A new wave of supermarket cyberattacks across Europe has disrupted refrigeration systems, caused food spoilage and raised serious questions about the security of internet-connected equipment.
On Monday, November 2, supermarkets in several European countries reported that refrigerators and freezers had suddenly begun warming overnight. In some cases, temperatures reportedly reached 50°C (122°F)—far beyond safe food-storage conditions.
More than 100 stores were affected, according to reports compiled by Reuters and cybersecurity publications.
The incidents follow a similar attack in France on October 12, when hundreds of supermarkets experienced manipulated refrigeration settings.
Unlike conventional cyberattacks involving stolen passwords or customer information, these incidents directly affected physical equipment responsible for keeping food refrigerated.
What Happened in the November 2 Supermarket Cyberattacks?
During the early hours of November 2, refrigeration systems at multiple European supermarkets experienced unexpected temperature changes.
In several confirmed incidents, unauthorized interference affected cooling equipment.
Attackers reportedly manipulated refrigeration controls, with some systems switching into defrost mode or stopping normal cooling operations.
The results included:
- Refrigerators and freezers warming unexpectedly.
- Frozen products thawing.
- Supermarkets removing potentially unsafe food from sale.
- Stores discarding damaged inventory.
- Emergency technical work to restore refrigeration systems.
Some stores remained open while affected refrigeration units were repaired or restocked.
According to Reuters, retailers in several countries confirmed incidents involving their refrigeration systems.
However, investigators had not established whether all the incidents formed one coordinated cyberattack.
Which Grocery Stores Were Affected?
Reports identified disruptions in Belgium, Sweden, Luxembourg, Ireland, Estonia, the Netherlands and Finland.
Among the affected businesses were several major supermarket chains.
Delhaize — Belgium and Luxembourg
Ahold Delhaize reported an IT incident affecting refrigeration equipment at several dozen Delhaize stores.
Approximately 40 locations were reported affected.
The retailer said its distribution centres continued operating and deliveries were not disrupted.
Carrefour — Belgium
Carrefour confirmed that refrigeration equipment was affected at approximately 15 of its 700 Belgian stores.
The company described the impact as limited and said stores remained open.
Coop — Sweden
Swedish supermarket chain Coop confirmed unauthorized interference with refrigeration systems at seven stores, according to Reuters.
The disruption ranged from partially functioning refrigerators to complete cooling failures.
The company later said the situation had been contained.
ICA — Sweden
ICA reported that a limited number of independently operated stores experienced refrigeration problems.
One supermarket in Sjöbo reported that its cooling equipment had been set to 50°C.
Staff were forced to discard affected products.
SuperValu — Ireland
Musgrave Group confirmed that refrigeration systems at 13 SuperValu stores were affected.
Chilled and frozen products were removed from sale as a precaution.
By Monday afternoon, Musgrave said the incident had been resolved and restocking was underway.
Other Affected Businesses
Additional disruptions were reported at:
- Five Spar stores operated under Colruyt Group’s franchise network in Belgium.
- At least one Selver supermarket in Estonia.
- Smaller grocery stores in Finland and the Netherlands.
- An IKEA store in Mons, Belgium.
The number of affected locations may change as companies complete their investigations.
How Can Hackers Control Supermarket Refrigerators?
Modern supermarket refrigeration systems are considerably more sophisticated than ordinary household refrigerators.
Large supermarkets often use centralized digital controllers to manage cooling equipment throughout a building.
These systems may regulate:
- Refrigerator and freezer temperatures.
- Automatic defrosting schedules.
- Temperature alarms.
- Equipment performance.
- Remote maintenance and diagnostics.
Internet connectivity allows refrigeration technicians to monitor equipment and make adjustments without visiting each location.
That convenience can introduce cybersecurity vulnerabilities.
If a refrigeration control system is accessible from the public internet without adequate protection, unauthorized users may be able to reach its management interface.
Depending on the equipment and its security configuration, an attacker who gains access could potentially alter temperature settings, activate defrost cycles or interfere with alarms.
The precise methods used in the November 2 incidents had not been publicly established.
Nearly 13,000 Refrigeration Services Found Exposed Online
The supermarket incidents follow a concerning cybersecurity investigation published shortly before the attacks.
On October 22, cybersecurity company Forescout released research examining internet-accessible refrigeration management systems.
Its researchers identified:
- 12,976 exposed refrigeration service observations.
- 6,017 distinct public IP addresses.
- Equipment spanning 99 countries and territories.
The research covered products including Danfoss StoreView and Copeland/Dixell XWEB systems.
Importantly, these figures represent exposed services—not 12,976 confirmed hacked refrigerators or unique vulnerable devices.
The researchers warned that outdated equipment, weak authentication and poorly secured remote access could create opportunities for attackers.
Read the original investigation: Forescout — Cold Chain, Open Control: Exposed Refrigeration Systems Reveal Global Risk.
Why the October Cyberattack in France Matters
The November 2 disruptions occurred approximately three weeks after a major refrigeration cyberattack in France.
On October 12, attackers interfered with refrigeration systems across hundreds of supermarkets and independent food retailers.
French authorities subsequently investigated hundreds of affected locations.
The incidents reportedly caused substantial food losses, while some equipment overheating was linked to fires.
France’s national cybersecurity response team, CERT-FR, confirmed compromises involving remote refrigeration controllers from several manufacturers.
The affected technologies included:
- Danfoss AK-SM
- Danfoss AK-SC
- Copeland XWEB
- Dixell XWEB
The agency warned that refrigeration management interfaces should not be directly exposed to the public internet.
It also recommended secure remote connections, updated software and replacement of unsupported equipment.
See the official CERT-FR security alert.
Although the November incidents resemble the October attacks, investigators have not confirmed that the same perpetrators were responsible.
How Much Food Was Lost?
The full financial impact of the November 2 supermarket cyberattacks remains unknown.
However, individual businesses have already reported substantial losses.
Luc De Laet, who operates the Belgian butcher business De Laet & Van Haver, told Reuters that refrigeration problems spoiled approximately €15,000 worth of meat at one location.
Other supermarkets discarded significant quantities of chilled and frozen products after equipment temperatures exceeded appropriate storage conditions.
Food affected by extended refrigeration failures may need to be discarded even after cooling systems return to normal.
The losses also create additional costs through:
- Emergency technical repairs.
- Replacement inventory.
- Disposal of damaged food.
- Employee overtime.
- Temporary reductions in available products.
The wider financial impact will depend on how many stores were affected and how quickly their operations recovered.
Who Is Behind the Grocery Store Cyberattacks?
As of November 2, no individual or organization had been publicly identified as responsible for the latest wave of attacks.
No group had claimed responsibility for the October French incidents either.
Cybersecurity specialists have discussed several possible motives, including sabotage, political disruption and financial extortion.
However, these remain possibilities rather than established explanations.
Reuters reported that investigators had not determined whether the November attacks were connected to the earlier French incidents.
Cybersecurity researchers have tracked activity by various hacktivist groups targeting connected refrigeration systems in the past, but that history does not establish responsibility for the latest events.
Were Customers’ Personal or Payment Details Stolen?
The publicly reported November 2 incidents primarily involved refrigeration and cooling equipment.
The available reporting did not establish that customers’ credit card information, loyalty accounts or other personal data had been stolen as part of these attacks.
That distinction matters.
A cyberattack can cause significant business disruption without involving the theft of customer information.
Here, the most clearly documented effects involved food preservation, refrigeration controls and inventory losses.
Why These Cyberattacks Matter Beyond Europe
The attacks highlight a broader cybersecurity challenge.
Increasingly, equipment essential to everyday life is connected to digital networks.
Examples include:
- Supermarket refrigeration equipment.
- Warehouse cooling systems.
- Building heating and ventilation.
- Agricultural storage facilities.
- Industrial machinery.
- Hospital refrigeration equipment.
Internet-connected systems can improve efficiency and allow faster maintenance.
But inadequate cybersecurity protections may also create pathways for attackers to interfere with physical operations.
The risk extends beyond supermarket profits.
Disruptions to refrigeration systems can threaten food supplies, create waste and affect access to temperature-sensitive products.
The European Commission has expressed concern about the potential consequences for food security and consumer confidence.
What Can Supermarkets Do to Prevent Similar Attacks?
Cybersecurity authorities and researchers recommend several protective measures.
1. Restrict Public Internet Access
Refrigeration management systems should not be unnecessarily accessible from the open internet.
Secure gateways and properly configured private networks can reduce exposure.
2. Update or Replace Older Equipment
Outdated controllers may contain known vulnerabilities that cannot be corrected if manufacturers no longer provide security updates.
3. Strengthen Authentication
Maintenance contractors and authorized employees should use individual accounts with strong authentication rather than shared passwords.
4. Monitor Temperature Changes
Independent monitoring can help detect unusual temperature fluctuations or unexpected changes to defrost schedules.
5. Prepare for Equipment Failures
Retailers need procedures for quickly isolating affected systems, protecting food inventory and restoring safe operating conditions.
These measures cannot eliminate every cybersecurity threat, but they can significantly reduce exposure and improve recovery.
Are the Supermarket Cyberattacks Still Ongoing?
As of the latest reporting on November 2, the situation varied between retailers.
Some businesses, including Coop and SuperValu, reported that their immediate refrigeration problems had been contained or resolved.
Others continued investigating the incidents or restoring affected equipment.
There was no verified confirmation that every affected location had fully recovered.
French cybersecurity authorities had also warned in October that attacks targeting exposed refrigeration controllers could continue.
Supermarket operators and equipment suppliers were therefore being urged to review their security arrangements.
The Bigger Picture: Cybersecurity Now Affects Everyday Essentials
The European supermarket cyberattacks demonstrate how digital threats can extend far beyond computers and financial accounts.
The ability to interfere with refrigeration systems illustrates a troubling reality: attackers may be able to cause physical and economic damage by manipulating ordinary equipment controls.
For retailers, cybersecurity is increasingly becoming part of food safety and business continuity.
For consumers, the incidents raise an important question:
If supermarket refrigerators can be remotely manipulated, what other essential systems might be vulnerable?
The answer will depend on how effectively businesses and governments secure the growing number of connected systems supporting everyday life.
Hot Issues Daily will continue monitoring developments in the European supermarket cyberattacks as additional information becomes available.
Sources
- Reuters — New Cyberattack on Supermarket Fridges Sweeps Across Europe
- Associated Press — Supermarket Freezers Hit by Apparent Cyberattacks
- AFP — Fridge Cyberattack Hits Supermarkets Across Europe
- Forescout — Exposed Refrigeration Systems Reveal Global Risk
- CERT-FR — Refrigeration Controller Security Alert