Second wave of refrigeration cyberattacks hits European supermarkets
Three weeks after the attack that turned refrigeration units in French supermarkets into ovens overnight, similar cyberattacks have hit shops in other European countries and again caused refrigerated food to be spoiled.
Belgium, Luxembourg and Sweden affected
“[In Belgium,] fridges and freezers have been affected at Delhaize, Carrefour and Spar, among others. The attackers remotely switched the units’ evaporators to defrost mode, causing the fridges to warm up,” Belgian news agency Belga reported today.
“The mechanism is said to be exactly the same as in the large-scale cyberattack on hundreds of shops in France in early October.”
Stephan Moelans, CEO of Sabcobel, a Belgian company that manufactures and installs industrial refrigeration equipment, told the agency that the attack started around midnight on Sunday, and that its technicians have been working “all night and morning to disconnect the affected units from the network.”
After the attack in France, most of its customers switched to managing the fridges over a secure internet connection, he added, and said that for a thorough fix of the vulnerability that allowed the attack, in addition to a software update, the refrigeration units have to be physically modified.
Delhaize supermarkets have also been hit in Luxembourg, RTL Today reported. Supermarket chains Colruyt and Intermarche confirmed that they have had “technical problems” at some of their stores, but did not say it was because of a cyberattack.
In Sweden, the Coop and Ica chains have been affected: the temperature on their freezers was turned up to 50 degrees (Celsius), The Local said.
An Ica spokesperson told Swedish newspaper Dagens Nyheter that a small number of stores that “have their connection outside Ica’s central network” were affected.
The root cause: Internet-exposed, unpatched systems
In October, French retail stores saw their frozen and chilled goods spoiled after an overnight attack on refrigeration control systems manufactured by Danfoss, Copeland, and Dixell, according to French cybersecurity agency Anssi.
The attack was made possible by remotely exploitable vulnerabilities in the monitoring systems’ internet-exposed management interfaces.
“I’ve confirmed with folks the impacted freezers in the countries impacted today are all [management] interface facing internet, same issue and vuln as last time. Many of the freezers are end of life and have no patch available, they’ve just been left online to quite literally rot,” security researcher Kevin Beaumont commented today.
As with the October attack, it’s still unclear who is behind these latest ones.
UPDATE (November 2, 2026, 10:30 a.m. ET):
The BBC reports attackers also hit supermarkets in Finland, Ireland, Estonia, and the Netherlands.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
