As of November 2, 2026. This is a developing story and reported figures are changing as more retailers come forward.
Executive Summary: On November 2, 2026, grocery retailers in at least nine European countries reported overnight refrigeration disruptions, according to Agence France-Presse. Several retailers confirmed cyber incidents and some pulled chilled or frozen products from sale, while others, including Finland’s Kesko, were still investigating temperature anomalies. The affected countries were Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, and Sweden. The disruptions came about three weeks after an attack on refrigeration controllers at hundreds of supermarkets in France. Whether the two waves are connected remains unconfirmed. Public access clues so far point to unsecured networks, default passwords, cellular connectivity, and contractor-managed systems, placing the incidents in the category of connected-device security problems that enterprise security teams have warned about for years.
On November 2, 2026, grocery retailers in at least nine European countries reported overnight refrigeration disruptions, according to Agence France-Presse. Several retailers confirmed cyber incidents, and some pulled chilled or frozen products from sale. The disruptions came three weeks after an attack on refrigeration controllers in France. Whether the two waves were connected remains unconfirmed.
EU food and agriculture commissioner Christophe Hansen said the bloc was taking the incidents “very seriously” and described them as “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it.” That is an assessment of intent, not an attribution of identity. As of this writing, no one has claimed responsibility, and investigators have not named an operator.
The incidents landed overnight into Monday, November 2, across at least nine countries: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, and Sweden. Reuters separately tracked more than 100 stores reporting refrigeration problems, a figure that comes from a different tally than the country count.
In Sweden, Coop reported disruptions at a small number of its roughly 800 stores, with figures varying across outlets. ICA said a limited number of its locations saw temperature anomalies, including one freezer that reached 55°C.
In Ireland, Musgrave Group confirmed a cyber incident involving refrigeration at 13 SuperValu stores and removed some chilled and frozen products from sale.
In Belgium and Luxembourg, Carrefour reported problems at about 15 of its more than 700 stores, Ahold Delhaize described an overnight IT incident affecting dozens of locations, and Colruyt and other retailers reported refrigeration issues. An IKEA store in Mons, Belgium, was affected. Four Delhaize outlets in Luxembourg reported problems.
In Italy, AFP reported that at least four Coop supermarkets in Sicily and one business in Tuscany were affected. In Portugal, Mosqueteiros confirmed incidents at seven Intermarché stores and said the attack appeared to target an external provider that managed their refrigeration systems.
In the Netherlands, at least 17 businesses, mainly butcher shops and small grocers, had temperature settings changed. Major Dutch supermarket chains were not reported affected. In Estonia, one store was affected and the incident was resolved within minutes. Finland’s Kesko reported temperature anomalies at a few smaller stores and said interference through network connections had not yet been ruled out.
Belgian federal prosecutors have opened an investigation, and Italy’s government planned a cybersecurity meeting. Belgium’s Centre for Cybersecurity said the attacker’s identity was unknown.
The October attack in France provides the clearest technical picture of this class of incident. France’s national cybersecurity agency issued a CERT-FR alert bulletin (CERTFR-2026-ALE-012), dated October 12 to 13, 2026, documenting a security incident targeting remote controllers of refrigeration systems.
The equipment named in that advisory included Danfoss AK-SM800 and AK-SC355 controllers, along with Copeland and Dixell XWEB systems. These are commercial refrigeration controllers, which is to say programmable industrial devices that let a technician monitor compressors, change temperature setpoints, and manage defrost cycles from a remote console. Both Danfoss models were already end of life. The AK-SC355 was retired in 2016 and the AK-SM800 in 2021. A patched software release for the AK-SM800A series shipped in August 2025, and only units not updated to that release were affected.
The remote access is the design intent. One technician services equipment across dozens of sites without visiting each one. The same functions become destructive when an unauthorized party reaches the management interface. In France, controllers were set to unusual defrost cycles with product still inside, which delayed alarms long enough for temperatures to drift. Many units climbed to 50°C within six hours, one Normandy site reached 80°C, and some equipment caught fire, triggering sprinkler water damage.
The public evidence from the November wave points to several different access paths, and it is important to keep them separate rather than merge them into a single story.
A Danfoss spokesperson told Dutch public broadcaster NOS that the affected systems in the Netherlands were on unsecured networks and still used default passwords. Danfoss had advised its Dutch clients on October 13 to disconnect their systems from the internet and reconnect only through a secure network. According to the spokesperson, “Most stores took action at that time, but a small number did not,” and the attack “could have been prevented” had those measures been in place.
Separately, Coop in Sweden reported that some affected refrigeration equipment ran on a 4G cellular connection. In Portugal, Mosqueteiros pointed to a suspected external-provider target, meaning the contractor that managed the refrigeration systems rather than the retailer’s own network.
These are three distinct findings from three different retailers. None of them, on its own, establishes a single confirmed exploit across every incident, and the reporting does not support the claim that 4G was the entry point or that one vulnerability explains the whole November wave. What they share is a pattern: operational technology commissioned by refrigeration contractors, connected through networks the facilities team arranged, and often left without the hardening a point-of-sale system or an ERP would receive.
The Portuguese case is the cleanest illustration of why contractor access belongs on the asset and access inventory. If an external provider can reach a refrigeration console remotely, that provider’s access is part of the retailer’s attack surface, whether or not the retailer’s own IT team manages it.
The operational cost arrived before any forensic report. Staff found temperatures outside spec and had to decide, product by product, what could stay on sale. Musgrave’s decision to remove some chilled and frozen stock across 13 Irish stores is the clean version of that call. Pull it, apologize, restock.
A Belgian butcher told Reuters that his refrigerators reached 18°C, the temperature he reported finding in his units, and he estimated roughly €15,000 in meat losses. That 18°C reading is a measured cold-room temperature, which is a different claim from a configured controller setpoint or a measured internal food temperature. Preserving that distinction matters for accurate internal reporting. All three types of number tend to get quoted interchangeably in early coverage, and they are not the same thing.
The slower cost is customer trust. A shopper who sees freezer cases roped off twice in a month plans around a different store next week.
The useful work for a retail IT, facilities, and food safety team is specific and testable. Each item below is a control a security validation or breach and attack simulation program could check against a live refrigeration environment, ideally in a tabletop or test setup for anything that could interrupt active cooling.
Was a UK supermarket hit in this wave? Reviewed reporting through November 2 did not identify a British supermarket affected.
Is the UK doing anything about it? The UK’s National Cyber Security Centre said it was working with partners to understand the incidents.
Does the attack pattern apply to UK retail? Yes. The controller models named in the French CERT-FR advisory are deployed across UK and Irish retail estates, and the access clues from the European incidents are not border-specific.
Commercial refrigeration moved from a facilities concern to a cybersecurity concern in two incident waves over three weeks. The controllers often sat in a service blind spot, maintained by whoever installed them, reachable over connections that rarely met an IT asset inventory or a vulnerability scanner. The French attack in October and the European wave on November 2 forced that blind spot into view.
The question for security leaders is no longer whether supermarket refrigeration can be reached remotely. It can. The real question is operational: if someone changes a defrost setting at 2 a.m., will a separate sensor detect the temperature rise and alert someone who can act before the store has to pull stock?
Executive Summary: On October 29, 2026, Binance was hit by the largest cryptocurrency theft on…
Cloud-based file transfer has made it easier than ever for businesses to move large amounts…
Executive Summary: Search “navy data exfiltration” and two completely different categories of results come back.…
Executive Summary: AI-powered attacks on data in motion are moving from theoretical to operational across…
The Federal Trade Commission is now actively investigating OpenAI, Anthropic, and other AI companies over…
Remote and hybrid work have changed how businesses collaborate. Employees can now access company resources,…