Freezers and refrigerators at supermarkets in several European countries warmed overnight into Monday, November 2, 2026, in incidents that retailers and officials describe as suspected or apparent cyberattacks, according to Reuters (via Al Jazeera) and BleepingComputer. The incidents follow an October attack on French supermarkets that the French finance minister put at about 700 of the country's 10,000 stores. No group has claimed responsibility for either wave, Al Jazeera reports.

The November incidents

BleepingComputer reports more than 115 stores affected in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. By country, as reported:

  • Sweden: ICA told Reuters that “a limited number of stores were affected by an incident overnight.” BleepingComputer says ICA described them as stores operating outside its central network and counts at least four. Coop told Aftonbladet that six of its stores were affected, and BleepingComputer counts seven of more than 800. Axfood said freezers at a home-delivery distribution centre in the Gothenburg area were hacked. An ICA store manager told TV4 that settings were changed overnight to +50°C and could not be modified.
  • Belgium and Luxembourg: Belga reported overnight temperature increases at dozens of Ahold Delhaize stores, and BleepingComputer gives about 40. Ahold Delhaize described “an IT incident affecting the refrigeration systems in several dozen stores.” Carrefour said its impact was “very limited”; BleepingComputer counts 15 of 700 stores. A Colruyt Group spokesperson said five Spar franchise shops had their fridge systems attacked. BleepingComputer also lists about 15 Intermarché locations and an IKEA store in Mons.
  • Ireland: SuperValu said a specific refrigeration model was hit by a “cyber incident” at 13 of its 223 stores.
  • Netherlands: BleepingComputer lists at least 17 butcher shops and neighborhood stores run by unnamed operators.
  • Estonia: Jann Mutso, chief executive of refrigeration supplier Kitman Coldtech, told ERR that at least one chain was affected, with temperatures set to 50°C. He said: “This is very fresh, it happened this morning.” The chain was not named, and BleepingComputer lists one Selver store.

What is reported about the cause

BleepingComputer reports that attackers remotely altered temperature settings and activated defrost functions, and that no vulnerability identifier is named for the European incidents. It cites RTL for Sabcobel, a refrigeration company, as the vendor at several affected sites. Sabcobel's Stephan Moelans blamed a cyberattack and said the units' evaporators were switched to defrost mode, according to Reuters. BleepingComputer reports that Moelans said the attacker used the same vulnerability as in the French attacks, that a software update alone is not enough because the refrigerators also need physical modifications, and that “The simplest solution is to manage the refrigerators via a secure internet connection.”

John Billow, head of Sweden's national cybersecurity centre, told Reuters that the centre is responding to multiple incidents and has found “quite a lot of exposed operational technology devices in Sweden” that need updating or patching. EU Agriculture and Food Commissioner Christophe Hansen called the attacks “a deliberate attempt to disrupt” EU food supplies, Al Jazeera reports. A spokesperson for the Centre for Cybersecurity Belgium told Al Jazeera: “we may never be able to identify … who is behind this attack.” BleepingComputer says it is unclear whether the attacks were coordinated or targeted individually.

The October attack in France

The Associated Press reported on October 13 that French Finance Minister Roland Lescure told Parliament that about 700 of France's 10,000 supermarkets were affected. Groupement Mousquetaires said 300 Intermarché and Netto stores were affected, and Cooperative U chief executive Dominique Schelcher said 80 of its 2,000 stores were. BFM-TV, as cited by AP, reported that hackers forced a continuous defrost cycle and set temperatures as high as 50°C. AP presents that as unconfirmed, along with spoiled food and fires that the Paris prosecutor's cybercrime unit is investigating.

France's cybersecurity agency said it was “aware of numerous compromises” of remote-control modules from Danfoss and Copeland. Danfoss said most affected systems were older products no longer receiving software or security updates, and Copeland said the vulnerability was in “a discontinued, end-of-life generation of controllers.” Claroty, a US security firm, said in an August report that many Danfoss AK-SM 800A and Copeland XWeb Pro controllers were reachable from the public internet, and AP says both companies have since fixed the flaws. AP reports no ransom demand or data theft and says no perpetrator has been identified.

Sources and notes

Sources: Al Jazeera, with Reuters (November 2), BleepingComputer (Bill Toulas, November 2) and the Associated Press via News4JAX (October 13). Lens could not open The Hacker News's report on the November incidents. Store counts differ between outlets, and Al Jazeera describes the figures for Sweden, Luxembourg and Estonia and the Belgian “dozens” estimate as approximate. The November incidents are described as suspected or alleged cyberattacks. The only link between the November and October incidents in the sources Lens read is Sabcobel's statement about a shared vulnerability. The French reports name Danfoss and Copeland modules, while the November reports Lens read name Sabcobel as the refrigeration vendor at several sites.

Image: Freezer (5194456668).jpg by Leslie Seaton, CC BY 2.0, via Wikimedia Commons. The Commons description says it shows frozen Indian foods photographed in Bellevue, Washington, if the location is accurate. Illustrative photo; it does not show the events described.