Around 40 Delhaize stores in Belgium and Luxembourg, plus shops in Sweden, Ireland, the Netherlands, Estonia and Finland, threw out food on Monday after attackers remotely switched refrigeration units into defrost mode. Belgium has opened a criminal investigation. The method matches an October wave in France that led the French cyber agency to warn about internet-exposed refrigeration controllers.

Overnight into Monday 2 November, attackers reached into the refrigeration controllers of supermarkets and butchers across at least seven European countries and set the evaporators to defrost, sending temperatures in some freezers as high as 50C. No group has claimed responsibility, and nothing suggests the attack was aimed at money.

Belgium bore the brunt. According to Belgian public broadcaster VRT NWS, at least 40 Delhaize stores, about 15 of Carrefour's 700 Belgian shops, five franchised Spar stores of Colruyt Group and 10 to 15 Intermarché stores in Wallonia and Brussels were hit, along with Ikea's store in Mons. The federal prosecutor's office confirmed to VRT that it has opened a criminal investigation.

The losses are concrete. The manager of a Delhaize in Hoeilaart told Het Laatste Nieuws the shop had binned about €100,000 of produce, the BBC reported. The operator of a Proxy Delhaize in Hoepertingen, Limburg, estimated at least €60,000 of food had gone in the bin, telling Het Belang van Limburg the damage was "immense" (translated). Belgium's food safety agency FAVV said stores must check products themselves and pull anything that rose above 7C, or above -18C for frozen goods.

Not just Belgium

In Sweden, ICA and Coop stores were affected. Coop told the BBC that seven of its 800 Swedish stores were hit. ICA said a "small number" of stores outside its central network were affected. John Billow, head of Sweden's National Cyber Security Centre, told Aftonbladet that "this is a big problem" (translated), and warned that the same exposure applies to connected wind turbines and other critical infrastructure.

In Ireland, 13 SuperValu stores were hit, according to the BBC. In the Netherlands, a spokesperson for Danish refrigeration-equipment maker Danfoss told public broadcaster NOS that systems at at least 17 businesses, mostly butchers and small neighbourhood shops, were attacked overnight, NRC reported. Kesko's K-stores in Finland and a Selver supermarket in Estonia also reported problems.

A warning that went unheeded

The attack copies a wave in mid-October that hit hundreds of French supermarkets. On 12 October France's national CERT (CERT-FR) issued an alert about "numerous compromises" of remote refrigeration controllers, naming Danfoss's AK-SM and AK-SC series and Copeland and Dixell XWEB systems. It told operators to take these units off the public internet and warned that attack campaigns were "probably still under way" (translated).

Danfoss said many customers had acted on that advice. "Most stores took measures then, but a small number did not," a spokesperson told NOS, as quoted by VRT. "They are now paying the price" (translated).

Stephan Moelans, chief executive of Belgian refrigeration installer Sabcobel, said the attackers went after controllers in individual stores, not the installers' own systems. He said a software update alone would not fix the weakness and that units needed physical changes, which "requires an investment" (translated).

Ethical hacker Keanu Nys of Spotit told VRT there is "no reason at all" (translated) for such systems to be reachable from the open internet. He said the absence of a financial motive points either to someone acting for fun or to a state trying to cause alarm. The Centre for Cybersecurity Belgium told VRT it was concerned about a rising number of incidents, partly driven by "the targeted use of AI" (translated).

Why it matters

The incident shows how operational technology bolted onto the internet for remote maintenance can turn a cheap attack into real losses for retailers and their suppliers. A European Commission spokesperson said the bloc's crisis network of national cyber authorities, CYCLONe, was being used to coordinate. The BBC reported that US authorities are investigating refrigeration failures at American military bases in August and are working with French officials on possible links.

Regulators will now ask why internet-exposed controllers were still online three weeks after France's public warning.

Sources

• VRT NWS live blog: "Federaal parket opent strafonderzoek na cyberaanval bij verschillende Belgische supermarkten" (Dutch), 2 Nov 2026
• NRC: "Ook in Nederland zijn koelsystemen geraakt door hack" (Dutch), 2 Nov 2026
• Aftonbladet: "Myndigheterna utreder attackerna mot matbutiker: 'Stort problem'" (Swedish), 2 Nov 2026
• BBC News: "Shop freezers in seven European countries hit by cyber-attack", 2 Nov 2026
• CERT-FR alert CERTFR-2026-ALE-012 (French), 12–16 Oct 2026

Image: AI-generated abstract illustration (European Tech On Heels).