Attackers warm supermarket refrigerators across Belgium, Sweden and Estonia

Attackers remotely changed refrigeration settings at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, Nov. 2, 2026, warming fridges and freezers.

Stores in Sweden, Belgium, Ireland, Luxembourg, Estonia and the Netherlands experienced temperature spikes and spoiled food. Retailers said no chain had more than several dozen affected stores, and some threw away chilled and frozen food or removed it from shelves.

Sabcobel chief executive Stephan Moelans said attackers put cooling units into defrost mode in Belgium. Defrost mode normally clears ice, but the attackers used it to make the units heat up rather than keep food cold. The Delhaize supermarket chain uses refrigeration systems managed by Sabcobel.

Colruyt Group said attackers hit fridge systems at five of its Spar stores in Belgium, and Carrefour said a cyber attack targeting refrigeration installations had a limited impact on 15 of its 700-plus stores in the country.

A butcher shop in Hove saw its fridges raised to 18°C, and owner Luc De Laet told Reuters that roughly €15,000 of meat spoiled. Sabcobel manages hundreds of units in Belgium and knows of about 20 affected ones. Moelans told Belgian media that attackers entered individual supermarket systems rather than refrigeration contractor systems.

An ICA store in Sjöbo, southern Sweden, reported that attackers had set its fridges and freezers to 50°C, and workers were discarding affected goods.

The ICA Kvantum branch in Sjöbo said on Facebook that hackers had set its fridges and freezers to 122 degrees Fahrenheit. Coop told Swedish daily Aftonbladet that similar incidents affected six of its stores.

ICA said its own systems were not affected by the incident. The company said it learned of an incident at some stores using an outside supplier with connectivity outside ICA’s central network, and that the incident affected refrigeration and freezer systems at those stores.

In Estonia, Jann Mutso said attackers reached an older Danfoss system’s control computer. Mutso said attackers were targeting old controllers that had not received updates. The Selver freezer temperature rose by only about 2-3°C, the problem was resolved within about 10 minutes, and no products were damaged. Selver said the hit store was the last one still on the old system.

A technology manufacturer said one client was hit by a cyber attack. Estonian public broadcaster ERR reported that attackers accessed a refrigeration computer and raised the temperature to 122 degrees Fahrenheit.

Musgrave removed chilled and frozen products from sale at 13 SuperValu stores in Ireland as a precaution. The company said Monday afternoon that the issue was resolved and restocking was underway.

Musgrave said its monitoring systems alerted it to the issue, it took immediate action, and its investigation is ongoing.

Ahold Delhaize told NBC News it was aware of an IT incident affecting refrigeration systems in a number of its stores in the Netherlands. “Our teams are working hard to fully assess the situation,” the company said. Ikea said its store in Mons, Belgium, was affected by a cyber incident that hit the shop’s refrigeration and freezer units, and it was investigating exactly what happened. The Mons Ikea store stayed open to shoppers, and no other Ikea stores in Belgium were hit.

The incidents follow a cyber attack in France in Oct. 2026 where police said hackers seized cooling units at hundreds of supermarkets. That attack pushed temperatures to 122 degrees Fahrenheit and caused fires and food losses.

Refrigeration controls are computers that run fridges and freezers in a store. These systems can connect to the internet, letting refrigeration contractors watch them and repair problems from afar. Danfoss made several of the systems that were hit.

An ICA spokesperson told AFP that all ICA affected stores used an outside refrigeration control system from Danfoss. The maker of the affected model was not named in Musgrave’s statement. A Belgian butcher told Dutch broadcaster NOS that Copeland equipment was also attacked in Belgium, though NOS received no clear answer from Copeland about the attacks.

According to a Danfoss spokesperson speaking to NOS, the affected Dutch systems had no secure network and continued using default passwords. Most shops in the Netherlands had acted after the French attack, but a small number had not and those were hit. Euronews reported that Danfoss told VTM the weakness mainly involves outdated software and affects customers who did not update.

No one had claimed responsibility for the attacks by Monday night, and officials did not know if they were linked to the attack in France.

Belgium’s federal prosecutor’s office opened a criminal investigation, confirmed to VRT. Belgium’s Centre for Cybersecurity on Monday told reporters it had no further information. The centre said the attacker was unknown, and said “it may never be determined.”

Sweden’s National Cybersecurity Centre is handling many grocery store incidents nationwide, center head John Billow said Monday. Billow said the center could not guess who was behind the attacks, and said Sweden recently found many exposed operational technology devices, the systems that run physical equipment, that require updates or patches.

Sweden’s National Cybersecurity Centre did not explain in its notice how attackers gained access. On Monday, Sweden’s National Cybersecurity Centre said it was monitoring the incidents and sharing details with agencies in Nordic and European countries.

Danfoss said the Dutch attacks were the same type as the French attack. Sabcobel said Belgium used the same method, and Kitman said Estonia’s method was similar. Using the same method does not prove one group carried out both attacks.

On Nov. 3, The Hacker News found CERT-FR’s alert dated Oct. 16. The alert includes Danfoss AK-SM and AK-SC series controllers and the Copeland xweb and Dixell xweb products. CERT-FR says attack campaigns against these devices are likely still underway.

CERT-FR’s alert says operators should ensure devices are not reachable from the internet, including devices on public IP addresses. It says operators should review the full configuration, particularly defrost schedules, and restore access solely through a secure VPN or protected network. During an emergency, firewall filtering of contractor IP addresses is allowed, but only as a temporary fix.

CERT-FR also says operators should follow manufacturer best practices including firmware updates. For Danfoss devices, the alert says the security level should be set to Strict and default passwords changed. For a compromised device, CERT-FR says to reboot the Danfoss unit or reset it to factory defaults, then reconfigure before putting it back in service.

CERT-FR warns that end-of-life devices without security fixes are likely compromised if they remain online, and that a factory reset by itself leaves them exposed to attack again.

Danfoss said in Oct. 2026 that most French units hit were older models no longer updated, the AK-SM 800 and AK-SC 355. On Oct. 13, Danfoss told Dutch customers to disconnect systems from the internet and reconnect only through a secure network, and said it was working with customers to implement fixes.

Moelans said a software update alone is insufficient since installations require physical changes that cost money. Sabcobel advised stores to secure internet connections, and many but not all complied. He said most Sabcobel customers adopted this following the French attack, and he said the simplest answer is managing fridges through a secure internet connection.

Broader security fears linked to Russia’s war in Ukraine are now confronting the continent. The European Commission said Monday that this new cyber attack demonstrates digital threats are having a growing effect on daily life. An expanding range of devices, such as refrigerators and heating systems as well as security cameras and alarm networks, now permits remote monitoring and control, and that gives cybercriminals new opportunities.