A cyberattack on supermarket refrigeration systems disrupted stores across seven European countries on November 2, 2026, forcing retailers to discard spoiled food after temperatures in some refrigerators and freezers rose to 50C (122F).
Retailers in Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia and the Netherlands reported equipment failures. Approximately 40 Delhaize supermarkets in Belgium and Luxembourg were affected, alongside stores operated by Carrefour, ICA, Coop, Spar and other retailers.
- Supermarkets in Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia and the Netherlands reported refrigeration failures after hackers reportedly raised temperatures to 50C (122F).
- Delhaize, Carrefour, ICA, Coop, Spar and Ikea were among the affected retailers. One Belgian supermarket reported €100,000 in spoiled food.
- The incident follows an October cyberattack affecting up to 700 French supermarkets, with food losses estimated in the tens of millions of euros.
The incident follows a similar attack in France in October that affected up to 700 supermarkets, reportedly causing fires and food losses estimated in the tens of millions of euros.
European Commissioner for Agriculture and Food Christophe Hansen described the repeated incidents as “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”.
Hackers manipulate supermarket refrigeration controls
Belgian refrigeration equipment company Sabcobel confirmed that attackers had switched refrigerator evaporators into defrost mode, causing temperatures to rise.
Sabcobel, which operates refrigeration systems for Delhaize and manufactures some of the affected equipment, had been working to address the vulnerability since the October attacks in France.
Moelans said protecting some refrigeration units required physical modifications rather than software updates alone.
Most modern supermarket refrigeration systems can be monitored and controlled remotely, allowing technicians to manage temperatures and diagnose equipment faults through internet connections. That capability can expose operational equipment to cyberattacks when network access or control systems are compromised.
The identity of the attackers remains unknown.
Delhaize, Carrefour and Spar report food losses and store disruptions
Belgium was among the hardest-hit countries, with refrigeration failures affecting several major supermarket chains.
Ahold Delhaize confirmed that dozens of its stores in Belgium and Luxembourg had experienced problems. The company had reported a similar incident to Dutch police in October.
At affected locations, refrigerated shelves were emptied and customers were informed that some fresh and frozen products were temporarily unavailable.
Ahold Delhaize spokesperson Sarah De Meester said distribution centres continued operating normally and deliveries were unaffected.
One Delhaize supermarket in Hoeilaart, Belgium, estimated its spoiled food losses at €100,000 (£83,500). Its manager said the figure excluded additional losses from temporarily closing the store.
Carrefour Belgium reported refrigeration problems at approximately 15 of its 700 supermarkets but said immediate measures had allowed stores to remain open.
Colruyt Group reported attacks on refrigeration systems at five Spar franchise stores, while Intermarché confirmed technical problems at 15 locations.
Other affected businesses included Shop & Go convenience stores associated with Q8 service stations and smaller Proxy Delhaize outlets.
Ikea also confirmed that a cyberattack had affected refrigeration equipment at its store in Mons, western Belgium.
The retailer removed food products as a precaution after freezer temperatures rose sharply and expected some inventory losses. A spokesperson said additional locations could also be affected.
Swedish ICA and Coop stores discard spoiled food
In Sweden, several ICA and Coop supermarkets experienced refrigeration failures overnight.
ICA confirmed that a limited number of stores operating outside its central network had been affected. The store temporarily closed while employees removed damaged products before reopening to customers.
Another ICA location in Stockholm reported a cyberattack at approximately 2 a.m. that left frozen inventory unusable.
Coop Sweden said seven of its approximately 800 stores were affected, adding that the situation was contained and under control. An earlier report referred to six affected locations.
Sweden’s National Cybersecurity Centre is investigating the incidents. Its head, John Billow, told Reuters that investigators had identified “quite a lot of exposed operational technology devices” requiring security updates or patches.
Similar refrigeration problems were reported elsewhere in Europe. In Finland, supermarket operator Kesko launched an investigation after equipment failures were detected at some K-stores.
Dutch public broadcaster NOS reported problems affecting at least 17 stores in the Netherlands, primarily smaller retailers. Incidents were also reported in Ireland and Estonia, although the number of affected locations was not established.
October attack on French supermarkets caused millions in damage
The latest attacks resemble an October incident in France involving refrigeration equipment at as many as 700 supermarkets, including stores operated by Intermarché and Coopérative U.
Hackers reportedly manipulated cooling systems, raising temperatures to 50C and forcing retailers to dispose of substantial quantities of perishable food.
French media initially reported losses worth millions of euros, with subsequent estimates placing the damage in the tens of millions. Fires were also reported during the incident.
The recurrence of similar equipment failures has prompted scrutiny of remotely managed refrigeration systems, particularly the security of connected operational technology used by food retailers.
Unlike conventional cyberattacks involving the theft of customer information or disruption of corporate software, interference with refrigeration controls can directly damage physical inventory and interrupt store operations.
The financial consequences include spoiled products, emergency maintenance, disposal costs and lost revenue during temporary closures.
European cybersecurity agencies investigate coordinated attacks
National cybersecurity authorities in Belgium and Sweden are monitoring the incidents and working with affected businesses.
The UK’s National Cyber Security Centre said it was cooperating with international partners and industry representatives to “fully understand details of an incident”. No related attacks had been reported in the UK.
European officials have previously expressed concern about state-sponsored hybrid attacks against civilian infrastructure following Russia’s invasion of Ukraine in 2022. No evidence has been disclosed linking the supermarket incidents to a government.
US authorities are separately investigating refrigeration malfunctions reported at several American military bases in August. Investigators are cooperating with French officials to determine whether those failures could be connected to the supermarket attacks.
No connection has been confirmed between the US incidents and those in Europe, or between the October and November supermarket attacks.
The total financial impact of the November 2 disruption remains unknown. Retailers and refrigeration suppliers are restoring affected systems, examining the security weaknesses and assessing inventory losses while authorities continue investigating the attacks.
