Cyber attacks hit supermarket refrigeration across Europe

Ahold Delhaize, Colruyt, ICA, Coop and Kitman Coldtech reported that attackers manipulated supermarket refrigeration and freezer systems across Belgium, Sweden, Luxembourg and Estonia on Nov. 2, 2026, raising temperatures to 50°C or higher overnight and spoiling food.

Ahold Delhaize and Colruyt reported an information technology incident on Nov. 2, 2026, affecting refrigeration systems in dozens of stores across Belgium and Luxembourg, with temperature spikes in freezers and fridges overnight. Colruyt Group said five stores in Belgium experienced refrigeration system attacks on Nov. 2, 2026, including Spar stores operated under a franchise system. Belgian refrigeration firm Sabcobel confirmed that hackers switched evaporators to defrost mode in Delhaize stores on Nov. 2, 2026, and stated that addressing the vulnerabilities required physical modifications. Attackers also targeted Copeland refrigeration equipment in Belgium during the Nov. 2, 2026, attacks, and the affected Copeland systems were reportedly older models.

Ahold Delhaize took systems offline in response to a security issue on Nov. 2, 2026, affecting Dutch and Belgian stores, and the outage disrupted online ordering, electronic shelf signs and employee access to schedules. The company also reported a separate cybersecurity incident to Dutch police in October 2026 involving suspicious activity in its infrastructure, though that incident was unrelated to the November refrigeration attacks. The November incident affected refrigeration systems in stores while also interrupting digital services used by customers and staff.

Swedish supermarket chains ICA and Coop reported temperature spikes in refrigeration systems overnight on Nov. 2, 2026, affecting multiple stores. ICA Group said an incident affected a limited number of stores and provided support to affected stores but did not disclose the exact number impacted. One ICA store in Sjöbo confirmed a cyber attack as the cause. Gustaf Nilsson of ICA Group said, “We are aware that a limited number of stores were affected by an incident overnight that affected their refrigeration and freezer systems.”

John Billow, head of Sweden’s national cybersecurity centre, confirmed investigations into refrigeration system incidents across Swedish grocery stores.

Kitman Coldtech reported that an Estonian supermarket chain experienced refrigeration system failures on Nov. 2, 2026, with temperatures set to 50°C, though the provider did not name the affected chain. Supermarkets in Ireland, the Netherlands and Luxembourg also reported refrigeration system disruptions on Nov. 2, 2026, with the exact number of affected stores not specified.

Ahold Delhaize, Colruyt, ICA and Coop reported that attackers manipulated refrigeration systems to trigger continuous defrost mode overnight, reaching 50°C or higher, and the method caused food spoilage and fires. Rickard Nilsson described the effect from inside a store: “We can’t adjust the temperatures, we can’t change them. Heat is blowing into the freezers. Everything is ruined”

The November incidents follow a cyber attack on French supermarkets in October 2026 that affected hundreds of stores, causing fires and food losses. The attack targeted Danfoss refrigeration control systems, and attackers exploited Danfoss refrigeration controllers after gaining access through exposed login credentials, with the controllers directly exposed to the internet and allowing remote manipulation. Cybersecurity consultant Emil Olofsson of Integrity 360 reported that temperatures reached 80°C in some refrigeration units during the French attack, while French police reported lower temperatures. Food spoilage and financial losses occurred in France, with damages reaching tens or hundreds of thousands of euros per store at retailers including Groupement Mousquetaires, Coopérative U and Leclerc.

Claroty’s Team82 disclosed vulnerabilities in Danfoss AK-SM 800A and Copeland XWEB Pro refrigeration controllers in August 2026, and both vendors released firmware updates to address the flaws. Danfoss discontinued support for legacy refrigeration controllers in 2026, citing European cybersecurity legislation, and enforced a hard End of Service policy for unsupported products.

Law enforcement agencies cited in the reporting have not identified perpetrators in either case, and security researchers said no group has claimed responsibility for the Nov. 2, 2026, attacks or the October 2026 French incidents. The Centre for Cybersecurity Belgium acknowledged the Nov. 2 incident but could not provide further details or identify perpetrators, and the centre expressed concern about the use of artificial intelligence in identifying and exploiting vulnerabilities. Swedish authorities noted a rise in exposed operational technology devices.

Security researchers and outlets reporting on the attacks said these incidents create risks for operational technology, the hardware and software that monitors and controls physical equipment, and industrial control systems used in critical infrastructure. Exposed operational technology devices provide new attack vectors for cybercriminals.

The European Union’s Cyber Resilience Act will impose stricter requirements on manufacturers of refrigeration products from December 2027. Current legislation does not mandate security updates for the targeted products.