Hackers remotely took control of supermarket freezers across seven European countries overnight on 1–2 November 2026, pushing temperatures inside fridges and freezers as high as 50°C (122°F) and forcing stores to throw away ruined food. The supermarket freezers cyber attack hit more than 100 stores in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland, just three weeks after a similar attack struck hundreds of supermarkets in France. No group has claimed responsibility, and police and cybersecurity agencies across Europe are still investigating who was behind it.

What makes this attack different from an ordinary burglary or ransomware incident is the target: the humble refrigeration controller. Supermarkets let their freezers connect to the internet so maintenance teams can monitor and adjust temperatures remotely. The attackers used that same remote access to switch the units into defrost mode, turning equipment designed to keep food at minus 18°C into heaters. This article explains which stores were hit, how the supermarket freezers cyber attack worked, and what it means for shoppers and for Europe’s food supply.

Which Countries Were Hit by the Supermarket Freezers Cyber Attack

According to an AFP tally cited by The Guardian, more than 100 stores were affected across the seven countries. Belgium suffered the widest damage, with dozens of stores hit. Here is what was reported in each country by the evening of 2 November 2026:

  • Belgium: Ahold Delhaize said an overnight IT incident affected fridges and freezers at dozens of Delhaize stores in Belgium and Luxembourg; the BBC reported about 40 Delhaize stores. Carrefour said about 15 of its 700 Belgian stores were affected, Colruyt Group confirmed five Spar franchise shops were attacked, and Intermarché reported problems at 15 stores. IKEA’s store in Mons also reported a cyberattack.
  • Luxembourg: Delhaize stores were hit in the same overnight incident as Belgium.
  • Sweden: ICA said a limited number of stores were affected; ICA stores in Sjöbo and Tomelilla stayed shut on Monday morning. Coop said cooling systems at around half a dozen of its 800 stores were affected and confirmed it was a cyber incident.
  • Ireland: Musgrave said a cyber incident affected refrigeration systems at 13 SuperValu stores, forcing chilled and frozen products to be removed from sale.
  • Netherlands: At least 17 businesses, including butcher shops and neighbourhood stores, were targeted, according to Danfoss.
  • Estonia: Attackers set systems at one Selver store to 50°C; supplier Kitman Coldtech responded within ten minutes and no goods were damaged.
  • Finland: Stores were among those reporting refrigeration problems, though no chain-by-chain figures were published on 2 November.

One Delhaize store in Flanders reported about €100,000 worth of destroyed produce, while a Belgian butcher chain, De Laet en Van Haver, said its fridges were turned up to 18°C, ruining about €15,000 worth of meat. The full cost across all seven countries was still being counted on 2 November, but early estimates put total losses in the millions of euros.

How the Supermarket Freezers Cyber Attack Worked

The attackers did not break into the supermarkets themselves. They reached the electronic controllers that run each store’s refrigeration — units often made by the Danish firm Danfoss, along with Copeland and Dixell equipment — and switched them into defrost mode. In normal operation, defrost cycles briefly warm the evaporator coils to melt frost. Left running, they heat the whole cabinet: temperatures in some units reached 50°C (122°F), and some reports put the peak at 55°C.

Investigators say the weak point was remote access. Many of these controllers are connected to the internet so outside maintenance contractors can adjust them without visiting the store, and some were still running with their factory default password. Danfoss said it had warned customers after the French attacks to make sure devices were not publicly exposed, especially because they contain a default password. France’s CERT-FR traced the October attacks to the same family of controllers, including Danfoss AK-SC and AK-SM units and Copeland and Dixell xweb devices, and said many of the compromised units were older models that no longer receive software or security updates. Security researchers at Sekoia found more than 2,700 of these StoreView systems reachable over the internet, with about 1,700 of them in France.

The Belgian refrigeration firm Sabcobel, which operates Delhaize’s systems, confirmed the incident was a cyberattack and said its teams worked overnight to disconnect affected equipment from the network. Its chief executive, Stefan Mullens, said the attackers switched the units’ evaporators to defrost mode.

The France Attack That Came First

The November attack was the second wave in three weeks. On 12 October 2026, hackers hit hundreds of supermarkets in France, raising refrigeration temperatures as high as 50°C and causing fires as well as food losses. French Finance Minister Roland Lescure told Parliament that roughly 700 of the country’s 10,000 supermarkets were affected, with chains including Intermarché, Carrefour, Monoprix and Coopérative U among them. The damage ran into tens of millions of euros.

France’s cybercrime agency ANSSI and the Paris Prosecutor’s Office are investigating the October attacks, and no one has been identified. At the time, Belgium was already flagged as a country with exposed systems. Three weeks later, the same method appeared in seven more countries — which is why investigators are treating the two waves as connected, even though no group has claimed either attack. Read our earlier report on the France supermarket cyberattack, when hackers heated fridges to 50°C.

Who Is Behind the Supermarket Freezers Hack?

As of 2 November, nobody knows. No group has claimed the attacks and nobody has demanded a ransom, which rules out the usual ransomware motive. Some experts have speculated about Russian involvement, but that remains speculation: officials have not attributed the attacks to any state, and the BBC and other outlets have been clear that attribution is unproven.

What is confirmed is the official response. Belgium’s federal prosecutor opened a criminal investigation. The EU’s agriculture commissioner, Christophe Hansen, called the attacks “a deliberate attempt to disrupt the Union’s food supply” and to undermine citizens’ trust. The EU’s CyCLONe network of national cyber-crisis agencies is coordinating the response between the affected countries, and cybersecurity agencies in Belgium, Sweden, Ireland and the United Kingdom are assessing the incidents alongside international partners.

The investigation also reaches across the Atlantic. The Pentagon is examining whether suspicious refrigeration failures at US military bases in August — at more than half a dozen commissaries — were a cyberattack and whether they are linked to the European incidents. The UK was not affected in the November wave, but its National Cyber Security Centre said it was working with international partners and industry, and it had warned British retailers to update the software on fridge temperature controllers “with urgency”. A handful of British meat suppliers were nevertheless affected, according to the retail magazine The Grocer, with temperatures on their fridges raised to 38°C.

What the Supermarket Freezers Hack Means for Shoppers

For shoppers, the immediate effect was empty shelves rather than danger: stores pulled chilled and frozen goods from sale as soon as the temperature rise was detected, and much of the food was thrown away. But the incident is a reminder that food safety depends on the cold chain — the unbroken run of refrigeration from warehouse to shelf. Food that warms above safe temperatures and is then re-chilled can grow bacteria, which is why retailers destroyed the stock instead of selling it.

If you shop at an affected store, the practical advice is simple: do not buy chilled or frozen food that feels warm or partly thawed, check use-by dates, and follow the store’s notices about which products were pulled. The affected chains have said they are restocking after cleaning and re-checking their systems. For the wider picture, the attack shows how a mundane piece of equipment — a fridge controller — can become critical infrastructure when thousands of them are connected to the internet with weak passwords. If you want the basics of staying safe online, see our guide to what cybersecurity is and how to protect yourself.

What Happens Next After the Supermarket Freezers Hack

Investigations in at least three countries are now running in parallel, and the EU is coordinating through CyCLONe. The immediate fixes are unglamorous but effective: take refrigeration controllers off the public internet, change default passwords, and replace older units that no longer receive security updates. Danfoss and other suppliers have been telling customers to do exactly that since the French attacks — the November wave suggests not every store had done so. Cyberattacks on everyday systems are becoming more common: in October, hackers also struck around 20 Indian financial institutions through payment APIs.

Whether the attacks continue is the open question. Reports on 2 November suggested refrigeration systems in other countries, including Germany, Portugal, Romania and Italy, may also have been targeted, but those reports were not confirmed by the evening of 2 November. What is clear is that the pattern has now repeated twice in three weeks, and that the people behind it have not been found. Until they are, every supermarket with an internet-connected freezer is a potential target — and the next wave, if it comes, may not stop at seven countries.

Sources: BBC, Reuters, The Guardian, The Times, FoodNavigator, AFP. This article is based on reporting published on 2 November 2026; figures may change as investigations continue.