Supermarket Fridge Cyberattack Spreads Across Europe

At around 2 a.m. on Monday, November 2, freezers in supermarkets across northern Europe started warming up on their own. By the time staff arrived for the morning shift, ice cream had melted, meat had spoiled, and in at least one Stockholm store the display units read 50°C (122°F). "Everything is destroyed," Engla Ingwall, a sales manager at an ICA franchise store in Stockholm, told Reuters. "There has been a cyberattack and all our freezers reached 50 degrees."

Stores in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Finland and Estonia reported the same pattern within hours, and later reports added Germany, Portugal, Romania and Italy. It is the second large attack on European supermarket refrigeration in three weeks, after hundreds of French stores were hit on October 12, and once again some of the targeted controllers were made by the Danish firm Danfoss.

Here is what is confirmed, what the numbers show, and why a freezer is now a target.

What happened on November 2

The attack ran overnight, while stores were closed and nobody was watching the displays. Stephan Moelans, CEO of the Belgian refrigeration installer Sabcobel, which maintains units for Delhaize, Carrefour and Spar, told the Belga news agency that the attack began around midnight and that the intruders remotely switched the units' evaporators into defrost mode. A defrost cycle deliberately heats the coils to melt ice. Left running, it turns a freezer into a warm cabinet. Belga reported that the mechanism matched the French attack exactly, and Moelans said his technicians spent the night physically disconnecting units from the network.

The damage landed mostly in Belgium and Luxembourg. Ahold Delhaize said an "IT incident" hit refrigeration in several dozen stores, mostly Belgian, with a few in Luxembourg, according to the Associated Press. Carrefour said 15 of its more than 700 Belgian stores were affected. Colruyt Group said five Spar shops were hit. IKEA confirmed one Belgian store and said it could not rule out more.

In Ireland, wholesaler Musgrave said 13 SuperValu stores had to pull chilled and frozen products. In Sweden, Coop reported seven of its roughly 800 stores affected and named Danfoss among its suppliers. In Estonia, Kitman Coldtech, which makes the affected equipment there, told public broadcaster ERR that an attacker reached a computer controlling refrigeration at one client and set it to 50°C, and that the attack was answered within minutes. The Selver chain said one of its outlets was affected.

The smallest victims felt it most. Luc De Laet, owner of the Belgian butchery chain De Laet & Van Haver, was woken at 3:30 a.m., drove to his store south of Antwerp, and found the fridges at 18°C. He estimated about €15,000 of meat was lost. "I only have two words for them: wake up, please, because there's something going on," he told Reuters.

The numbers: how big was this attack?

Adding up every store count that a company confirmed on November 2 gives a clearer picture than the "dozens of stores across Europe" framing in most headlines.

Operator	Country	Stores affected	Network size stated	Source
Delhaize (Ahold Delhaize)	Belgium, Luxembourg	~40	not stated	Company via AP, BBC
Carrefour	Belgium	15	700+	Company via AP, Reuters
SuperValu (Musgrave)	Ireland	13	not stated	Company via Reuters
Coop	Sweden	7	~800	Company via Reuters
Spar (Colruyt Group)	Belgium	5	not stated	Company via Reuters
IKEA	Belgium	1	not stated	Company via Reuters
Selver	Estonia	1	not stated	Kitman Coldtech via ERR, AP
De Laet & Van Haver	Belgium	1	not stated	Owner via Reuters
ICA	Sweden	"limited number"	not stated	Company via Reuters, AP

Method: store counts as stated by each company on November 2, 2026; Delhaize gave "several dozen" to AP and the BBC put it at about 40. ICA disclosed no count and is excluded from the total.

Across the eight operators that gave a figure, the November 2 attack hit roughly 83 stores in five countries, about a quarter to a third of the 250 to 350 stores French outlets reported for the single-country October 12 attack.

Two details in that table matter more than the total. First, where a chain stated its network size, the hit rate was tiny: 15 of 700+ Carrefour stores is about 2.1%, and 7 of 800 Coop stores is under 1%. Second, Sabcobel said it knew of around twenty affected units out of the hundreds it manages in Belgium. A breach of a chain's central IT would plausibly reach every store at once. A hit list this thin and this scattered fits an attacker working through individual controllers that happen to be reachable from the internet.

Why Danfoss controllers keep coming up

The French attack reportedly hijacked refrigeration controllers running older versions of Danfoss control software and triggered their built-in defrost cycle, according to BleepingComputer. Danfoss supervisory controllers such as the AK-SM series sit in a store's back room. They manage every display case's temperature, alarms and defrost schedule, and many expose a web interface so technicians can log in remotely.

The weaknesses were documented well before either attack. In 2025, Danfoss published an advisory for CVE-2025-41450, an authentication bypass with privileged access in AK-SM 8xxA controllers prior to version 4.2, alongside a command injection flaw, CVE-2025-41451. Researchers at Claroty's Team82, who found both, published a write-up titled "Freeze the Controller, Defrost the Food" showing how exposed management interfaces could be taken over. Investigators have not officially tied either attack to these specific flaws.

Exposure is the bigger problem. After the French attack, security researcher Baptiste Robert counted 2,752 Danfoss systems reachable online, 1,590 of them in France, and the device search engine Shodan tracked more than 4,500. Danfoss told Reuters it has been working with customers to implement fixes.

Patching alone does not close the gap. Moelans told Belga that a software update is not enough for many installed units, which need physical modifications, and "that requires investment." His advice was to manage fridges only over a secure connection. He said most of Sabcobel's customers switched to that after the French attack.

Patrick Lamplmair, CTO at the Austrian security firm Tributech, put the design flaw plainly to Gizmodo: "A freezer should never accept an instruction to heat to 50°C, no matter who sends it."

Who is behind it?

Nobody has claimed either attack, and no government has named a culprit. "It is not known who is behind this attack, and it may never be determined," said Katrien Eggers of Belgium's Centre for Cybersecurity, who added that AI now lets sophisticated actors exploit weaknesses faster.

The shape of the attack narrows the motive. There was no ransom note, no data theft and no extortion demand, only destroyed stock. Tom Hegel, a researcher at SentinelOne, told Reuters that the absence of financial demands points toward sabotage, and that attribution is hard by design: "An attacker who logs into an exposed control panel leaves almost nothing behind." Retail, he added, is an easy target because chains run enormous estates of refrigeration controllers, building systems and door panels.

The European Commission framed it as a food-security issue. Agriculture commissioner Christophe Hansen called the incidents "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it," and said their repetition was "deeply concerning." The timing sharpened that reading: the same day, Ukraine and Russia both reported attacks on their emergency alert apps, and Gizmodo noted that U.S. military commissaries were hit by a suspected refrigeration attack in late August.

What happens next

Three things are worth watching:

• The spread. Reports from Germany, Portugal, Romania and Italy arrived hours after the first wave, so the confirmed count above is a floor.
• The losses. Intermarché's CEO put the French attack's cost at potentially millions of euros. No chain has yet priced November 2.
• The fix. Every exposed controller that is still online is a candidate for the next night shift. Disconnecting units, moving them behind secure remote access, and replacing end-of-life hardware is slow, physical work, which is why the same technique has now succeeded twice in a month.

For shoppers the immediate effect is empty freezer aisles and a few days of thin stock in fresh and frozen food. Delhaize said its distribution centers were operating normally. For the industry, the lesson of November 2 is that the cheapest piece of connected equipment in a supermarket can now empty its shelves overnight.

Cover image: AI-generated illustration of an emptied supermarket freezer aisle.