Suspected Cyberattack Hits Supermarket Freezers Across Europe Weeks After France
Fridges and freezers at supermarkets in Belgium, Sweden, Luxembourg and Ireland warmed overnight, about three weeks after France. No group has claimed responsibility.
Choose Clash Report as a preferred source and see our reporting first in Top Stories.
Fridges and freezers at dozens of supermarkets in Belgium, Luxembourg and Sweden warmed up overnight on Nov. 1–2. Delhaize calls it an “IT incident,” and one Swedish store says it was hacked, Reuters reports.
The incidents come about three weeks after a cyberattack heated fridges at hundreds of French supermarkets. Sources describe a similar method, but no source reviewed says the same attackers are behind both.
Ireland’s SuperValu and an Estonian chain also report fridge incidents. Nobody has claimed responsibility for any of them, in the sources reviewed.
What Happened on Nov. 2
In Belgium, Delhaize says about 40 of its stores were hit, in both Flanders and Wallonia. Carrefour Belgium reports 15 stores, and the Colruyt Group says five independent Spar shops were affected, DutchNews reports.
The butcher chain De Laet & Van Haver also saw alarms at about 3 a.m. Its operations lead, Werner Muylle, says the evaporators had been switched to defrost mode. Staff paused the system before the fridges got too hot, Brussels Times reports.
Delhaize warned store managers around 4 a.m., and some stores called in refrigerated lorries. The chain says it disconnected the refrigeration systems from the internet. Shops in Luxembourg were also hit, DutchNews says.
Reported temperatures vary widely. RTL Info cites about 15°C, mainly in freezers, while some reports say 70°C. A Delhaize spokeswoman could not confirm the higher figure, HLN reports.
The cost is already visible. One Delhaize store in Hoepertingen threw away about €60,000 of food, its manager told Het Nieuwsblad, as quoted by HLN.
What Happened in Sweden, Ireland and Estonia
In Sweden, ICA says a “limited number” of stores were hit overnight. The affected stores’ connections sit outside ICA’s central network, spokesman Gustaf Nilsson says. Six Coop stores in Gästrikland and Hälsingland were also affected, Anadolu reports, citing SVT.
One ICA store in Sjöbo says its freezers were set to 50°C, RTBF reports. On Öland, a store manager found a 55°C reading in his freezer and spoiled food, Anadolu says.
In Ireland, Musgrave pulled chilled and frozen food from 13 SuperValu stores after a “cyber incident.” It says the impact was limited to a “specific model” of refrigeration equipment, The Irish Times reports.
In Estonia, Kitman Coldtech says attackers accessed an older Danfoss controller at a large chain. They set a freezer to 50°C, ERR reports.
“The signature is the same,” Kitman CEO Jann Mutso says. A response within 10 minutes limited the damage.
What Happened in France
Attackers took control of refrigeration controllers on the night of Oct. 11, forcing some units to heat to 50°C. Hundreds of stores were hit, and some food was thrown away, BBC reports.
The tally differs by source. Retailers’ own figures suggest about 400 stores, the BBC says. Finance Minister Roland Lescure put it at about 700 of 10,000 supermarkets, AP reports.
Chains named include Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc. Intermarché says its fridges ran at 50°C for six hours. Small fires were reported in some stores, BBC says.
France’s cyber agency said it was aware of “numerous compromises” of remote-control modules from Danfoss and U.S.-based Copeland, AP reports. The Paris prosecutor opened a cybercrime investigation into the “large-scale” attack.
What Is Known About the Equipment
Danfoss, a Danish maker, says most affected French units were older models that no longer receive security updates. It says it has “long advised” customers to keep systems updated and run them behind a firewall, AP reports.
The controllers let maintenance firms manage a store’s cold units remotely. French alerts told operators to disconnect them from the internet or filter access tightly, The Hacker News reports.
Whether Belgian and Swedish stores use the same Danfoss equipment is not yet clear, DutchNews notes. Sabcobel, a Belgian refrigeration installer, says the mechanism is “exactly” the same as in France, as quoted by HLN.
Many devices remain exposed. Reuters found at least 4,500 Danfoss interfaces visible online days after the French attack, CNA reports. RTL Z found 57 vulnerable Dutch systems, DutchNews notes.
Who Is Behind It
No group or individual has claimed the French attack, and no ransom demand has been reported, CNN reports. The silence puzzled investigators, a source told Reuters.
Analysts offer cautious views. Félix Aimé of Sekoia says a lone hacker or hacktivist group cannot be ruled out. Ken Munro of Pen Test Partners says it could be “kids messing around.”
No claim or attribution has surfaced for the Nov. 2 incidents in the sources reviewed. Delhaize is investigating, and Musgrave says it is working with equipment suppliers and cybersecurity specialists.
Delhaize’s parent, Ahold Delhaize, reported a separate cyberattack in October that shut down IT systems. The Dutch cyber watchdog said it saw no link to the French attack, Euronews reported. Delhaize is checking whether that attack relates to Nov. 2, DutchNews says.
Why It Matters
The incidents hit food safety rather than data. Retailers pull anything they cannot guarantee, so a few hours of heat means lost stock.
After the French hack, EU Food Commissioner Christophe Hansen said that “the weaponisation of food has become a reality,” BBC reports. That is his framing, and investigators have not named a motive.
Disruptive cyber incidents are not new for European business. A 2026 attack on Jaguar Land Rover halted global production, Clash Report reported. The supermarket cases show how an exposed controller can reach the cold chain.
Key Questions
Is it confirmed as a cyberattack? Retailers in Belgium and Ireland say “IT incident” or “cyber incident.” A Swedish store and Estonia’s Kitman say hacking. Investigators have not published findings on Nov. 2.
Is it the same attack as in France? Installers describe the same mechanism and signature. That does not prove the same culprit. Sources reviewed offer no evidence on that.
Is the food on shelves safe? Delhaize and Musgrave removed products that could be affected. Musgrave says items still on sale were stored at safe temperatures.
Choose Clash Report as a preferred source and see our reporting first in Top Stories.