Europe’s Food Cold Chain Under Attack as Hacked Freezers Hit Seven Countries

Supermarkets in at least seven European countries opened on Monday, November 2, 2026, to find that their fridges and freezers had been tampered with remotely during the night. Belgium was hit hardest, with dozens of Delhaize, Carrefour, Intermarché and Spar stores reporting sudden temperature spikes in their cold storage, while similar problems surfaced in Luxembourg, the Netherlands, Sweden, Ireland, Estonia and Finland. The new wave came exactly three weeks after a much larger attack disabled refrigeration at hundreds of supermarkets in France, and it once again shows how exposed internet-connected equipment has become in the food supply chain.

The first alerts came in the middle of the night. Belgian refrigeration installer Sabcobel, which services cooling equipment for many Delhaize outlets, said its technicians were mobilized from 01:00 Central European Time to disconnect the affected installations. Around 03:00, the Antwerp butcher group De Laet & Van Haver noticed that someone was changing the settings of its cooling systems from the outside and managed to pause the units before temperatures rose too far. At about 04:00, Delhaize warned its store managers by text message, and some locations brought in refrigerated trucks to save part of their stock.

According to Sabcobel CEO Stephan Moelans, the attackers did not break into his company's own network. They went directly after the central controllers that run refrigeration inside each store, many of which are reachable over the internet, and switched the evaporators into defrost mode. As a result, display cases and freezers started to warm up instead of keeping products cold. In Sweden and Estonia, freezer settings were pushed to 50°C (122°F) and staff could not change them back. Moelans said the method matched the one used in France and warned that a software update alone would not close the gap, because many installations also require physical modifications.

Belgium accounted for the largest share of affected sites. Delhaize said around 40 of its stores in Flanders and Wallonia were affected, mostly smaller Proxy Delhaize shops and Shop & Go convenience stores next to Q8 fuel stations, along with some regular supermarkets. Carrefour Belgium confirmed that 15 of its roughly 700 stores had problems, none of them hypermarkets. Intermarché reported about 15 independently run outlets in Wallonia and Brussels, and Colruyt Group said around five independently operated Spar stores were hit while its own Colruyt stores were spared. An IKEA store in Mons and several butcher shops in the Antwerp area also saw their freezers warm up.

For some store owners, the losses were heavy. At a Proxy Delhaize in Hoepertingen, in the province of Limburg, freezers that normally run at -22°C climbed to around 15°C, and the manager estimated that at least €60,000 worth of food had to be thrown away. A Delhaize store in Eeklo reported damage in the tens of thousands of euros after its units reached 50°C. The Delhaize in Grembergen kept its doors closed on Monday morning, and stores in Boortmeerbeek, Ghent and Sint-Truiden emptied their refrigerated shelves. A butcher shop in Hove said several hundred kilos of meat and ready-made products had to be destroyed.

Belgium's food safety agency, the FAVV, reminded retailers that they must check the temperature of both their equipment and the products themselves. Chilled food generally cannot exceed 7°C, sensitive products such as meat and fish have stricter limits, and frozen goods must stay at -18°C or below. Any item that crossed these limits, or whose safety is in doubt, has to be pulled from the shelves. The Belgian federal prosecutor's office opened a criminal investigation into the attack on Monday.

Outside Belgium, Swedish grocer Coop confirmed that 7 of its more than 800 stores were affected, with problems ranging from fully shut-down freezers to one system that started generating heat. ICA said a small number of stores operating outside its central network were hit, including ICA Baronen in Stockholm and an ICA Kvantum in Sjöbo, which had to discard frozen products. In Ireland, 13 SuperValu stores that use the same refrigeration system removed fresh and frozen items, and some opened later than usual. In Estonia, freezers at the Selver chain were set to 50°C, and a local refrigeration technology supplier said other customers in the country were also targeted.

In the Netherlands, Danfoss said the cooling systems of at least 17 businesses, mostly neighborhood stores and butcher shops, had their temperatures altered. According to the Danish manufacturer, these were customers who had not followed its advice after the French incident to disconnect their systems and reconnect them through a secured network. Several Delhaize supermarkets in Luxembourg were affected as well, and Finland's cybersecurity center reported a few hit stores with limited damage, reportedly small outlets of the K Group. In total, more than 115 stores across the region acknowledged refrigeration failures on Monday.

The French precedent was far larger. During the night of October 11 to 12, attackers took control of refrigeration controllers in hundreds of French supermarkets and raised temperatures as high as 50°C, spoiling food and causing fires in several stores. Intermarché and Netto, Coopérative U, E.Leclerc, Carrefour and Monoprix were all affected, and the French government later put the total at around 700 supermarkets. The national cybersecurity agency ANSSI linked the attack to older Danfoss controllers from the AK-SM and AK-SC ranges that no longer received security updates, and it also issued a warning about Copeland and Dixell XWEB devices. The Paris prosecutor opened an investigation, but three weeks later no group has been publicly identified as responsible.

The refrigeration attacks also coincided with another major incident in the grocery sector. On the afternoon of October 11, Ahold Delhaize, the parent company of Delhaize and Albert Heijn, took part of its IT network offline after detecting a security issue. The shutdown halted Albert Heijn home deliveries, disrupted work at distribution centers and left empty shelves in some Dutch stores, while websites and apps of the group's brands in Europe and the United States went down. The company filed a police report on October 19, and Albert Heijn planned to resume home deliveries on October 23. For Delhaize Belgium, Monday's attack therefore marked the second serious cyber incident in barely three weeks.

The Centre for Cybersecurity Belgium said it was concerned about the growing number of incidents and pointed to the targeted use of artificial intelligence, which makes it easier for skilled attackers to exploit vulnerable systems. The agency described this as a trend that has accelerated over the past six months. Remote access allows suppliers to monitor and adjust cooling units from a distance, but every controller left reachable from the internet with outdated software becomes a potential entry point. Independent franchise stores, which often manage their own equipment outside the central IT security of the large chains, appear to be the weakest link.

As of Monday evening, most affected stores remained open with a reduced range of fresh and frozen products, while technicians continued to disconnect and secure the compromised controllers. The financial bill is still being assessed and includes destroyed stock, lost sales and the cost of upgrading or replacing old equipment. The identity and motives of the attackers remain unknown, and security experts warn that new waves are possible as long as exposed refrigeration systems stay online across Europe.