Europe’s Supermarket Refrigeration Cyberattacks: What Happened and How

As of November 2, 2026. This is a developing story and reported figures are changing as more retailers come forward.

Executive Summary: On November 2, 2026, grocery retailers in at least nine European countries reported overnight refrigeration disruptions, according to Agence France-Presse. Several retailers confirmed cyber incidents and some pulled chilled or frozen products from sale, while others, including Finland’s Kesko, were still investigating temperature anomalies. The affected countries were Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, and Sweden. The disruptions came about three weeks after an attack on refrigeration controllers at hundreds of supermarkets in France. Whether the two waves are connected remains unconfirmed. Public access clues so far point to unsecured networks, default passwords, cellular connectivity, and contractor-managed systems, placing the incidents in the category of connected-device security problems that enterprise security teams have warned about for years.

On November 2, 2026, grocery retailers in at least nine European countries reported overnight refrigeration disruptions, according to Agence France-Presse. Several retailers confirmed cyber incidents, and some pulled chilled or frozen products from sale. The disruptions came three weeks after an attack on refrigeration controllers in France. Whether the two waves were connected remains unconfirmed.

EU food and agriculture commissioner Christophe Hansen said the bloc was taking the incidents “very seriously” and described them as “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it.” That is an assessment of intent, not an attribution of identity. As of this writing, no one has claimed responsibility, and investigators have not named an operator.

Where the Refrigeration Disruptions Were Reported

The incidents landed overnight into Monday, November 2, across at least nine countries: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, and Sweden. Reuters separately tracked more than 100 stores reporting refrigeration problems, a figure that comes from a different tally than the country count.

In Sweden, Coop reported disruptions at a small number of its roughly 800 stores, with figures varying across outlets. ICA said a limited number of its locations saw temperature anomalies, including one freezer that reached 55°C.

In Ireland, Musgrave Group confirmed a cyber incident involving refrigeration at 13 SuperValu stores and removed some chilled and frozen products from sale.

In Belgium and Luxembourg, Carrefour reported problems at about 15 of its more than 700 stores, Ahold Delhaize described an overnight IT incident affecting dozens of locations, and Colruyt and other retailers reported refrigeration issues. An IKEA store in Mons, Belgium, was affected. Four Delhaize outlets in Luxembourg reported problems.

In Italy, AFP reported that at least four Coop supermarkets in Sicily and one business in Tuscany were affected. In Portugal, Mosqueteiros confirmed incidents at seven Intermarché stores and said the attack appeared to target an external provider that managed their refrigeration systems.

In the Netherlands, at least 17 businesses, mainly butcher shops and small grocers, had temperature settings changed. Major Dutch supermarket chains were not reported affected. In Estonia, one store was affected and the incident was resolved within minutes. Finland’s Kesko reported temperature anomalies at a few smaller stores and said interference through network connections had not yet been ruled out.

Belgian federal prosecutors have opened an investigation, and Italy’s government planned a cybersecurity meeting. Belgium’s Centre for Cybersecurity said the attacker’s identity was unknown.

The French Precedent and the Controllers Involved

The October attack in France provides the clearest technical picture of this class of incident. France’s national cybersecurity agency issued a CERT-FR alert bulletin (CERTFR-2026-ALE-012), dated October 12 to 13, 2026, documenting a security incident targeting remote controllers of refrigeration systems.

The equipment named in that advisory included Danfoss AK-SM800 and AK-SC355 controllers, along with Copeland and Dixell XWEB systems. These are commercial refrigeration controllers, which is to say programmable industrial devices that let a technician monitor compressors, change temperature setpoints, and manage defrost cycles from a remote console. Both Danfoss models were already end of life. The AK-SC355 was retired in 2016 and the AK-SM800 in 2021. A patched software release for the AK-SM800A series shipped in August 2025, and only units not updated to that release were affected.

The remote access is the design intent. One technician services equipment across dozens of sites without visiting each one. The same functions become destructive when an unauthorized party reaches the management interface. In France, controllers were set to unusual defrost cycles with product still inside, which delayed alarms long enough for temperatures to drift. Many units climbed to 50°C within six hours, one Normandy site reached 80°C, and some equipment caught fire, triggering sprinkler water damage.

Three Separate Access Clues, Not One Confirmed Exploit

The public evidence from the November wave points to several different access paths, and it is important to keep them separate rather than merge them into a single story.

A Danfoss spokesperson told Dutch public broadcaster NOS that the affected systems in the Netherlands were on unsecured networks and still used default passwords. Danfoss had advised its Dutch clients on October 13 to disconnect their systems from the internet and reconnect only through a secure network. According to the spokesperson, “Most stores took action at that time, but a small number did not,” and the attack “could have been prevented” had those measures been in place.

Separately, Coop in Sweden reported that some affected refrigeration equipment ran on a 4G cellular connection. In Portugal, Mosqueteiros pointed to a suspected external-provider target, meaning the contractor that managed the refrigeration systems rather than the retailer’s own network.

These are three distinct findings from three different retailers. None of them, on its own, establishes a single confirmed exploit across every incident, and the reporting does not support the claim that 4G was the entry point or that one vulnerability explains the whole November wave. What they share is a pattern: operational technology commissioned by refrigeration contractors, connected through networks the facilities team arranged, and often left without the hardening a point-of-sale system or an ERP would receive.

The Portuguese case is the cleanest illustration of why contractor access belongs on the asset and access inventory. If an external provider can reach a refrigeration console remotely, that provider’s access is part of the retailer’s attack surface, whether or not the retailer’s own IT team manages it.

From Setpoint Change to Food Loss in Hours

The operational cost arrived before any forensic report. Staff found temperatures outside spec and had to decide, product by product, what could stay on sale. Musgrave’s decision to remove some chilled and frozen stock across 13 Irish stores is the clean version of that call. Pull it, apologize, restock.

A Belgian butcher told Reuters that his refrigerators reached 18°C, the temperature he reported finding in his units, and he estimated roughly €15,000 in meat losses. That 18°C reading is a measured cold-room temperature, which is a different claim from a configured controller setpoint or a measured internal food temperature. Preserving that distinction matters for accurate internal reporting. All three types of number tend to get quoted interchangeably in early coverage, and they are not the same thing.

The slower cost is customer trust. A shopper who sees freezer cases roped off twice in a month plans around a different store next week.

What Retail Security Teams Should Validate Now

The useful work for a retail IT, facilities, and food safety team is specific and testable. Each item below is a control a security validation or breach and attack simulation program could check against a live refrigeration environment, ideally in a tabletop or test setup for anything that could interrupt active cooling.

• Inventory every refrigeration controller and cellular gateway by store, model, firmware version, and remote access method. Include units installed and managed by third-party contractors.
• Remove public internet exposure for management interfaces. If a controller can be reached from the open internet, assume someone has already found it.
• Replace default credentials across every controller and management console, and rotate them on a schedule.
• Require phishing-resistant multi-factor authentication for contractor and vendor remote access. Single-password portals are not enough.
• Segment the refrigeration network away from guest Wi-Fi, point-of-sale, and corporate IT. A flat network is a shared blast radius.
• Confirm temperature alarms route to a human on duty, verify who that person is after hours, and confirm who has the authority and access to act on an alert.
• Deploy an independent temperature sensor on critical cases. If a controller misreports its setpoint, a separate probe still reports the truth.
• Plan replacement for unsupported, end-of-life controllers. Legacy connected-device debt is the lowest-hygiene attack surface in most food retail environments.

UK Exposure: A Short FAQ

Was a UK supermarket hit in this wave? Reviewed reporting through November 2 did not identify a British supermarket affected.

Is the UK doing anything about it? The UK’s National Cyber Security Centre said it was working with partners to understand the incidents.

Does the attack pattern apply to UK retail? Yes. The controller models named in the French CERT-FR advisory are deployed across UK and Irish retail estates, and the access clues from the European incidents are not border-specific.

Where This Leaves Food Retail Security

Commercial refrigeration moved from a facilities concern to a cybersecurity concern in two incident waves over three weeks. The controllers often sat in a service blind spot, maintained by whoever installed them, reachable over connections that rarely met an IT asset inventory or a vulnerability scanner. The French attack in October and the European wave on November 2 forced that blind spot into view.

The question for security leaders is no longer whether supermarket refrigeration can be reached remotely. It can. The real question is operational: if someone changes a defrost setting at 2 a.m., will a separate sensor detect the temperature rise and alert someone who can act before the store has to pull stock?

Key Takeaways

• Grocery retailers in at least nine European countries (Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, and Sweden) reported overnight refrigeration disruptions on November 2, 2026, per AFP. The figure was still rising as more retailers came forward.
• Several retailers confirmed cyber incidents and pulled product from sale, while others, including Finland’s Kesko, were still investigating temperature anomalies. The count is a tally of countries with reports, not a confirmed single attack.
• The access clues are three separate findings, not one exploit: default passwords on unsecured Dutch networks (Danfoss to NOS), 4G connectivity at some Swedish Coop stores, and a suspected external-provider target in Portugal.
• Contractor-managed access is part of the attack surface. If an outside provider can reach a refrigeration console, that access belongs on the asset and access inventory.
• The October CERT-FR advisory (CERTFR-2026-ALE-012) named end-of-life Danfoss AK-SM800 and AK-SC355 controllers plus Copeland and Dixell XWEB systems. A patched release existed; unpatched and retired units were exposed.
• A configured controller setpoint, a measured cold-room temperature, and a measured internal food temperature are three different claims. Keep them distinct in any internal reporting.
• EU agriculture commissioner Christophe Hansen called the wave “a deliberate attempt to disrupt our food supply chain.” That is an assessment of intent. The attacker’s identity, and any link to the French attack, remain unconfirmed.
• The highest-leverage controls are inventory, removing public exposure, credential rotation, phishing-resistant MFA, network segmentation, independent temperature sensing, verified after-hours alarm routing, and replacement of end-of-life controllers.