Cyberattacks sabotage supermarket refrigeration across Europe, destroying food and causing millions in losses

Attackers took remote control of supermarket refrigeration in Belgium, Luxembourg, Sweden, Ireland and Estonia overnight from 1 to 2 November 2026, setting freezers to 50°C and forcing stores to destroy meat, fish and frozen stock.

Danfoss, the Danish manufacturer whose controllers were compromised in the attack on French supermarkets on 11 and 12 October, confirmed to DR that its products were involved in the incidents reported across several European countries. The company named the AK-SM 800 and AK-SC 355, the same two models hit in France. Neither has received a security update since Danfoss retired them in 2021 and 2016.

CERT-FR, the French government's computer emergency response team, told every operator of those controller families on 12 October to disconnect them from the internet or filter access. Danfoss sent its own warning to customers on 13 October. Three weeks later, controllers still reachable from the internet were hit in at least six more countries, and a Danfoss spokesman in the Netherlands told the broadcaster NOS that the attacks could have been avoided if stores had followed that warning.

Christophe Hansen, the European Commissioner for Agriculture and Food, said the attacks were a deliberate attempt to disrupt food supplies in the EU and undermine public confidence, and that Europe's food security was not currently at risk. Belgium's federal prosecutor opened a criminal investigation. No group has claimed responsibility, no ransom has been demanded and no authority has attributed either wave.

The night

Technicians from Sabcobel, the Belgian refrigeration company that installs and maintains Delhaize's systems, were called out from about 1am on 2 November to cut compromised installations off from the network, chief executive Stephan Moelans told Belga. At about 2.30am the manager of the Delhaize supermarket in Eeklo, in East Flanders, received an alert that freezer and fridge temperatures had been changed. The freezers had been set to 50°C, she told VRT, and she drove to the store in the middle of the night to reset the system.

Delhaize issued an internal alert about sudden temperature rises at about 4am, VRT reported. By morning, temperatures in fridges and freezers at affected Delhaize stores had climbed to about 15°C. One store owner south of Antwerp told Reuters he found his fridges at 18°C and called the police.

Staff at ICA Kvantum in Sjöbo, in southern Sweden, found that morning that the freezers had been set to plus 50 degrees. Store manager Rickard Nilsson told TV4 that staff could not adjust or change the temperatures and that heat was blowing into the freezers. The store stayed shut on Monday morning. At an ICA store on Odengatan in Stockholm, a notice told customers that every freezer in the shop was broken because of a cyberattack. In Ireland, Musgrave said its monitoring systems raised the alert and the company acted at once.

Belgium and Luxembourg

About 40 Delhaize stores in Flanders and Wallonia were affected, along with 15 Carrefour stores, five Spar stores, 15 Intermarché stores, the butchery chain De Laet en Van Haver and the IKEA store in Mons. Yle put the Belgian total at about 75 stores. Delhaize stores in Boortmeerbeek, Sint-Truiden, Dendermonde, Sint-Amandsberg, Hoepertingen, Overijse and on the Kouter in Ghent were among those hit, VRT and RTL Info reported. Delhaize, which runs about 818 stores in Belgium and 65 in Luxembourg, said an IT incident had affected refrigeration in several dozen stores in both countries and that it was investigating.

The federal prosecutor confirmed to VRT that it had opened a criminal investigation. Interior Minister Bernard Quintin said there was no problem with food supply.

Mich Vergauwen, spokesman for Carrefour Belgium, said: "It's a cyberattack, there is no other reason." Carrefour told ABC News that 15 of its 700 stores were affected, that all remained open and that the problem concerned a few units, mainly freezers. Colruyt, which runs Spar in Belgium under a franchise system, said five independently operated shops had their refrigeration attacked.

The operator of the Delhaize in Hoeilaart put the damage at no less than €100,000, excluding lost takings, and kept the store shut until noon. At Proxy Delhaize in Hoepertingen, in Limburg, freezer temperatures rose from -22°C to 15°C and manager Gerte Bouchet estimated that at least €60,000 of food was thrown away. The Eeklo store lost tens of thousands of euros of stock, mostly meat and fish, and stayed closed all morning. Proxy Delhaize in Grembergen avoided serious losses after staff intervened early, HLN reported.

Katrien Eggers, spokesperson for CCB, Belgium's national cybersecurity centre, said the agency was aware of an incident but had no further information. CCB told Belga it may never become clear who carried out the attack.

Sweden

Sweden's national cybersecurity centre said it was responding to several incidents at ICA and Coop stores. Carlos Cancino, Coop's press chief, told Dagens Nyheter that seven of the chain's 800 stores were affected by a cyber incident involving unauthorised tampering with refrigeration. The affected stores belong to two regional consumer societies, Coop Mitt and Coop Nord. Coop told Reuters that Danfoss was among its suppliers and told ABC News that the incident came ahead of a system upgrade it had begun planning after the French attack.

ICA said its own IT systems were not affected. The incident hit a small number of stores that use an external supplier and connect outside ICA's central network, an ICA spokesperson told FoodNavigator. ICA stores in Sjöbo, Tomelilla, Böda, Brösarp and Sankt Olof were among those hit, Dagligvarunytt reported. Nilsson told TV4 the Sjöbo store lost food worth hundreds of thousands of kronor. The store said it could not guarantee its stock was safe because temperatures had risen sharply and then frozen again once the system was restored, and its refrigeration has since been disconnected from the internet.

John Billow, head of the national cybersecurity centre at FRA, Sweden's signals intelligence agency, told SVT that the centre had tried to draw attention to this type of vulnerability.

Ireland

Musgrave, which owns SuperValu, said refrigeration at 13 of its 223 stores was affected by a cyber incident confined to a specific model of equipment. Staff removed chilled and frozen products from sale as a precaution. Stores in Lucan, Blanchardstown, Waterford and Bray were among those hit, The Irish Times reported, with the cost expected to run to thousands of euros. Musgrave said it was working with the equipment suppliers and cybersecurity specialists and later said the problem had been resolved and restocking of chilled and frozen ranges was under way.

Utz Roedig, professor of computer science at University College Cork, told The Irish Times that direct financial gain is not usually the motive for incidents of this kind.

Estonia

Intruders reached the computer that controls refrigeration at a Selver supermarket early on Monday and set a refrigerated case to 50°C, ERR reported. Selver communications head Mariann Järvela told Postimees the chain had prepared after the attacks elsewhere, which let its contractor detect the intrusion quickly. Jann Mutso, chief executive of Kitman Coldtech, which monitors the store's refrigeration, told ERR the attackers had entered an older type of Danfoss controller, that Kitman responded within 10 minutes of the alarm and that no stock was lost. Mutso said other Estonian retailers had also been attacked. No second Estonian victim has been named.

The Netherlands, Denmark and Finland

A Danfoss spokesman told NOS that intruders changed temperature settings at refrigeration systems at no fewer than 17 Dutch businesses. The targets were butchers, neighbourhood shops and a frozen-food storage site, where the setpoint went from -20°C to -10°C before Danfoss intervened, IO+ reported. Albert Heijn said none of its stores had problems.

A Danish food producer's refrigeration was targeted, DR reported, and no Danish store has reported an incident. Danfoss communications director Kasper Elbjørn told DR in October that the company had been contacting customers worldwide by email, letter and telephone since the French attack to tell them to replace or update outdated systems.

Finnish authorities are examining overnight refrigeration faults at K-market stores in Helsinki and have not ruled out an attack. The faults lasted an hour or two, the store owners said, and the affected units were outside Kesko's central security monitoring. Juha Tretjakov of Finland's National Cyber Security Centre told STT that the centre had alerted Finnish retailers about two weeks earlier, when a few dozen refrigeration controllers in Finland were openly reachable from the internet, and that the new attacks targeted particular Danfoss models.

The UK's National Cyber Security Centre said it was working with international partners and industry to understand the incident. No British retailer has reported an attack.

How the attack worked

Each affected store runs its refrigeration from a central controller. One panel holds the setpoints for every display case and cold room, schedules defrost cycles, routes alarms and runs a web interface so that contractors can adjust equipment remotely. Defrost heats the evaporator coils to clear ice and normally runs for short scheduled periods. The intruders switched it on and left it running, with a setting of up to 50°C, so the heaters warmed the cabinets they were meant to protect.

Moelans told VRT that the attackers went directly into the refrigeration installations at individual stores and did not breach the systems of the installers. He told Belga the mechanism was the same as in France and that a software update alone would not close the vulnerability, because the installations need physical modifications that cost money. The simplest protection is to manage the controllers over a secure connection, he said, and most Sabcobel customers switched to one after the French attack. Sabcobel knows of about 20 affected units among the hundreds it manages in Belgium.

Danfoss said customers who had not updated their software were affected. Its advice to customers on 2 November was to make sure their systems are not directly reachable from the internet, DR reported. Neither CERT-FR nor Danfoss has named a specific vulnerability or CVE for either wave. In the French attack the intruders appear to have used no malicious code on the controllers, Félix Aimé, an analyst at the French security company Sekoia and a former ANSSI official, told CNN, which leaves investigators with fewer traces to follow. An ethical hacker, Nys, told VRT there was no reason for refrigeration installations to be publicly reachable on the internet at all.

Why the controllers were still exposed

Danfoss declared the AK-SM 800 end of life in May 2021 and phased out the AK-SC 355 in 2016. In an October 2025 newsletter it said it would end all services for older products and told customers to plan replacements. The same newsletter recorded attacks in 2022 on 16 Russian supermarkets and 40 Israeli stores that ran the AK-SM 800 without a firewall or VPN. Danfoss fixed flaws in the newer AK-SM 800A, found by Claroty, in version 4.3.1 in 2025.

More than 1,700 instances of the affected Danfoss software were exposed to the internet in France before the October attack, Aimé told CNN. Claroty's Team82 research group counted 2,765 AK-SM 800A interfaces reachable from the public internet in August 2026. Forescout published a scan on 22 October, 10 days after the French attack, that found 12,976 exposed refrigeration management services on 6,017 IP addresses in 99 countries and territories.

Moelans told VRT the Belgian impact was relatively limited because Sabcobel had contacted its supermarket customers after the French attack. Selver had prepared and lost no stock. Coop Sweden was still planning its upgrade when its stores were hit, and the ICA stores that were attacked sat outside the chain's central network with their own external supplier.

Who is responsible

No hacktivist group has claimed either wave and no criminal group has demanded payment, which puzzled French investigators in October, a source with knowledge of the Paris inquiry told Reuters. Tom Hegel, a researcher at the security company SentinelOne, told Reuters that attacks of this kind are usually linked to extortion, political motives or state operations, and that the absence of financial demands points to sabotage. The European Commission said the incidents showed digital threats becoming increasingly disruptive.

The Paris prosecutor's cybercrime section and the national anti-cybercrime office OFAC have investigated the French attack since 12 October and have made no public finding on the intruders. Ahold Delhaize separately reported a cybersecurity incident to Dutch police in October that disrupted online services at Albert Heijn and Delhaize, and Dutch authorities said they saw no link between that incident and the French attack.

Refrigeration failures at about a dozen U.S. military commissaries in late August 2026 caused food losses, Reuters reported in October. U.S. Defense Department officials are investigating whether Iran-backed hackers compromised freezer units on military bases, TechCrunch reported. No government has linked the commissary failures to the attacks in Europe.

The October attack

Attackers switched refrigeration at hundreds of French supermarkets to continuous defrost overnight from 11 to 12 October, with a setting of up to 50°C for about six hours. Intermarché said 150 to 200 of its stores were hit, Coopérative U 80, Carrefour about 80 and Monoprix about 30, and French police later put the total at as many as 700 stores. Thierry Cotillard, chief executive of Intermarché, told BFM TV the attack caused losses of tens of millions of euros across France in a single day, and the Paris prosecutor's office said the reported damage included fires. On 13 October CERT-FR extended its alert to Copeland XWEB and Dixell XWEB controllers and said the campaigns were probably still active.

The recovery guidance

CERT-FR's alert CERTFR-2026-ALE-012 told operators of AK-SM and AK-SC controllers to disconnect them from the internet or restrict access, and said exposing a management interface directly to the internet was contrary to good practice. For a controller suspected of compromise, the alert sets out six steps: restrict network access to service providers, perform a factory reset, apply available security fixes, change passwords, check accounts and reconfigure the device completely, with remote access restored only through a secure VPN after the configuration is verified. A controller cut off from the internet keeps running its programmed setpoints, defrost schedules and local alarms, because control of compressors and cases sits on the store panel.

The open questions

Stores still running the AK-SM 800 or AK-SC 355 cannot patch them. Danfoss stopped updating the first in 2021 and the second in 2016, and the only protection left is to take them off the internet or replace them. Neither Danfoss nor any government has said how many are still in use in Europe or how the attackers got into them. French and Belgian investigators have not named a suspect and no hacker has taken credit yet.