What happened to European supermarket freezers on 2 November?
Supermarkets in seven European countries spent Monday 2 November dealing with refrigeration failures, and many cleared spoiled food. Reports came from Belgium and Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland. Several retailers and refrigeration contractors treated the pattern as a deliberate attack; some chains said they were still investigating.
In Belgium, Delhaize raised the alarm at about 04:00 local time as temperatures climbed. Belgian broadcaster VRT reported readings of 15C, while other Belgian outlets cited by Euronews put the figure at 17C. Carrefour Belgium said 15 of its more than 700 stores were affected, and its spokesman later told Euronews: “It’s a cyberattack, there is no other reason.”
Delhaize described the event in narrower terms. A spokesperson said the company had identified an IT incident in “several dozen stores” and had acted to keep shops open. Around 40 Delhaize stores, mostly in Belgium with a few in Luxembourg, were involved, according to the BBC and the Associated Press.
Sweden produced the most dramatic readings. ICA Kvantum in Sjöbo, in the south of the country, told customers its units had been “hacked overnight” and set to 50C. The store closed for the morning before reopening. At an ICA Nära shop in Böda, on Öland, the manager found water across the floor. A freezer was reading 55C, Swedish broadcaster SVT reported.
Coop said seven of its 800 Swedish stores were affected and described the situation as contained. In Ireland, 13 SuperValu stores lost refrigeration. Owner Musgrave said the impact was limited to a specific refrigerator model, and chilled and frozen stock was removed from sale. RTÉ reported that the problems were fully resolved by mid-afternoon.
Smaller clusters appeared elsewhere. Estonia’s Selver confirmed one affected outlet, where staff restored normal temperatures within about 15 minutes. Danfoss told Dutch broadcaster NOS that at least 17 companies in the Netherlands, including butchers and small neighbourhood stores, had been attacked. Finnish media reported problems at several K Group supermarkets, and Delhaize suspended its ordering systems in Luxembourg as a precaution.
Which countries and supermarkets were affected?
The list of affected countries is still being assembled, and different outlets have drawn the boundary in different places. The BBC counted seven countries on 2 November. The Associated Press wire named four: Sweden, Belgium, Luxembourg and Estonia. Later reporting added Ireland, the Netherlands and Finland.
These are not audited totals. No public register of affected sites has been published, and some retailers declined to give store counts. ICA, for example, confirmed only a “limited number” of stores and did not say whether hacking caused the failures.
Companies also describe the same event in different language. Delhaize called it an “IT incident”, while Carrefour called it a cyber-attack. A franchise store may report a fault to its local operator before the parent chain knows about it. That produces a stream of partial counts rather than one clean figure.
Temperature claims come from different sources too. Some are corporate statements, some are store social-media posts and some are local reporters who saw display cases. The widely repeated 50C figure is a set point reported by stores, not a measurement certified by an investigator.
The geographic spread matters more than the exact count. The incidents appeared on the same night in countries with different retailers, contractors and regulators. That pattern points to a common technique or common equipment rather than a single compromised company.
- •Belgium: about 40 Delhaize stores, 15 Carrefour Shop & Go outlets, 15 Intermarché shops and five Spar Q8 sites. An IKEA store in Mons and a butchery group also reported problems.
- •Sweden: a small number of ICA stores outside its central network and seven Coop stores, with reported temperatures reaching 50C.
- •Ireland: 13 SuperValu supermarkets, all linked to the same refrigerator model.
- •Netherlands: at least 17 businesses, mostly butchers and small neighbourhood stores, according to Danfoss.
- •Estonia: one Selver supermarket, where the temperature was raised to 50C but no stock was lost.
- •Finland and Luxembourg: several K-stores and a few Delhaize stores, with Delhaize pausing orders in Luxembourg.
How did the attack work?
The common thread is remote refrigeration management. Modern supermarket cases are controlled by digital controllers that staff and contractors can reach over a network. The controllers run defrost cycles, log temperatures and allow remote troubleshooting across hundreds of sites.
Attackers appear to have abused that access to force a defrost cycle and hold it. Sabcobel, the Belgian contractor that manages Delhaize’s refrigeration, said the units’ evaporators were switched to defrost mode. Normally that cycle is brief; in this case the warm state persisted, and food spoiled.
Stephan Moelans, Sabcobel’s chief executive, told Belgian news agency Belga the mechanism was the same as in France. “The signature is the same,” said Jann Mutso of Estonian refrigeration firm Kitman Coldtech, though he declined to say more. Neither comment proves a single attacker or a single flaw.
France’s CERT-FR, part of the ANSSI cybersecurity agency, listed four affected product families. They were Danfoss AK-SM series, Danfoss AK-SC series, Copeland XWEB and Dixell XWEB. It warned that exposing a management interface to the public internet is contrary to security best practice.
The Belgian Centre for Cybersecurity issued a similar warning after the French attack. It told operators to remove public IP access and require a VPN or protected network. They should also update firmware, change default passwords and set Danfoss equipment to “Strict” security mode. It urged them to check the full configuration, including defrost schedules.
Security researchers had already mapped part of the risk. Claroty’s Team82 published research in August 2026 on the Danfoss AK-SM 800A controller. It found a hidden “code of the day” authentication bypass and a command-injection flaw that allowed remote code execution. It also found a way to inject web-server configuration. Danfoss fixed the issues in firmware R4.3.1, according to Claroty.
That research does not establish what happened in November. No advisory has named the flaw used in the latest incidents, and no attacker has described a technique. The overlap is circumstantial: exposed controllers, old firmware and a defrost function that can be triggered remotely.
Why couldn’t a software patch stop it?
A patch only helps if the device can take one and someone applies it. Many supermarket controllers are old, and some are end-of-life. Danfoss told Belgian broadcaster VTM NIEUWS that the vulnerability lay primarily in outdated software. The company said it had urged customers to move to newer software.
Sabcobel’s Moelans went further. He said a software update alone was not enough and that the units needed physical modifications. “That requires investment,” he said. The company had spent weeks trying to protect customers’ fridges after the French attack. The fix could not be delivered remotely in every case.
Retailers described a patchwork of old and new systems. Estonia’s Selver said its affected shop was the last one still running the old system. Coop in Sweden said it had ordered new systems after the French incident. ICA said the affected Swedish stores sat outside its central network, which suggests local systems with less central control.
Remote access is the other half of the problem. Contractors need it to monitor alarms and troubleshoot without sending engineers to every store. That convenience becomes a liability when controllers answer on public addresses, share default credentials or run firmware that no longer receives updates.
The economics are awkward. Replacing controllers across hundreds of stores costs money and takes time. A factory reset can remove an intruder’s changes, and it can also remove configuration data that investigators may want. The CERT-FR advice to check insurance terms before cutting a data feed shows how tangled the response can be.
The second wave is therefore not evidence that nobody patched. It is evidence that the estate is uneven. Some sites had new systems, and some had updated firmware. Others still had internet-facing controllers that could not be fixed with a download.
What did the French attack reveal?
The French incident began overnight on 11-12 October. Hackers forced refrigerators and freezers at hundreds of supermarkets into sustained defrost, sending temperatures toward 50C. Stores threw away fresh and frozen food, and some reported small fires.
French Finance Minister Roland Lescure told parliament that about 700 of the country’s 10,000 supermarkets were affected. Les Mousquetaires said 300 of its Intermarché and Netto stores were impacted. More than 100 Coopérative U stores were targeted, and Carrefour reported problems at 80 of its 6,000 outlets.
The bill was measured in food, not data. Two Intermarché stores in Alsace reported a combined €270,000 in lost goods, and local media estimated millions of euros in losses nationwide. Paris prosecutors opened a cyber-crime investigation. They described a “large-scale cyber-attack affecting the refrigerators of several major food retail chains across France.”
Politicians treated it as a food-security incident. European food commissioner Christophe Hansen wrote that “the weaponisation of food has become a reality.” Lescure called the episode “a wake-up call for everyone.” The French alert was updated as agencies identified more affected equipment.
Three weeks later, the same signs appeared in other countries. That gap is the central lesson. The French attack produced warnings and patches. It did not remove thousands of exposed controllers from the internet or retrofit every old unit. The vulnerabilities were known; the exposure was not fixed everywhere.
The French case also showed that losses spread beyond the chiller aisle. Prosecutors opened a case, retailers counted spoiled stock, and the episode reached the desks of national and European officials. Those questions are now live in Belgium, Ireland and Sweden as well.
Who is behind the attacks?
No group has claimed responsibility, and investigators have not named a suspect. The Belgian federal prosecutor’s office opened an investigation, according to a spokesperson cited by Euronews. French cyber-crime prosecutors are investigating the October case. Sweden’s national cyber-security centre is handling several cases, and the UK’s NCSC said it was working with international partners.
The UK agency said no incidents had been reported in Britain. That is useful context: the campaign has hit retailers in seven countries but has not been linked publicly to a UK store.
A separate thread runs through the United States. Authorities are investigating refrigeration malfunctions at several American military base stores in August. They are working with French officials on whether the incidents could be connected, the BBC reported. No link has been established.
Reporting has not described the incidents as ransomware. There is no public evidence of encrypted systems, extortion notes or stolen customer data in the European supermarket cases. The visible effect was physical: warm fridges, spoiled food and discarded stock.
That absence of a clear motive makes attribution harder. Without a public claim, investigators must infer intent from the technical evidence.
The technical trail is also thin. The controllers were exposed, but exposure alone does not identify who logged in. Without logs, network captures or a claim, investigators must work from retailer systems and contractor records.
What should retailers and shoppers watch next?
For retailers, the immediate checklist is the one CERT-FR and the Belgian CCB published. Find every refrigeration controller with a public address, remove that exposure, and route remote access through a VPN or a protected network. Update firmware where possible, change default passwords and review defrost settings.
The second step is harder. Operators need an inventory of who can reach each controller, including contractors and maintenance providers. They should preserve logs and configuration before resetting a compromised unit, and check insurance and maintenance contracts before cutting a data feed.
Shoppers are unlikely to face a broad food shortage. There is no sign of one: affected stores removed chilled and frozen products, and Delhaize said its distribution centres were operating normally. Local food-safety authorities remain the best source if a specific recall or closure is announced.
The policy question is whether voluntary guidance will change practice. The French case moved food security onto the agenda of a European commissioner. Belgian federal prosecutors opened a criminal investigation. Both responses show that the issue now reaches beyond IT departments.
Watch for three signals. First, whether an official advisory names a specific vulnerability or confirms a link to the Claroty findings. Second, whether the exposed-controller count falls. Third, whether any group claims the campaign or a ransom demand appears.
The bigger test is commercial. Remote monitoring saves money and prevents spoilage. Cutting it off entirely would make stores less safe, not more. The realistic fix is segmented access, supported hardware and a plan for replacing controllers that can no longer be patched.
Until then, the cold aisle remains an exposed target. The equipment is mundane, the exposure is widespread and the effect is immediate. That combination is what makes the case worth watching beyond the food thrown away this week.