European Supermarket Cyberattacks: Hackers Target Freezers

Updated: November 3, 2026

A new wave of cyberattacks has disrupted supermarket refrigeration systems across Europe, affecting more than 100 businesses and forcing retailers to discard significant quantities of food. The incidents have raised concerns about the security of internet-connected infrastructure and the growing threat of cyberattacks targeting physical business operations.

The latest attacks, which began overnight on November 1–2, have affected supermarkets and smaller retailers across Belgium, Sweden, Ireland, Luxembourg, Estonia, and the Netherlands. ⁠Additional incidents have now been reported in Italy, Portugal, and Finland, bringing the number of affected countries to at least nine.

The disruption follows a similar campaign in France on October 12, when hackers reportedly compromised refrigeration systems at approximately 700 supermarkets, causing widespread food spoilage and substantial financial losses.

Although investigators have yet to establish whether the two waves are connected, similarities in the methods used and equipment targeted have raised questions about whether the incidents are part of a broader campaign exploiting vulnerable operational technology (OT) systems.

Attackers reportedly gained remote access to supermarket refrigeration controllers, manipulating temperature settings and activating extended defrost cycles. In some cases, temperatures were raised to 50°C (122°F), leaving chilled and frozen products unsafe for sale.

In Sweden, supermarket chains ICA and Coop reported disruptions across multiple locations. One ICA store in Stockholm confirmed that its freezers had reached 50°C, forcing employees to dispose of affected inventory.

Belgium has experienced some of the most widespread disruption. Delhaize reported problems at several dozen stores, while Carrefour confirmed that 15 locations were affected. Five Spar stores operating under the Colruyt Group also experienced attacks. Belgian refrigeration specialist Sabcobel reported that attackers had remotely activated defrost functions, causing refrigeration temperatures to rise rapidly.

The financial consequences have been immediate. According to ⁠Reuters, the owner of Belgian butcher chain De Laet & Van Haver reported losing approximately €15,000 worth of meat after refrigeration temperatures were remotely increased.

In Ireland, supermarket chain SuperValu confirmed that 13 of its 223 stores had been affected by a cyber incident involving a specific model of refrigeration equipment. The retailer removed chilled and frozen products from sale as a precaution.

The attacks have now extended further across Europe. In Italy, at least four Coop supermarkets in Sicily were affected, while Portugal’s Mosqueteiros group confirmed incidents at seven Intermarché stores. In the Netherlands, at least 17 businesses, primarily butcher shops and smaller grocery stores, experienced similar disruptions.

Additional incidents have been reported in Estonia and Luxembourg, while Finnish retailer Kesko is investigating unusual refrigeration temperatures at several smaller stores.

The geographical spread highlights how vulnerabilities in connected operational systems can expose businesses across multiple countries to similar attacks.

The latest incidents closely resemble the ⁠October 12 cyberattacks in France, which affected approximately 700 supermarkets and independent retailers, including stores operated by Carrefour, Intermarché, Monoprix, and Coopérative U.

During those attacks, hackers remotely manipulated refrigeration controllers, forcing systems into defrost mode and raising temperatures to dangerous levels. The resulting disruption caused significant food spoilage, with some incidents reportedly resulting in fires.

Investigations identified vulnerabilities affecting older refrigeration controllers manufactured by Danish engineering company Danfoss. France’s national cybersecurity agency, ANSSI, subsequently expanded its security advisory to include certain Copeland and Dixell refrigeration management systems.

Similar equipment has been implicated in the latest European incidents.

According to ⁠SecurityWeek, refrigeration equipment targeted in the Netherlands included systems manufactured by Danfoss and Copeland, while an Estonian supplier confirmed that older Danfoss controllers had been affected.

The similarities between the two waves are significant. Both involved remote manipulation of refrigeration systems, unusually high temperature settings, and attacks occurring overnight when businesses were less likely to detect interference immediately.

However, no threat actor has claimed responsibility, and investigators have not confirmed whether the attacks were carried out by the same individuals or group.

The possibility remains that separate attackers are exploiting the same weaknesses in internet-connected refrigeration infrastructure.

New cybersecurity research has revealed suspicious activity targeting refrigeration controllers in the days leading up to the latest incidents.

Cybersecurity company Lupovis reported detecting attempted access to its Danfoss refrigeration controller sensors between October 20 and October 30, with activity peaking on October 26.

According to ⁠SecurityWeek’s November 3 report, many of these attempts involved factory-default credentials, while others appeared designed to identify specific refrigeration controller components.

Lupovis CEO Xavier Bellekens confirmed that the company had not observed similar activity on those sensors before October 20 and that all authentication attempts against its sensors were unsuccessful.

The timing is particularly noteworthy, as the suspicious activity occurred between the original French attacks and the latest incidents across Europe.

However, there is currently no evidence establishing that the activity detected by Lupovis was connected to either wave of attacks.

The findings nevertheless highlight how attackers can target exposed operational technology using relatively straightforward techniques, particularly when systems rely on outdated equipment or inadequate access controls.

Further research has highlighted the scale of potentially vulnerable refrigeration infrastructure.

Internet intelligence company ⁠Censys identified more than 1,000 Danfoss StoreView interfaces accessible over the public internet, raising concerns about the exposure of systems responsible for managing commercial refrigeration.

Its November 2 analysis identified 220 exposed interfaces in France, 138 in Belgium, 51 in the Netherlands, and 50 in Sweden.

While these figures represent a significant number of publicly accessible systems, they also reveal some progress in reducing exposure.

Before the October attacks, Censys had identified approximately 1,825 exposed Danfoss StoreView interfaces in France. That number has since fallen to 220, suggesting that businesses and service providers have taken steps to restrict access.

However, outdated software remains a concern.

Censys estimated that only 41% of the remaining exposed French interfaces were running patched firmware. In Belgium, approximately 68% appeared patched, compared with 58% in Sweden and 37% in the Netherlands.

These findings do not establish that the exposed systems were compromised during the latest attacks. They do, however, demonstrate the continued presence of internet-accessible refrigeration equipment, some of which appears to be running outdated software.

For organizations relying on connected operational technology, this represents a significant security challenge.

The incidents highlight an increasingly important cybersecurity risk: attackers exploiting operational technology to cause direct physical and financial damage.

Modern refrigeration systems rely on internet-connected controllers that allow businesses and maintenance providers to monitor temperatures, manage equipment, and respond to faults remotely.

While these capabilities improve efficiency, inadequately secured systems can provide attackers with opportunities to interfere with critical business operations.

Unlike traditional cyberattacks focused on stealing sensitive information or encrypting files, attacks against operational technology can directly manipulate physical equipment, interrupt business processes, and cause immediate financial losses.

For supermarkets, the consequences extend beyond replacing spoiled inventory. Refrigeration failures can disrupt supply chains, force temporary closures, increase operational costs, and undermine customer confidence.

The implications are equally significant for other industries dependent on connected infrastructure, including manufacturing, logistics, healthcare, and energy.

These attacks also demonstrate the risks associated with legacy technology. Older operational systems may remain in service for years after manufacturers stop providing security updates, leaving businesses exposed to vulnerabilities that cannot always be resolved through conventional patching.

As organizations continue to digitize their operations, securing connected infrastructure is becoming just as important as protecting traditional IT environments.

The growing scale of the attacks has prompted a response from European authorities.

EU Agriculture Commissioner Christophe Hansen described the incidents as a deliberate attempt to disrupt Europe’s food supply chain and undermine consumer confidence.

According to ⁠AFP’s November 3 reporting, Hansen said the European Union was taking the incidents seriously, particularly given their repeated occurrence and the resulting financial damage.

However, he emphasized that Europe’s overall food security was not currently under threat.

Authorities across several affected countries are continuing their investigations. Belgium’s federal prosecutor’s office has opened a criminal investigation, while Italy’s national cybersecurity agency has urged retailers, food logistics operators, and refrigeration companies to strengthen their security measures.

At the time of writing, no group has claimed responsibility for either wave of attacks, and investigators have not established a definitive connection between the incidents in France and those affecting other European countries.

The latest developments nevertheless demonstrate the growing risks associated with inadequately secured operational technology.

Whether these attacks ultimately prove to be part of a coordinated campaign or the work of separate threat actors, they highlight a concerning reality: cybercriminals do not need to steal data or deploy ransomware to cause significant financial damage. By compromising connected infrastructure, attackers can disrupt operations, destroy inventory, and inflict substantial losses without ever accessing traditional corporate IT systems.

This is a developing story. Further updates will follow as investigations continue.