Attackers heat up fridges and freezers at more than 100 stores across Europe, spoiling food

What happened

Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia, and other European countries overnight into Monday, November 2, 2026, warming fridges and freezers, The Hacker News reported. Some stores had to throw away chilled and frozen food or take it off the shelves.

Refrigeration controls are computers that run a store's fridges and freezers. They can be connected to the internet so that refrigeration contractors can monitor them and fix faults remotely, The Hacker News explained.

In Belgium, the attackers switched cooling units into defrost mode, The Hacker News reported. Defrost mode is meant to clear ice, but in these attacks it made the units heat up. Stephan Moelans, chief executive of the Belgian refrigeration company Sabcobel, which operates the systems used by Delhaize, told the Belga news agency that the incident was a cyberattack, according to NBC News. In other cases the attackers raised the temperature setting. An ICA Kvantum store in Sjöbo, in southern Sweden, said its fridges and freezers had been hacked and set to 50 degrees Celsius (122 degrees Fahrenheit), the Associated Press reported.

The attacks closely resemble a first wave that hit France overnight from October 11 to 12, when around 700 supermarkets had their refrigeration units forced into defrost mode, SecurityWeek reported. French police said hackers seized control of cooling units at hundreds of supermarkets in that attack, causing fires and food losses, according to CBC News.

Who is affected

More than 100 stores were affected, including major chains and small butcher shops, according to SecurityWeek. BleepingComputer counted more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. Problems were also reported in Finland, Italy, and Portugal, SecurityWeek reported.

• •
  Belgium. Delhaize said an "IT incident" affected refrigeration at several dozen stores, Carrefour counted 15 of its more than 700 stores, and Colruyt Group said five franchised Spar shops were attacked. An IKEA store in Mons was also hit, according to SecurityWeek.
• •
  Luxembourg. Four Delhaize stores were affected, SecurityWeek reported.
• •
  Ireland. Musgrave pulled chilled and frozen food from 13 of its 223 SuperValu stores after a "cyber incident" limited to one refrigeration model, The Hacker News reported. Musgrave said on Monday afternoon that the incident had been "fully resolved," according to The Irish Times.
• •
  Sweden. ICA said "a limited number" of stores were affected and gave no count, the Associated Press reported. Coop told the TT news agency that six stores in central Sweden had problems, according to the Associated Press, and told BleepingComputer that 7 of its more than 800 stores were affected.
• •
  Netherlands. Danfoss said the systems of at least 17 businesses were hit, mainly butcher shops and small grocers, according to SecurityWeek.
• •
  Estonia. One Selver supermarket was affected, and the problem was fixed within about 10 minutes with no products damaged, according to The Hacker News.

Not every company called the incident a cyberattack. ICA and Coop told AFP they had no immediate information that their systems had been attacked, CBS News reported.

Investigation and response

Nobody has taken responsibility for the attacks, and investigators have not established whether the French and November 2 waves are connected, SecurityWeek reported. Belgium's federal prosecutor's office confirmed to VRT NWS that it has opened a criminal investigation. "It is not known who is behind this attack, and it may never be determined," a spokesperson for the Centre for Cybersecurity Belgium told Reuters, according to CBC News.

Sweden's National Cyber Security Centre said in a notice that it is following the incidents, is in contact with affected organizations, and is exchanging information with its counterparts in other Nordic and European countries.

European Union agriculture commissioner Christophe Hansen called the attacks "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it," according to CBC News.

Several of the systems that were hit were made by Danfoss, a Danish maker of refrigeration controls, which said its products were involved, The Hacker News reported. A Belgian butcher told Dutch broadcaster NOS that equipment from a second maker, Copeland, was also attacked. A Danfoss spokesperson told NOS that the Dutch systems that were hit were not on a secure network and still used default passwords, according to The Hacker News.

Security researcher Kevin Beaumont said people he spoke with had confirmed that every freezer hit on November 2 had a management interface reachable from the internet, according to SecurityWeek. Beaumont said many of the devices are end-of-life and have no available patch. Officials have not publicly explained how the attackers got in.

How many controllers are exposed

The internet intelligence firm Censys found just over 1,000 Danfoss StoreView interfaces reachable online worldwide, SecurityWeek reported. Exposed instances in France fell from 1,825 before the October attacks to 220. Censys counted 138 exposed instances in Belgium, 51 in the Netherlands, and 50 in Sweden.

What store operators should do

CERT-FR, the incident response team of France's national cybersecurity agency ANSSI, published an alert covering Danfoss AK-SM and AK-SC series controllers and Copeland XWEB and Dixell XWEB systems. It warns that attack campaigns against these devices are probably still under way. For devices that have not been compromised, CERT-FR advises operators to:

• •
  Remove the units from the internet, including any device on a public IP address.
• •
  Check their insurance contract before cutting the data feed to the refrigeration contractor.
• •
  Check the whole configuration, especially the defrost schedules.
• •
  Restore remote access only through a secure virtual private network (VPN) or a protected network.
• •
  Follow the maker's good practices, such as updating firmware. For Danfoss devices, CERT-FR advises setting the security level to strict and making sure default passwords have been changed.

For a compromised device, CERT-FR advises restarting it or restoring it to factory settings and reconfiguring it before putting it back into service. It warns that a device past its end of life that stays exposed to the internet is very likely to be compromised, and that a factory reset alone leaves it open to attack again.

Danfoss said it told its customers on October 13 to cut their systems' internet connections and reconnect only through a secure network, according to SecurityWeek. Sabcobel's Moelans said a software update alone is not enough, because many installations also need physical changes that cost money, CBS News and The Hacker News reported.

Sweden's National Cyber Security Centre advises organizations to list which devices are connected to the internet, decide whether each one needs to be connected, and keep any that remain connected updated and protected with several layers of security, The Hacker News reported.