Hackers Turned Europe's Supermarket Freezers Into Ovens: The November 2 Fridge Cyberattack Explained

It is the kind of attack that sounds made up until you read the store managers' own words. "Everything is destroyed," a sales manager at an ICA franchise store in Stockholm told Reuters, after arriving to find all her freezers at 50 degrees Celsius. The attack did not steal money or lock files for ransom. It turned the cold chain itself into the weapon: fridges and freezers that were supposed to preserve food were remotely ordered to heat up instead.

At a glance

How the attack worked: defrost mode, weaponised

Every supermarket fridge and freezer runs a regular defrost cycle. Frost builds up on the evaporator coils, so the unit briefly warms them to melt it off, then returns to cooling. It is a normal, short, controlled process — and it is controlled remotely in modern stores, so technicians can manage hundreds of sites from one system.

The attackers abused exactly that remote control. According to Sabcobel, the Belgian refrigeration contractor that manages Delhaize's systems, hackers switched evaporators into defrost mode and left them there. Instead of a brief warming, the units heated continuously. Frozen food thawed, chilled food warmed past safe temperatures, and by morning staff were discarding stock they could no longer legally or safely sell.

After the French attacks, France's CERT-FR issued an alert on compromised remote refrigeration controllers, naming Danfoss AK-SM and AK-SC series units and Copeland and Dixell XWEB supervisors. Danfoss, the Danish manufacturer, told broadcasters that the weakness lay mainly in outdated software and that customers who had not updated were the ones affected. In the Netherlands, Danfoss told public broadcaster NOS that 17 facilities using its systems — including frozen-product storage sites and butcher shops — were hit by the same kind of attack as in France.

Country by country: what each chain reported

Belgium — the epicentre. Ahold Delhaize described an "IT incident" affecting refrigeration in several dozen stores, mainly in Belgium with a few in Luxembourg — around 40 Delhaize locations in total, with temperatures in some units climbing to 15°C. Carrefour Belgium confirmed a cyberattack affecting about 15 of its more than 700 stores, mostly freezer sections, and said all stores stayed open. Colruyt Group said five Spar franchise shops had their fridge systems attacked. One Proxy Delhaize operator estimated losses around €60,000.

Sweden. ICA confirmed a limited number of stores connected outside its central network were affected, though it told AFP it could not confirm a cyberattack was the cause. Individual stores were blunter: a Stockholm ICA store reported all freezers at 50°C, and a Sjöbo store reported freezers set to +50°C with goods worth hundreds of thousands of kronor discarded. Coop Sweden confirmed a cyber incident at 7 of its more than 800 stores.

Netherlands, Ireland, Finland, Estonia, Portugal, Italy, Luxembourg. The Netherlands saw 17 affected facilities. Ireland had at least 13 affected branches, including SuperValu stores, where operator Musgrave said the attack was restricted to a single model of fridge control system. Finland's Kesko group said it was investigating irregular temperatures at a few smaller shops. Estonia's Kitman said the method there was similar. Portugal reported affected stores, and Italy reported at least four Coop supermarkets in Sicily plus one business in Tuscany, where the Radenza Group said the attack hit its remote-control system for frozen sections at 4 a.m. and has since been resolved.

Denmark — the correction. Denmark does not appear on the confirmed list of countries with affected stores, despite appearing in some viral summaries. What was reported is that a Danish food producer was also targeted, according to the Confederation of Danish Industry — collateral, in the same way British meat suppliers using the same software found themselves affected and were warned by the UK's National Cyber Security Centre to update fridge controller software urgently.

The French wave three weeks earlier

This was not the first time. On October 11–12, 2026, hackers seized control of cooling units at roughly 700 French supermarkets. French police said the attacks caused fires as well as food losses, and losses were estimated in the tens of millions of euros. France's CERT-FR alert followed, naming the controller families involved — and that warning is what makes the November wave so pointed: the industry knew the mechanism, and still had unpatched units in the field.

Sabcobel's CEO, Stephan Moelans, told Belga that his company had begun securing installations after the French attack but that about 10% of its units had not yet been updated — and those were among the ones hit on November 2. He added a detail that matters for every business running connected equipment: a software update alone is not enough; some installations need physical changes to be properly secured.

What officials said — and what is still unknown

EU Commissioner for Food and Agriculture Christophe Hansen said the bloc was taking the incidents "very seriously": "They are a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it — a warning that we must take seriously." He also said food security itself was not at risk, but that the disruption and resulting waste had a real impact on businesses, and called for coordinated work to make the supply chain more resilient.

Belgium's federal prosecutor opened a criminal investigation, and Belgium's Centre for Cybersecurity said it was aware of the incident and that it was not known who was behind the attacks. A researcher at cybersecurity firm SentinelOne noted that such attacks are typically linked to extortion, political motives or nation-state operations — and that the absence of financial demands in these cases points instead toward sabotage. Reuters reported it could not establish who was behind the November attacks or whether they were linked to the French incidents. No group has claimed responsibility for either wave.

Why this matters beyond supermarkets

The cold chain is one of the most connected parts of modern life that nobody thinks about: fridges, freezers, warehouses, trucks and display cases, all managed remotely for efficiency. This attack shows what happens when that remote management is reachable by the wrong people and the devices run outdated software. The target was not data or money — it was temperature, and temperature is what keeps food safe.

For any business running connected equipment, the lessons are concrete: keep controller firmware updated, restrict remote access to those systems (ideally off the public internet entirely), segment operational equipment away from office networks, monitor for abnormal temperature or mode changes with alerts that wake someone up, and have a manual override plan — because a defrost command that cannot be countermanded locally is a single point of failure. Sabcobel's warning stands: where a software patch is not enough, budget for the physical fix too.

For shoppers, the practical takeaway is simpler: if your local store's chilled or frozen section looks emptier than usual this week, that may be why — and food that was discarded after warming is food that should not have been sold to you at a discount. The waste is real, the disruption is real, and the investigation is still open.

Frequently Asked Questions

Sources

• The Hacker News — New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe
• Security Affairs — Another fridge cyberattack hits European supermarkets
• BreachNews — European Supermarket Refrigeration Hit by Cyberattack Wave
• Bytes Europe — Including Luxembourg: Fridge cyberattack hits supermarkets across Europe (AFP/Reuters-based)
• Logistics Insider — Refrigeration Cyberattack Hits Europe's Food Chain

Developing story: store counts and attribution may change as investigations continue. Figures above are as reported by the named chains and agencies on November 2–3, 2026.