Jump to content

User:Louis/European supermarket refrigeration cyberattacks November 2026

From Consumer Rights Wiki

The computers that run supermarket fridges & freezers in Belgium, Sweden, Estonia & other European countries had their settings changed remotely by attackers overnight into November 2, 2026,[1] & the BBC reported that many of the retailers hit said they had no choice but to throw away spoiled food.[2] Some of those retailers put their lost produce at hundreds of thousands of euros,[2] & in an October 15, 2026, report on the earlier attack in France, four insurance brokers told Reuters that cyber insurance does not generally cover physical losses from attacks.[3]

The Dutch systems hit three weeks after the French attack were not on a secure network & still used default passwords, a spokesperson for Danfoss, a Danish maker of refrigeration controls, told Dutch broadcaster NOS.[4][1][5] By November 2, 2026, supermarket chains in at least seven countries had reported refrigeration problems,[6] & Belgium's federal prosecutor's office had opened a criminal investigation;[7] as of November 3, no one had claimed responsibility for either attack.[8]

Fridges and freezers switched to defrost overnight

[edit | edit source]

In Belgium, attackers switched cooling units into defrost mode, Sabcobel chief executive Stephan Moelans told Belgian media.[1] Sabcobel, a Belgian refrigeration company,[5] operates the refrigeration systems of the Delhaize supermarket chain.[6] If a refrigerated display case is not defrosted regularly, ice can build up on a part called the evaporator, restricting air flow and reducing cooling, according to Danfoss.[9] Defrost mode is meant to clear that ice; in these attacks it made the units heat up.[1]

In other cases, the temperature setting was raised,[1] with thermostats "remotely cranked up in some cases to 50C (122F)", The Guardian reported.[10] An ICA store in Sjöbo, in southern Sweden, wrote on social media that its fridges & freezers had been hacked overnight & "they have set the temperature to 50 degrees".[11] At a Selver supermarket in Estonia, hackers changed a freezer setting to 50 °C,[12] but the temperature in the freezers rose by about 2–3 °C & no products were damaged, said Jann Mutso, head of refrigeration technology maker & distributor Kitman Coldtech.[12]

The Belgian attack hit at around midnight on the night from Sunday to Monday, November 2, Moelans told Belgian news agency Belga.[13][1] The freezers at a Proxy Delhaize in Hoepertingen, Belgium, rose to 15 °C against a normal minus 22 °C, VRT NWS, the news service of Flemish broadcaster VRT, reported, citing newspaper Het Belang van Limburg.[7] Luc De Laet, founder & owner of Belgian butchery chain De Laet & Van Haver, said he found the fridges at his store south of Antwerp turned up as high as 18 °C.[14] In the Netherlands, a Danfoss spokesperson told Dutch broadcaster NOS that at a frozen-goods storage site, systems that should be at minus 20 °C were found at minus 10 °C.[4]

Food thrown away and store losses

[edit | edit source]

Referring to the French attack, the BBC reported:

As with that incident, many of the retailers affected on Monday said they had no choice but to throw away spoiled food - some saying this amounted to hundreds of thousands of euro in lost produce.[2]

Mathieu Tilman, who runs a Delhaize supermarket in Belgium, told the BBC he found it "truly distressing".[2] In Belgium, a Delhaize branch in Hoeilaart told news website Het Laatste Nieuws it had lost €100,000 worth of produce, an estimate its manager said did not even take into account further losses from closing the shop.[11] De Laet estimated the incident ruined about €15,000 worth of meat.[14] Sarah De Meester, a spokesperson for Dutch retailer Ahold Delhaize, said the range of fresh & frozen products was "temporarily somewhat limited" in affected shops, but that there was no disruption to deliveries.[6]

Belgium's federal food-safety agency said affected supermarkets had to check for themselves whether certain products had exceeded the maximum temperature.[7] Its spokesperson, Hélène Bonte, said the maximum temperature for products in the fridge is usually 7 °C.[7] For frozen products, a temperature of minus 18 °C applies that may not be exceeded.[15] The agency said that if the temperature has been exceeded or there is doubt about food safety, shops must take the products off the shelves & may no longer sell anything.[7]

In Ireland, SuperValu removed chilled & frozen products from shelves in 13 stores on Monday morning as a precautionary measure.[16] A number of stores, including the SuperValu in Bray, did not open on time while staff dealt with the issue.[17]

Countries and retailers hit

[edit | edit source]

Retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands & Sweden reported problems with their refrigeration systems on Monday, November 2, 2026.[6] The BBC reported that dozens of supermarkets across seven European countries had been hit.[11] In a report published on November 3, news agency Agence France-Presse (AFP) said the suspected cyberattack had hit grocery stores across at least nine European countries, Italy & Portugal among them.[5]

Country Reported by Businesses affected, as reported
Belgium & Luxembourg The BBC Delhaize: around 40 supermarkets.[11]
Sweden Coop Coop: six of its around 800 stores,[5] then a seventh, in Sundsvall, confirmed at around 11:00.[18]
Finland Yle Kesko: temperature faults in the refrigeration equipment of a few smaller K grocery stores.[19]
Ireland A spokesman for SuperValu owner Musgrave Group SuperValu: a "cyber incident" limited to a "specific model" of refrigerator,[16] affecting refrigeration systems in 13 of its 223 shops.[6]
Estonia Selver Selver: one outlet.[12] Estonia's Information System Authority said it had received one notification, from Selver, & had not heard of any other incidents that day.[20]
Netherlands A Danfoss spokesperson, to NOS At least 17 companies, including butchers & small neighbourhood shops, whose freezing & cooling systems were attacked overnight.[4]
Italy Media reports & Italy's national cybersecurity agency, according to AFP At least four Coop supermarkets in Sicily & one business in Tuscany.[5]
Portugal The Mosqueteiros group, to AFP Incidents at seven Intermarché stores.[5]
UK Association of Independent Meat Suppliers (AIMS) Meat suppliers: AIMS said a few of its more than 300 members had "unexpectedly become 'collateral'" & none of those affected had lost any meat.[21][2]

Remote access to shop refrigeration controllers

[edit | edit source]

A store's fridges & freezers are run by computers known as refrigeration controls, which can be connected to the internet so that refrigeration contractors can monitor them & fix faults from a distance.[1] Cybersecurity expert Patrick Hauspie of Vlaio, the Flemish government's support platform for entrepreneurs, said, according to VRT NWS, that suppliers often co-manage the systems remotely & can then carry out maintenance, run updates or step in when something goes wrong, for example when they receive an alarm.[15] Cybersecurity company Forescout, in research published on October 22, 2026, used Shodan, a search engine that indexes devices connected to the internet, to find 12,976 exposed refrigeration management services on 6,017 internet addresses across 99 countries & territories.[22][23]

An ICA spokesperson confirmed that the incident had affected a "small number of ICA stores operating outside ICA's central network".[11] Carlos Cancino, a spokesman for Swedish retailer Coop, told AFP that the chain's affected stores had been connected to a 4G mobile network rather than the updated 5G system, which made them "more exposed" to hackers.[5] In Finland, public broadcaster Yle reported that the security chief of retail group Kesko said the disturbance was not large-scale & concerned a few shops, whose refrigeration equipment had not been covered by centralised protection.[19]

Entry routes named by suppliers and agencies

[edit | edit source]

The Danfoss spokesperson who told NOS that the Dutch systems lacked a secured network & had a default password said the attack could have been prevented had measures been taken.[4] Hauspie said, according to VRT NWS, that the refrigeration systems usually still have an admin account, but that its password has often not been changed.[15] In Belgium, Moelans was quoted by VRT NWS as saying that the refrigeration installations in the shops had been attacked directly & that there had been no cyberattack on Sabcobel itself.[7][1]

Kitman Coldtech's Jann Mutso said the attackers in Estonia gained access to the control computer of an older type of Danfoss refrigeration system.[12] Mai Kraft, head of the Cyber Security Center at Estonia's Information System Authority, told Estonian public broadcaster ERR's Aktuaalne kaamera that the main factor in these attacks was devices with security vulnerabilities visible on the internet, which attackers maliciously exploit.[20]

A Danfoss spokesperson told Belgian broadcaster VTM NIEUWS that the vulnerability lies primarily in outdated software & that customers had already been urged to start using the company's new software, Euronews reported.[24] Security researcher Kevin Beaumont commented that the freezers hit in the countries affected that day "are all [management] interface facing internet, same issue and vuln as last time".[25] Ireland's National Cyber Security Centre said current indications suggested the incidents "may be related to a known vulnerability", industrial-cybersecurity news site Industrial Cyber reported.[26]

End-of-life controllers still in service

[edit | edit source]

In its Tech Insider newsletter dated October 31, 2025, Danfoss wrote that its AK SM 800, one of the company's refrigeration controllers,[27] "was officially declared End of Life in May 2021" & that, according to an earlier product note, "End of Life status leads to End of Service".[28] The newsletter gave Danfoss's reason:

These products can no longer meet current regulatory or security requirements. Continuing to provide services for these products would place Danfoss under new legal obligations to maintain security updates.[28]

After the October attack in France, Danfoss said in a statement to cooling-industry news site Cooling Post, published on October 12, 2026, that the majority of units affected were legacy products or current products running outdated firmware.[27] Specifically, Cooling Post reported, those affected were the AK-SM800 & the AK-SC355 systems, phased out in 2016, which "no longer receive software or security updates".[27] Richard Horne, chief executive of the UK's National Cyber Security Centre, told the BBC that many firms had extended systems beyond their end of life.[2]

On November 2, Mutso told ERR:

All the store chains have started fighting this and have updated their controllers, but there are also places where the controllers are old and not updated, and those are being targeted now[12]

October warnings after the French attack

[edit | edit source]

The November attacks came three weeks after a cyberattack in France "forced hundreds of outlets to throw away spoiled stock", AFP reported.[5] In the French attack, on the night of October 11 to 12, 2026, hackers took control of the refrigeration systems of French supermarkets.[29] Among the equipment affected were several types of refrigeration control systems made by Danfoss, Copeland & Dixell, France's Computer Emergency Response Team (CERT-FR) confirmed.[30][31] Vincent Strubel, director general of France's national cybersecurity agency, said before the French Senate that the attackers had relied on basic security failures, starting with refrigeration equipment exposed directly on the internet, as well as weak passwords & similar failings.[29]

CERT-FR's alert, first published on October 12, 2026, told operators to restore access only through a secure virtual private network or a protected network.[31] On October 13, Danfoss advised its customers in the Netherlands to disconnect the systems from the internet & to reconnect them only through a secure network.[4][1] The Centre for Cybersecurity Belgium (CCB) issued a warning on October 13, 2026, whose title ended "patch immediately!"[32] The CCB's advisory added:

Attack campaigns are likely still underway. Maintaining internet exposure on equipment (especially ones that are End-of-Life) without a patch, exposes it to a very high probability of compromise.[32]

Shops not yet secured by November 2

[edit | edit source]

A Danfoss spokesperson told NOS that most Dutch shops had taken measures after the company's advice of October 13, but a small number had not, & those were the ones hit.[4][1] Selver communications chief Mariann Järvela said the one Selver store hit in Estonia was "the last Selver store where the new system had not yet been taken into use".[12] Swedish chain Coop said new systems had already been ordered after the French incident.[12]

In Belgium, Sabcobel said it had started securing its installations after the October attack in France, but that some of its systems had not yet been upgraded & were among those hit.[5] The company put the share of its installations still not overhauled at about 10%.[33] Moelans told AFP that if Sabcobel had not launched this work, the impact would have been much greater.[33] He told Belga that a software update alone is not enough & the installations must be physically modified.[13][24]

Insurance cover and independent shop owners

[edit | edit source]

The four insurance brokers who spoke to Reuters after the French attack said that, besides cyber insurance generally not covering physical losses from attacks, supermarkets' claims could be affected if they did not have the latest software updates.[3] After the French attack, Intermarché told AFP that its insurance did not cover this type of incident, Reuters reported.[3]

In an alert dated November 3, 2026, law firm Kennedys wrote that "Neither coverage nor exclusion should be assumed" & that known vulnerabilities "do not automatically establish liability or defeat cover".[34] Cybersecurity news site The Record reported that there are currently no legal obligations on manufacturers to fix products targeted by such attacks, & that the EU's Cyber Resilience Act will impose stricter requirements on such products from December 2027.[35]

In Belgium, Intermarché's 150 shops in Brussels & Wallonia are run by independent operators, VRT NWS reported.[7] A representative of Belgian retailer Colruyt Group told technology news site BleepingComputer that the refrigeration systems at around five Spar stores had been affected & that these stores "are operated by independent entrepreneurs who have their own refrigeration systems".[36] In Ireland, most stores "operating under the SuperValu name are independently owned", the Irish Examiner reported, while Musgrave centrally owns some branches.[37] Ireland's National Cyber Security Centre warned that responsibility for the affected systems rests with the relevant operators & their suppliers, Industrial Cyber reported.[26]

Investigations and official responses

[edit | edit source]

Belgium's federal prosecutor's office confirmed to VRT NWS on November 2 that it had opened a criminal investigation into the cyberattack on the refrigeration systems of several supermarkets.[7] No group had claimed responsibility for the November 2 attacks or for the October attack in France, & no law enforcement or government agency had yet identified the perpetrators, The Record reported.[35] Katrien Eggers, spokesperson for the CCB, told The Record:

It is not known who is behind this attack, and it may never be possible to identify them[35]

EU food and agriculture commissioner Christophe Hansen said the repeated attacks were deeply concerning & called them "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it".[6] Horne told BBC Radio Four's Today programme that the National Cyber Security Centre had worked through the night to alert potentially affected organisations in the UK, the BBC reported.[2] The National Cyber Security Centre said it was aware of "a couple of instances where vulnerable technology had been exploited in the UK".[2] Horne told the BBC that it was still "too early to say" who was behind the hacks.[2]

See also

[edit | edit source]

References

[edit | edit source]
  1. ↑ 1.00 1.01 1.02 1.03 1.04 1.05 1.06 1.07 1.08 1.09 Swati Khandelwal (2026-11-03). "New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food". The Hacker News. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  2. ↑ 2.0 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 Liv McMahon and Chris Vallance (2026-11-03). "UK meat industry hit by cyber-attack which targeted European supermarket freezers". BBC News. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  3. ↑ 3.0 3.1 3.2 Reuters (2026-10-15). "Les assurances cyber des supermarchés français ne devraient pas couvrir les pertes de denrées, selon les assureurs". Zonebourse (in français). Archived from the original on 2026-10-17. Retrieved 2026-11-03. {{cite web}}: |author= has generic name (help)
  4. ↑ 4.0 4.1 4.2 4.3 4.4 4.5 Stan Hulsen (2026-11-02). "Ook koelsystemen in Nederland aangevallen, bij 17 bedrijven temperatuur aangepast". NOS (in Nederlands). Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  5. ↑ 5.0 5.1 5.2 5.3 5.4 5.5 5.6 5.7 5.8 "Fridge cyberattack hits supermarkets across Europe". Agence France-Presse. 2026-11-03. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  6. ↑ 6.0 6.1 6.2 6.3 6.4 6.5 Jon Henley (2026-11-02). "Shop fridges and freezers across Europe hit by fresh suspected cyber-attack". The Guardian. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  7. ↑ 7.0 7.1 7.2 7.3 7.4 7.5 7.6 7.7 "LIVE Europese Commissie vergaderde over cyberaanval, supermarkten van Delhaize draaien zoals normaal". VRT NWS (in Nederlands). 2026-11-02. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  8. ↑ Jonathan Benton and AFP (2026-11-03). "Which countries in Europe have been hit by supermarket fridge cyber incidents?". Euronews. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  9. ↑ "The secret behind Danfoss adaptive defrost". Danfoss. 2020-05-04. Archived from the original on 2026-10-15. Retrieved 2026-11-03.
  10. ↑ Robert Booth and Miatta Mbriwa (2026-11-02). "Who is hacking Europe's supermarket fridges and freezers, and why?". The Guardian. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  11. ↑ 11.0 11.1 11.2 11.3 11.4 James Gregory (2026-11-02). "Shop freezers in seven European countries hit by cyber-attack". BBC News. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  12. ↑ 12.0 12.1 12.2 12.3 12.4 12.5 12.6 "Hackers raised freezer temperature at Selver supermarket to +50°C". ERR News. 2026-11-02. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  13. ↑ 13.0 13.1 Belga (2026-11-02). "Sabcobel, la société derrière les frigos touchés par l'attaque d'ampleur, communique sur le mode opératoire des "pirates"". La Libre Belgique (in français). Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  14. ↑ 14.0 14.1 Reuters (2026-11-02). "New cyberattack on supermarket fridges sweeps across Europe". Business Insurance. Archived from the original on 2026-11-02. Retrieved 2026-11-03. {{cite web}}: |author= has generic name (help)
  15. ↑ 15.0 15.1 15.2 Michaël Torfs (2026-11-02). "Na cyberaanval op koelsystemen in Belgische supermarkten: hoe kan dat? En wie zit hierachter?". VRT NWS (in Nederlands). Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  16. ↑ 16.0 16.1 Ian Curran (2026-11-02). "SuperValu says issues after cyberattack on its fridge systems 'fully resolved'". The Irish Times. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  17. ↑ Eleanor Burnhill (2026-11-02). "Issues with refrigeration systems at 13 SuperValu stores after hack now resolved". RTÉ News. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  18. ↑ Edvin Borg, Isidor Beslic and Ellen Larsson (2026-11-02). "Butiker inom Ica och Coop drabbade i misstänkt hackerattack". Dagligvarunytt (in svenska). Retrieved 2026-11-03.
  19. ↑ 19.0 19.1 Kati Siponmaa, Mia Gertsch, Pauliina Happo and Sari Pöyhönen (2026-11-02). "K-kauppojen kylmä­laitteissa ilmeni häiriötä samaan aikaan – hakkerointia ei voida poissulkea". Yle (in suomi). Archived from the original on 2026-11-02. Retrieved 2026-11-03. {{cite web}}: soft hyphen character in |title= at position 18 (help)CS1 maint: multiple names: authors list (link)
  20. ↑ 20.0 20.1 Johannes Tralla (2026-11-03). "State IT authority spokesperson: Motives for Selver fridge hack not yet known". ERR News. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  21. ↑ Bethan Grylls (2026-11-02). "Meat suppliers and retailers hit by suspected cyberattack". Food Manufacture. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  22. ↑ Sai Molige (2026-10-22). "Cold Chain, Open Control: Exposed Refrigeration Systems Reveal Global Risk". Forescout. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  23. ↑ Simon Ormiston (2026-11-02). "Supermarket hacks across Europe: why are fridges connected to the internet?". Euronews. Retrieved 2026-11-03.
  24. ↑ 24.0 24.1 Jonathan Benton and Pascale Davies (2026-11-02). "Cyberattacks hit supermarket fridges and freezers in Europe, Belgium launches investigation". Euronews. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  25. ↑ Zeljka Zorz (2026-11-02). "Second wave of refrigeration cyberattacks hits European supermarkets". Help Net Security. Retrieved 2026-11-03.
  26. ↑ 26.0 26.1 Anna Ribeiro (2026-11-02). "Hackers manipulate supermarket freezer temperatures across Europe, exposing weaknesses in connected OT systems". Industrial Cyber. Archived from the original on 2026-11-02. Retrieved 2026-11-03.
  27. ↑ 27.0 27.1 27.2 "Danfoss moves to mitigate cyberattack". Cooling Post. 2026-10-12. Archived from the original on 2026-10-15. Retrieved 2026-11-03.
  28. ↑ 28.0 28.1 "Tech Insider October 2025". Danfoss. 2025-10-31. Archived from the original on 2026-10-13. Retrieved 2026-11-03.
  29. ↑ 29.0 29.1 Florian Bayard (2026-10-22). "Cyberattaque contre les frigos de supermarchés : on sait enfin ce qu'il s'est vraiment passé". 01net (in français). Retrieved 2026-11-03.
  30. ↑ Joanna R. Turpin (2026-10-16). "Massive Cyberattack Targets Refrigeration Systems at French Supermarkets". The ACHR News. Archived from the original on 2026-10-24. Retrieved 2026-11-03.
  31. ↑ 31.0 31.1 "Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération" (in français). CERT-FR. 2026-10-12. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  32. ↑ 32.0 32.1 "Warning: Security Incidents in France Targeting Remote Controllers of Refrigeration Installations, patch immediately!". Centre for Cybersecurity Belgium. 2026-10-13. Archived from the original on 2026-10-14. Retrieved 2026-11-03.
  33. ↑ 33.0 33.1 AFP (2026-11-02). "Une cyberattaque frappe des réfrigérateurs à travers l'Europe". Boursorama (in français). Retrieved 2026-11-03.
  34. ↑ Safine Hadri and Alexis Valençon (2026-11-03). "Cyberattacks on refrigeration systems: physical damage coverage gaps". Kennedys. Retrieved 2026-11-03.
  35. ↑ 35.0 35.1 35.2 Alexander Martin (2026-11-02). "Second wave of suspected cyberattacks hits supermarket freezers across Europe". The Record from Recorded Future News. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
  36. ↑ Bill Toulas (2026-11-02). "Hackers disrupt refrigeration systems at European supermarkets". BleepingComputer. Retrieved 2026-11-03.
  37. ↑ Amy Campbell (2026-11-02). "SuperValu among several supermarkets hit by Europe-wide cyberattack". Irish Examiner. Archived from the original on 2026-11-03. Retrieved 2026-11-03.
Retrieved from "https://consumerrights.wiki/index.php?title=User:Louis/European_supermarket_refrigeration_cyberattacks_November_2026&oldid=71800"