Why did a supermarket cyber attack hit Europe’s fridges and freezers? Across at least seven European countries on November 2, 2026, thousands of commercial refrigerators and freezer units suddenly had their settings remotely overridden overnight—pushing internal cabinet temperatures from -27°C up to a scorching 50°C (122°F). From ICA and Coop stores in Sweden to Delhaize, Carrefour, Spar, and even IKEA food halls in Belgium, retail workers arrived to find spoiled meat, melted dairy, and empty shelves in the second massive wave of food-chain sabotage in less than a month.
While early headlines focused on spoiled produce, search trends show millions of shoppers asking a deeper technical question behind the cyber attack on supermarket fridges: how can hackers remotely heat up a commercial freezer, and why are grocery chains being targeted without a single ransom demand? Below is the complete technical and geopolitical breakdown of the europe cyber attack on retail cooling systems, how internet-exposed Operational Technology (OT) controllers were hijacked, and why EU officials warn this is a textbook hybrid warfare strike against the food supply chain.
🚨 At a Glance: The European Supermarket Fridge Cyber Attack (Nov 2026)
- What Happened: Hackers remotely accessed industrial refrigeration controllers overnight (between 1:00 AM and 2:00 AM), switching cooling evaporators into continuous defrost mode and forcing cabinet temperatures from -27°C to 50°C (122°F).
- 7 Countries Hit in Wave 2 (Nov 2, 2026): Sweden, Belgium, the Netherlands, Ireland, Finland, Estonia, and Luxembourg—following Wave 1 in France (October 2026), which hit up to 700 supermarkets and caused tens of millions of euros in losses.
- Major Chains Affected: ICA and Coop (Sweden); Ahold Delhaize, Carrefour, Colruyt, Intermarché, Spar, Q8 Shop & Go, and IKEA Mons (Belgium/Luxembourg); SuperValu (Ireland); Kesko (Finland); and Selver (Estonia).
- The Technical Flaw: Thousands of building management and temperature controllers (including unpatched systems from suppliers like Danfoss and two other industrial vendors) were left reachable directly from the public internet.
- The Motive: Zero ransom demands were made. Cybersecurity analysts at SentinelOne and EU Food Commissioner Christophe Hansen classify the strikes as deliberate supply-chain sabotage and hybrid warfare designed to undermine consumer confidence.
How Can Hackers Heat Up a Supermarket Fridge to 50°C? The OT Vulnerability Explained
To everyday shoppers, a supermarket cyber attack targeting fridges sounds like science fiction. A domestic kitchen refrigerator is a closed standalone appliance, so how can a commercial freezer in Stockholm, Dublin, or Brussels be turned into a 50°C oven by a hacker thousands of miles away?
The answer lies in the retail industry’s shift from isolated mechanical thermostats to networked Operational Technology (OT) and Industrial Internet of Things (IIoT) building management systems:
1. Remote Maintenance Gateways Left Exposed to the Public Internet
Modern supermarkets do not adjust hundreds of display cabinets manually. Instead, chains rely on centralized electronic refrigeration controllers—most notably hardware and software suites manufactured by the Danish industrial giant Danfoss (alongside two other European controller vendors identified by France’s national cybersecurity agency, ANSSI). These controllers allow external HVAC contractors to monitor energy consumption, receive compressor fault alerts, and adjust temperatures remotely over the internet.
As Patrick Lamplmair of the cybersecurity firm Tributech explained to The Guardian, thousands of these industrial temperature controllers were left directly reachable from the public internet with known, unpatched software vulnerabilities. Although Danfoss identified security flaws last year and urged retail clients to install firmware updates, hundreds of supermarkets failed to patch their local hardware.
2. Weaponizing the “Defrost Mode” Heating Elements
Commercial freezers cannot reach 50°C (122°F) simply by turning the cooling compressor off—ambient room temperature inside a supermarket is only around 20°C. To actively heat the cabinets to 50°C and ruin food within hours (and even spark electrical fires, as seen during the October wave in France), the attackers exploited the units’ built-in heating rods.
Stephan Moelans, CEO of Sabcobel—the refrigeration contractor operating Ahold Delhaize’s cooling systems in Belgium—confirmed to the Belga news agency that hackers broke into the network around 1:00 AM and remotely forced the refrigeration evaporators into continuous defrost mode. Industrial freezers use electric resistance heaters inside the evaporator coils to melt ice buildup during brief, scheduled 15-minute maintenance cycles. By overriding the safety limits and locking the defrost heaters on all night while disabling high-temperature alarms, a few lines of remote code destroyed up to €130,000 (£109,000) worth of meat, dairy, and frozen goods per store before morning staff unlocked the doors.
Country-by-Country Map: Which Supermarkets Were Hit Across Europe?
The November 2, 2026 europe cyber attack expanded a tactic first tested in France in mid-October into a coordinated seven-nation strike across Northern and Western Europe. Below is the verified breakdown of affected countries, chains, and operational impacts:
| Country | Supermarket & Retail Chains Hit | Confirmed Scale & Operational Impact |
|---|---|---|
| France (Wave 1 – Oct 2026) | Intermarché, Carrefour, Leclerc, Coopérative U, Monoprix | Up to 700 stores hit; temperatures pushed from -27°C to 50°C; electrical fires and up to €130,000 in spoiled stock per shop. |
| Belgium & Luxembourg | Ahold Delhaize (Proxy), Carrefour (15 stores), Intermarché (15), Colruyt (5), Spar (5), Q8 Shop & Go, IKEA Mons | Dozens of supermarkets forced to empty chilled shelves; technicians worked from 1:00 AM manually disconnecting controllers from the internet. |
| Sweden | ICA (Sjöbo, Stockholm & regional stores), Coop (6 stores) | 2:00 AM cyber-attack set freezers to 50°C; Swedish National Cybersecurity Centre (John Billow) warned of widespread exposed OT devices. |
| Ireland | SuperValu (3rd-largest grocer in Ireland) | 13 out of 223 stores hit via a specific controller model; chilled and frozen products removed from sale in Dublin and regional branches. |
| Netherlands | At least 17 local supermarkets (plus earlier Ahold Delhaize police report) | Dutch public broadcaster NOS confirmed 17 independent and regional shops suffered overnight cooling sabotage. |
| Finland | Kesko supermarket chain | Multiple K-group retail locations investigated overnight temperature spikes across refrigeration networks. |
| Estonia | Selver supermarket chain (serviced by Kitman Coldtech) | Hackers accessed the central control computer and set temperatures to 50°C; Kitman Coldtech detected and blocked the intrusion within minutes. |
Why Target Supermarket Fridges? Sabotage, Hybrid Warfare & the Stockpiling Link
When traditional cybercriminals breach a corporate network, they deploy ransomware to encrypt servers and demand millions in cryptocurrency (which is why institutional investors closely track digital asset liquidity—see our analysis on why Bitcoin and tech stocks are dropping). However, in both the French and pan-European cyber attack fridges incidents, there were zero ransom notes and zero financial demands.
Why would hackers invest time into spoiling milk, Swedish meatballs at IKEA, and frozen vegetables across eight European countries without asking for a cent?
1. Pure Sabotage: “Cheap and the Damage Is Immediate”
Tom Hegel, principal threat researcher at cybersecurity firm SentinelOne, noted that the complete absence of extortion points directly to politically motivated sabotage, potentially aligned with hostile state actors. Unlike hardened military or banking networks, retail chains manage sprawling, decentralized estates of thousands of refrigeration controllers, door panels, and point-of-sale terminals across hundreds of towns. Once an attacker writes an automated script that exploits a single unpatched Danfoss or third-party controller flaw, they can scan the entire European internet and execute the exact same attack across seven countries at almost zero cost.
2. Psychological Warfare Against the European Food Supply Chain
EU Food and Agriculture Commissioner Christophe Hansen stated that the repeated strikes represent “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it.”
In hybrid warfare—a doctrine heavily utilized since Russia’s 2022 invasion of Ukraine—the goal of attacking civilian infrastructure is rarely to starve a nation overnight. Instead, it is to create visible, everyday disruption inside neighborhood supermarkets. When citizens in Brussels, Stockholm, or Dublin walk into their local grocery store and see empty refrigerators with signs reading “No products due to cyberattacks,” it erodes public trust in national infrastructure resilience.
This exact vulnerability is one of the primary reasons why governments are telling people to stockpile food and water in 2026. Just days before the November 2 supermarket hack, European security ministers warned that “state-sponsored terrorism” and cyber sabotage targeting everyday retail and payment infrastructure are why every household needs 72 hours of non-perishable canned food that does not rely on electrical refrigeration.
Why Didn’t Supermarkets Fix the Flaw After the French Attack?
One of the most pressing questions following Monday’s supermarket freezers cyber attack is why retailers in Sweden, Belgium, and Ireland were still vulnerable three weeks after 700 French stores were hit by the exact same method in October 2026.
- Fragmented Contractor Responsibility: Most supermarkets do not manage their own cooling software; they outsource installation and maintenance to dozens of regional HVAC and refrigeration subcontractors. Store managers often have no idea their freezers are reachable via the public internet.
- Legacy Hardware & Downtime Fears: Patching operational technology (OT) often requires rebooting controllers or taking cooling units offline temporarily—something 24/7 grocery stores hesitate to do until an attack forces technicians to physically unplug the network cables at 1:00 AM.
- Automated Internet Scanning: Using public search engines for internet-connected devices (such as Shodan), threat actors can locate every unpatched industrial controller in Europe in seconds. As cybersecurity analysts warned, attackers will continue triggering the exploit “until it stops working”—meaning until every exposed controller is placed behind a secure VPN firewall and patched.
Frequently Asked Questions (FAQ)
Why did the supermarket cyber attack target fridges and freezers?
Hackers targeted supermarket fridges and freezers because commercial cooling units rely on internet-connected Operational Technology (OT) controllers for remote maintenance. Many of these controllers had unpatched security flaws and were exposed directly to the internet, allowing attackers to cause immediate physical and financial damage across hundreds of stores with a few remote commands.
How did hackers make supermarket freezers reach 50°C (122°F)?
Attackers remotely overrode the electronic temperature controllers (such as unpatched Danfoss and third-party systems) and switched the refrigeration evaporators into continuous defrost mode. This locked the internal electric heating elements on overnight while disabling high-temperature alarms, raising cabinet temperatures from -27°C to 50°C.
Which countries and supermarkets were hit in the Europe fridge cyber attack?
Following an October 2026 attack on 700 stores in France (Carrefour, Intermarché, Leclerc), the November 2, 2026 wave hit seven more European countries: Sweden (ICA, Coop), Belgium and Luxembourg (Ahold Delhaize, Carrefour, Colruyt, Spar, IKEA), Ireland (SuperValu), the Netherlands, Finland (Kesko), and Estonia (Selver).