Refrigeration failures across European supermarkets are exposing a largely overlooked dimension of cyber risk: the ability of attackers to disrupt physical operations without necessarily compromising conventional corporate IT systems. On 2 November 2026, retailers in Sweden, Belgium, Luxembourg, Estonia and Ireland reported incidents affecting refrigerators and freezers, with several operators and technical service providers attributing the disruptions to cyberattacks. Temperature settings were reportedly manipulated, defrost cycles activated and large quantities of perishable food removed from sale. Coming just three weeks after similar attacks affected hundreds of French supermarkets, the incidents raise urgent questions about remote access security, ageing industrial controllers and the resilience of interconnected operational technology.

The disruption illustrates how cyber incidents can translate directly into physical and economic consequences. Unlike ransomware attacks that encrypt business data, interference with refrigeration control systems can affect equipment operation almost immediately. A manipulated temperature setting or extended defrost cycle may be sufficient to interrupt the cold chain, force the disposal of food products and temporarily close essential retail operations.

For Europe’s security industry, the significance extends well beyond supermarket refrigeration. Similar technology architectures are used in building automation, heating and ventilation systems, industrial installations and other remotely managed infrastructure. As more operational equipment becomes connected to corporate networks and external service platforms, the boundary between cybersecurity and physical security becomes increasingly difficult to maintain.

Sweden: ICA and Coop Report Refrigeration Disruptions

The first reports on 2 November emerged from Swedish supermarket chains ICA and Coop. Several ICA stores experienced problems with refrigeration systems overnight, including locations in Sjöbo, Tomelilla, Böda and Mörlunda.

At an ICA Kvantum store in Sjöbo, manager Rickard Nilsson reported that refrigeration and freezer settings had been changed to approximately 50°C. Staff were initially unable to restore normal operating conditions, and substantial quantities of chilled and frozen products had to be discarded. The resulting losses were estimated at several hundred thousand Swedish kronor.

ICA confirmed that a limited number of stores had experienced refrigeration-related incidents but did not initially establish a cyberattack as the cause across its affected locations. The company said it was supporting stores in restoring normal operations.

Coop reported problems at six stores in central Sweden, particularly around Gävle. Some experienced partial or complete refrigeration failures, although the company had not confirmed a common technical cause. Affected stores remained open where possible, with products removed from sale whenever their storage conditions could no longer be guaranteed.

Sweden’s National Cyber Security Centre is investigating several refrigeration-related incidents. Its head, John Billow, told Reuters that authorities had recently identified numerous exposed operational technology devices and highlighted the need to update and secure vulnerable equipment.

The Swedish cases therefore raise two separate questions: whether the reported temperature changes resulted from unauthorised interference, and whether different retailers were affected through shared technical weaknesses. Neither question had been conclusively answered at the time of publication.

Belgium and Luxembourg: Multiple Retailers Affected

Belgium experienced particularly widespread disruption. According to Belgian broadcaster RTL Info, approximately 40 Delhaize stores reported refrigeration problems, alongside around 15 Carrefour locations, 15 Intermarché outlets and five Spar stores. Other food businesses, including the De Laet en Van Haver butchery group, also reported unusual temperature changes.

Ahold Delhaize confirmed that an IT incident had affected refrigeration systems at several dozen stores in Belgium and neighbouring Luxembourg. The company said it had taken measures to maintain operations, while acknowledging temporary restrictions on fresh and frozen products in affected locations.

The reports suggest that the incidents involved more than a conventional equipment malfunction. At a Proxy Delhaize store in Overijse, manager Diego Louwers reported that refrigeration units had unexpectedly entered defrost mode during the night. The equipment began circulating warm air, making it impossible to maintain the temperatures required for safe food storage.

Stephan Moelans, chief executive of Belgian refrigeration specialist Sabcobel, told the Belga news agency that attackers had switched refrigeration evaporators into defrost mode. Technical teams worked overnight to disconnect affected installations from their networks and restore normal operating conditions.

The distinction between a changed controller setting and an actual product temperature is important. Some reports referred to settings as high as 50°C or 70°C. Belgian journalists also documented refrigeration compartments reaching approximately 15°C, while individual operators described much warmer air during defrost cycles. These figures do not necessarily represent equivalent measurements, and the highest reported values should not be interpreted as independently confirmed food temperatures.

Nevertheless, the operational consequences were immediate. Retailers faced product disposal, disrupted sales and urgent technical intervention. Even where supermarkets remained open, the loss of refrigeration capacity significantly restricted their ability to sell fresh and frozen goods.

Estonia: Older Refrigeration Controls Targeted

The Estonian incident provides a more specific account of the suspected technical intrusion. Public broadcaster ERR reported that attackers accessed a computer controlling refrigeration equipment at a Selver supermarket and changed a freezer setting to 50°C.

Jann Mutso, chief executive of refrigeration technology provider Kitman Coldtech, said the attack involved an older Danfoss refrigeration control system. According to Mutso, the attackers appeared to be targeting security weaknesses in outdated controllers.

Selver subsequently confirmed that one of its stores had been affected. The retailer said the incident was detected rapidly by its technical partner and that no damage resulted. The company also indicated that the affected location was the last in its network where an upgraded refrigeration system had not yet been introduced.

Mutso reported that the incident was addressed within approximately ten minutes. He also referred to other suspected attacks against refrigeration systems in Estonia, although their full extent was not immediately established.

The case illustrates the importance of maintaining older operational equipment. Refrigeration controllers may remain in service for many years, particularly where the underlying mechanical systems continue to operate reliably. Their digital interfaces, however, can become difficult to secure when software updates are unavailable, unsupported or not consistently installed.

The Estonian account identifies a particular category of older equipment in one incident. It does not establish that every affected retailer across Europe was using the same controller, that the same vulnerability was exploited or that a single manufacturer was responsible for the wider disruption.

Ireland: SuperValu Removes Products from 13 Stores

The geographical scope expanded further when Irish supermarket chain SuperValu confirmed a cyber incident affecting refrigeration systems at 13 stores.

According to The Irish Times, the disruption led to chilled and frozen products being removed from sale as a precaution. The affected locations included stores in Lucan, Blanchardstown, Waterford and Bray.

SuperValu’s parent company, Musgrave Group, confirmed that the incident involved a specific model of refrigeration equipment. The company said its monitoring systems had identified the problem and that immediate action had been taken to protect customers. Stores remained open, with unaffected products continuing to be sold.

Musgrave also confirmed that it was working with equipment suppliers and cybersecurity specialists to investigate the incident and restore normal operations.

The Irish case is significant because it demonstrates the value of an effective detection and response process. Monitoring systems can identify abnormal operating conditions, but their usefulness depends on timely alerts, clear responsibilities and the ability to intervene before a technical disturbance causes widespread product losses.

At the same time, the reference to a specific refrigeration model suggests that equipment-level characteristics may be relevant to individual incidents. Whether that model or its vulnerabilities are connected to systems affected elsewhere in Europe has not been established.

The French Attacks Provide an Important Warning

The incidents follow a substantial attack against French supermarket refrigeration systems on 12 and 13 October 2026. According to French authorities and subsequent media investigations, hundreds of stores were affected when attackers gained control of connected refrigeration equipment and changed operating parameters.

The disruption affected major retail chains, including Intermarché and Coopérative U, and caused extensive food losses. French authorities also reported fires associated with the incidents.

Initial investigations focused on refrigeration controllers supplied by Danfoss. Further attacks were subsequently reported against systems using Dixell equipment, demonstrating that the problem was not necessarily confined to a single manufacturer’s technology.

The precise intrusion routes have not been conclusively established. Public reporting has highlighted previously identified vulnerabilities in certain refrigeration controllers, but the existence of a known weakness does not prove that it was exploited in every reported incident.

There is also no confirmed evidence that the attacks in France and the incidents of 2 November were conducted by the same individuals or organised group. Similarities in timing, equipment behaviour and operational consequences justify investigation, but they are not sufficient to establish common attribution.

When Cyber Intrusions Produce Physical Consequences

The technical significance of these incidents lies in the relationship between digital commands and physical processes.

Commercial refrigeration systems commonly rely on programmable controllers to regulate temperatures, compressor operation, defrost cycles and alarm conditions. Remote access allows technicians to monitor equipment, diagnose faults and adjust settings without visiting individual locations.

These capabilities improve operational efficiency but create potential attack paths when remote access is inadequately protected. A compromised account, exposed management interface or vulnerable controller can allow an unauthorised party to alter parameters that directly affect equipment behaviour.

Defrost functionality provides a particularly clear example. Refrigeration systems normally require controlled defrost cycles to remove ice from evaporator components. When these cycles are activated at inappropriate times or extended beyond normal operating limits, the cooling process can be interrupted and temperatures can rise.

Such manipulation does not necessarily require the attacker to damage the refrigeration machinery itself. Instead, the system may be instructed to perform a legitimate function under unsafe or inappropriate conditions.

For operational technology security, this distinction is fundamental. A malicious action may appear as a valid command at device level, even though its timing, origin or operational consequences are abnormal.

Traditional IT security monitoring may not detect such behaviour if it focuses primarily on malware, suspicious files or conventional network intrusions. Effective protection requires visibility into the operational context, including controller states, temperature parameters, remote maintenance sessions and unexpected configuration changes.

A Wider Challenge for Building and Infrastructure Security

The same underlying risks extend to other connected building and industrial systems.

Security cameras, access control platforms, environmental monitoring equipment, heating and ventilation systems and certain alarm-related components increasingly depend on network connectivity and remote administration. Where these technologies share infrastructure or service providers, weaknesses in one part of the environment can create additional risks for the wider organisation.

This does not mean that all connected building systems are equally vulnerable. Their exposure depends on architecture, access controls, software maintenance, network segmentation and the consequences of unauthorised commands. Nevertheless, the supermarket incidents demonstrate why operational technology should not be treated as a peripheral component of cybersecurity governance.

For security integrators and facility operators, an appropriate response begins with identifying all remotely accessible controllers and understanding their dependencies. Legacy equipment should be assessed according to its actual exposure, available security updates and the feasibility of compensating protective measures.

Remote maintenance access should be restricted to authorised personnel, protected by appropriate authentication and monitored for unusual activity. Network separation can reduce the likelihood that a compromise of a less critical system will affect safety-sensitive or operationally essential equipment.

Equally important are independent monitoring, locally available intervention procedures and clearly defined recovery responsibilities. A technically redundant installation offers limited protection if its controllers depend on the same compromised management interface or external service connection.

These principles are consistent with established operational technology security guidance, including NIST SP 800-82 and European cybersecurity recommendations on risk-based network segmentation and access management.

NIS2: Regulatory Relevance Requires Careful Interpretation

The incidents also have implications for European cybersecurity governance, although the legal position requires differentiation.

The EU’s NIS2 Directive includes certain food-sector businesses within its scope, particularly organisations engaged in wholesale distribution and industrial food production or processing. Ordinary supermarket retail operations are not automatically covered simply because they sell food.

Belgium’s Centre for Cybersecurity explicitly clarifies that supermarkets, as retailers, generally fall outside the food-sector category in Annex II. However, a retail group may operate separate wholesale, industrial production or processing activities that bring particular legal entities within scope.

For organisations subject to NIS2, cybersecurity risk management must address relevant threats to the continuity and security of their services. This can include operational technology where its compromise affects business functions or essential operations.

The broader lesson is therefore not that every affected supermarket has necessarily breached NIS2 obligations. Rather, the events reinforce the need to assess connected physical infrastructure within organisational risk management, irrespective of whether a particular operator is directly regulated.

Supplier security is also relevant. Retailers frequently depend on refrigeration specialists, maintenance contractors and equipment manufacturers to operate and support their installations. Security responsibilities should therefore cover remote access arrangements, maintenance procedures, incident escalation, supported software versions and the availability of alternative operating modes.

The Critical Test Is Operational Resilience

The reported incidents demonstrate that relatively small changes to technical operating parameters can produce substantial commercial consequences. In food retail, a refrigeration failure can quickly become a food safety problem, a stock-loss event and a business continuity incident.

The differences between affected retailers are equally instructive. Some stores discarded large quantities of food after prolonged refrigeration failures. Others identified abnormal conditions quickly enough to prevent significant losses. These outcomes underline the importance of detection, response capabilities and operational preparedness.

For security professionals, the immediate priorities are clear: understand which systems can be controlled remotely, restrict unnecessary access, monitor critical configuration changes, maintain supported software and establish procedures for safe local intervention. Incident exercises should also examine scenarios in which several locations experience similar failures simultaneously.

The wider significance of the European supermarket incidents is not simply that refrigerators can be hacked. It is that connected operational technology has become an integral part of business resilience, with digital weaknesses capable of producing immediate physical consequences.

Whether the current incidents ultimately prove to be coordinated or technically unrelated, they expose a shared security challenge. Protecting modern infrastructure requires organisations to secure not only information and networks, but also the physical processes that increasingly depend on them.

Sources and Further Reading

• Reuters – European supermarkets hit by new fridge cyber attack, 2 November 2026.
• Associated Press – Freezers at supermarkets in several European countries hit by apparent cyberattacks, 2 November 2026.
• ERR News – Hackers raised freezer temperature at Selver supermarket to +50°C, 2 November 2026.
• The Irish Times – SuperValu removes chilled and frozen food from 13 stores, 2 November 2026.
• RTL Info Belgium – Cyberattacks affecting supermarket refrigeration, 2 November 2026.
• Le Monde – After Danfoss, hackers strike other refrigeration systems used in France, 13 October 2026.
• NIST – Guide to Operational Technology (OT) Security, SP 800-82 Rev. 3.
• European Union – Directive (EU) 2022/2555 (NIS2).