication also noted that it remains unclear whether all affected stores were targeted through one coordinated operation or through separate incidents.
Danfoss technology and the problem of outdated systems
One company repeatedly mentioned in reporting about the incidents is Danfoss, a Danish manufacturer of refrigeration and industrial control technology.
Reuters reported that at least some refrigeration units affected in the November incidents used temperature-control technology from Danfoss. The company said it had been working with customers to implement fixes.
The connection became particularly significant because a similar cyberattack had affected French supermarkets in October 2026.
According to Le Monde, the October 12 incident disrupted refrigeration systems across hundreds of French retail locations. The attackers reportedly manipulated defrost settings, increasing temperatures in cold-storage areas and causing substantial food losses.
Danfoss subsequently explained that many of the affected units were obsolete products that had reached the end of their supported lifecycle and no longer received software or security updates.
This highlights a difficult issue for businesses operating industrial equipment. Refrigeration installations are expensive assets designed to remain in service for many years. Replacing older controllers and upgrading entire systems can require significant investment.
However, equipment that no longer receives security updates can remain vulnerable even as the surrounding business adopts more modern IT security measures.
It is important to distinguish between the involvement of technology from a particular supplier and responsibility for an attack. There is currently no verified evidence that Danfoss itself was breached or that every affected supermarket used the same vulnerable equipment.
The financial and operational consequences
Refrigeration failures can quickly become expensive for supermarkets. When food is exposed to unsuitable temperatures, retailers must determine whether products remain safe for sale. If their safety cannot be established, products must be removed from circulation.
The impact extends beyond the value of discarded inventory. Stores may also face emergency maintenance costs, replacement deliveries, additional employee hours and interruptions to normal operations.
Reuters reported that Belgian butcher Luc De Laet estimated his business had lost approximately €15,000 worth of meat following the incident. He discovered that refrigeration temperatures had risen as high as 18°C.
Other retailers reported precautionary product removals. Musgrave, the Irish company operating SuperValu, confirmed that 13 stores were affected and that some chilled and frozen products had been removed from sale.
Not every affected location experienced the same level of damage. Some incidents were resolved relatively quickly, while other businesses faced significant stock losses.
The incidents also demonstrate why refrigeration is a critical component of the food supply chain. A supermarket can remain open and continue serving customers while losing access to a substantial portion of its chilled and frozen inventory.
Are the attacks connected?
The November incidents followed a major refrigeration-related cyberattack in France on October 12, 2026. The earlier operation reportedly affected hundreds of supermarkets and other food retailers.
According to The Record from Recorded Future News, the Paris prosecutor's office identified approximately 700 victims in the October incident.
Investigators have not established whether the October and November operations were conducted by the same attackers. No group has publicly claimed responsibility for either campaign.
Belgium's Centre for Cybersecurity confirmed that it was aware of the latest incident. Its spokesperson, Katrien Eggers, told Euronews that the organization had no further information to provide at the time.
Belgian federal prosecutors also opened an investigation into the incidents.
The lack of confirmed attribution makes it difficult to establish whether the attacks were financially motivated, politically motivated or intended simply to cause operational disruption.
Why connected industrial equipment is becoming a cybersecurity target
Supermarket refrigeration is part of a much broader category known as operational technology (OT). This term describes the hardware and software used to monitor and control physical processes, including manufacturing equipment, energy infrastructure, building systems and industrial machinery.
For many years, these systems operated separately from conventional corporate IT networks. Increasing connectivity has changed that arrangement.
Remote maintenance, centralized monitoring and internet-connected controllers offer practical advantages, but they also expand the potential attack surface.
Reuters quoted Tom Hegel, a researcher at cybersecurity company SentinelOne, who explained that retailers operate extensive networks of refrigeration controllers, building management systems, access panels and point-of-sale equipment.
This complexity makes security particularly challenging. A business may have strong protection around its corporate network while overlooking older devices or remote-access systems used by external maintenance providers.
In other words, protecting a supermarket now involves securing more than computers, servers and customer databases. It also means protecting the equipment that keeps the physical store operating.
What supermarkets need to do next
The incidents underline the need for retailers to treat operational technology as an essential part of their cybersecurity strategy.
Several security measures can help reduce the risk of similar attacks:
- Secure remote access: Restrict access to refrigeration management systems and require strong authentication for technicians and administrators.
- Replace unsupported equipment: Identify controllers that no longer receive security updates and develop replacement plans.
- Separate networks: Keep operational technology isolated from ordinary corporate IT systems wherever practical.
- Monitor configuration changes: Detect unexpected temperature adjustments, unusual defrost cycles and unauthorized remote commands.
- Use independent monitoring: Maintain additional temperature monitoring that can alert employees when actual storage conditions become unsafe.
- Prepare emergency procedures: Ensure employees can respond to refrigeration failures even if centralized management systems become unavailable.
Independent monitoring is especially important. A compromised controller may report or enforce an incorrect operating setting, so businesses need ways to verify that products are actually being stored under safe conditions.
What happens next?
Over the coming months, retailers and equipment providers will need to investigate how attackers accessed refrigeration systems, identify vulnerable installations and implement effective security improvements.
The challenge is not simply installing new software. Some older systems may require hardware modifications or complete replacement, while businesses must maintain refrigeration throughout the upgrade process.
Regulatory developments will also matter. The European Union's Cyber Resilience Act introduces cybersecurity requirements for products with digital elements, including obligations relating to vulnerability handling and security updates. Its main requirements will apply from December 2027, although certain reporting obligations begin earlier.
For the retail industry, the incidents provide a practical warning about the risks of connected infrastructure. A vulnerability in a refrigeration controller can become a problem involving food safety, inventory losses and store operations.
Cybersecurity is no longer limited to preventing data theft or protecting online services. As more physical equipment becomes remotely accessible, protecting the systems behind everyday infrastructure is becoming equally important.
The European supermarket incidents show just how tangible the consequences can be: when digital security fails, the damage can end up sitting directly on the supermarket shelves.
Sources: This article is based on reporting from Reuters – New cyberattack on supermarket fridges sweeps across Europe, Euronews – Which countries in Europe have been hit by supermarket fridge cyber incidents?, BleepingComputer – Hackers disrupt refrigeration systems at European supermarkets, The Record from Recorded Future News – Second wave of suspected cyberattacks hits supermarket freezers across Europe and Le Monde – A disastrous day for French supermarkets after massive cyberattack targets refrigeration systems.
