Suspected Hackers Push Supermarket Freezers to 50C in Dozens of Stores Across Europe

Featured photo: A Proxy Delhaize store in Differdange, Luxembourg (file photo; not one of the stores confirmed affected). Photo: Jwh, Wikimedia Commons, CC BY-SA 3.0 LU.

A suspected supermarket freezer cyberattack hit dozens of grocery stores across Europe overnight into Monday, Nov. 2, with refrigeration controls remotely changed so that freezer temperatures climbed as high as 50C (122F). Stores in Belgium, Luxembourg, Sweden, Ireland and Estonia confirmed incidents, and the BBC reported further cases in the Netherlands and Finland.

No group has claimed responsibility, and no government has publicly named a culprit. The attacks follow an October campaign against refrigeration controllers in France, which the French cyber agency’s emergency team, CERT-FR, described in an official alert.

How the attackers changed the temperatures

Stephan Moelans, chief executive of Belgian refrigeration firm Sabcobel, which runs systems for Delhaize, told the Belga news agency the incident was a cyberattack and said the units’ evaporators had been switched to defrost mode, which warms the cases. His staff had been “working all night and morning to disconnect the affected units from the network,” he said, according to the BBC. He added that some units needed physical modifications, not only software updates, to close the hole.

In Estonia, Jann Mutso, head of refrigeration supplier Kitman Coldtech, told public broadcaster ERR that attackers reached the control computer of an older Danfoss system and set it to 50 degrees. “The signature is the same, but I can’t comment further yet,” he said, comparing it with the October incidents in France and the Netherlands.

CERT-FR’s alert lists Danfoss AK-SM and AK-SC series controllers and Copeland and Dixell XWEB units as targets in France, and warns that exposing a management interface to the internet runs against good practice. The U.S. Cybersecurity and Infrastructure Security Agency had earlier published an advisory on Danfoss AK-SM 8xxA controllers rating the flaws remotely exploitable. TBR has tracked related warnings on its national security threats page.

Country by country: who was hit

Belgium and Luxembourg: Ahold Delhaize spokesperson Sarah De Meester said an “IT incident” raised temperatures in fridges and freezers at dozens of stores, The Guardian reported. Carrefour said 15 Belgian stores were affected and all stayed open, while Colruyt Group said five franchised Spar shops were attacked. A Delhaize branch in Hoeilaart told Het Laatste Nieuws it lost about 100,000 euros of produce. Belgium’s national cyber agency said it was monitoring the incident.

Sweden: John Billow, head of Sweden’s National Cyber Security Centre, told Reuters the centre was responding to multiple incidents affecting store cooling systems, according to Al Jazeera’s republication of the Reuters report. ICA said a “limited number” of stores connected outside its central network were affected. Coop gave a count of six stores to Aftonbladet and seven to the BBC and Expressen. The ICA Kvantum store in Sjöbo said its freezers had been set to plus 50 degrees, and its manager told Expressen the spoiled food was worth several hundred thousand kronor. Axfood said a home-delivery picking warehouse in Västra Frölunda, near Gothenburg, was also hit.

Ireland: Musgrave Group said a “cyber incident” affected a specific model of refrigeration system at 13 of its 223 SuperValu stores.

Estonia: Selver said one store was hit. Communications chief Mariann Järvela said it was the last Selver outlet still awaiting a new system, and the supplier said the response came within 10 minutes, so temperatures rose only two to three degrees and no products were damaged.

What the data shows

By company figures reported Monday, at least 98 stores and businesses were affected across the operators named in the chart (TBR calculation: 40 + 17 + 15 + 13 + 7 + 5 + 1). Delhaize’s roughly 40 stores make up about 41% of that total. That count is still far below the October wave in France, where Finance Minister Roland Lescure told parliament about 700 of the country’s 10,000 supermarkets were affected, AP reported. Ireland’s 13 SuperValu stores equal about 6% of the chain’s 223 outlets (TBR calculation).

Responsibility and response

Neither Monday’s incidents nor the French attack have been claimed. Reuters noted that European states have blamed Moscow for a growing number of infrastructure incidents in recent months, which Russia denies; no official has linked these freezer attacks to Russia or any other actor. A European Commission spokesperson said the incidents “show that cyberattacks can disrupt services, affect businesses and directly affect citizens’ daily lives.” The UK’s National Cyber Security Centre said it was working with partners to understand the incident and that no UK cases had been reported.

The European wave also echoes a U.S. case: the Pentagon is probing a suspected commissary freezer cyberattack on military bases. It lands the same day as Germany’s Bundestag spyware warnings, another reminder of pressure on European digital systems.

Sources

• BBC News: Shop freezers in seven European countries hit by suspected cyber-attack
• Reuters via Al Jazeera: Suspected cyberattacks trigger supermarket fridge failures across Europe
• ERR News: Hackers raised freezer temperature at Selver supermarket to +50°C
• CERT-FR alert CERTFR-2026-ALE-012
• The Guardian: Supermarket freezers across Europe hit by second suspected cyber-attack

Additional sources

• CISA: Danfoss AK-SM 8xxA Series advisory
• Expressen: Hackerattack mot Ica och Coop
• SVT Nyheter: Experterna: Riskerna är välkända
• AP: Cyberattack hits 700 supermarkets in France