Cyberfeed6Cyber incidents across IT, OT and crypto

All incidents

OTProcess manipulationDeveloping

Supermarket freezer and fridge systems are tampered with in a second wave across at least seven European countries

November 2, 2026 (Overnight into November 2, 2026)

Three weeks after the attack on French supermarkets, refrigeration controllers at food stores in several more countries started running at wrong temperatures overnight into November 2. Reports name ICA and Coop in Sweden, Delhaize, Carrefour and Spar stores in Belgium, 13 SuperValu stores in Ireland, Ahold Delhaize stores in Luxembourg, a few K-Food stores in Finland and one Selver store in Estonia. In the Netherlands, Danfoss told broadcaster NOS that at least 17 businesses were hit, mostly butchers and small neighborhood shops, and Albert Heijn said none of its branches was affected. One Swedish store had a freezer set to 50 degrees Celsius and another showed 55, some Delhaize fridges reached 15, and a Dutch frozen-food store was at minus 10 instead of minus 20. Belgian refrigeration firm Sabcobel confirmed a cyberattack, and its chief executive said the units' evaporators were switched into defrost mode. AFP reports that many units will need physical modifications to be restored. Danfoss said the European incidents involved its products, as in France, and NOS reports Copeland equipment was also hit in Belgium. DutchNews reports that the affected Dutch systems were not on a secure network and still used a default password, and that Danfoss had advised Dutch customers on October 13 to disconnect systems from the internet. Coop confirmed a hack, Ahold Delhaize called it an IT incident, Musgrave called it a cyber incident, and ICA did not confirm a cyberattack. Sweden's national cyber security center is handling several cases. No group has claimed responsibility, reporting finds no evidence yet linking these cases to the French attack or to the US military base freezer failures, and Delhaize says it is investigating whether its case is linked to the group's October cyberattack.

Why it matters

The same kind of attack is now hitting many countries and small shops as well as large chains. Any store whose controller can be reached from the internet, runs an old model or still has a default password is exposed, and the food losses are immediate.

What defenders can take from it

  • Shops and chains: ask your refrigeration contractor in writing how remote access to your controllers is secured, and have them taken off the open internet.
  • Change default passwords on controllers and replace models that no longer receive security updates, as Danfoss advised after the French attack.
  • Keep independent temperature sensors and alarms that the control system cannot switch off, and have a manual temperature check and food-safety plan ready.
  • Refrigeration installers and service providers: restrict remote access to a VPN or secure gateway and review which customer devices are reachable from the internet.

Sources