A supermarket fridge cyberattack hit six European countries overnight on 2 November 2026, forcing refrigeration controls into defrost mode and spoiling food. Freezers in Sweden and Estonia reached 50C, and Carrefour, Colruyt, Coop, ICA and SuperValu pulled chilled and frozen stock. Belgium’s federal prosecutor opened a criminal investigation the same day.
How the Attack Worked
Attackers reached internet-connected refrigeration controllers and put them into a prolonged defrost cycle. Defrost mode is a routine maintenance function: it briefly warms the cooling element to clear ice, then returns the cabinet to its set temperature. Held on, it turns a freezer into a heater.
Belgian investigators say the defrost mode was activated remotely overnight from Sunday to Monday, according to the Brussels Times. In the October attack on French stores, the Irish Times reported that attackers reached centralised, internet-connected fridge controllers and changed their settings to trigger prolonged defrost cycles. The same pattern appears in the 2 November wave.
Two brands of controller have been named. The Centre for Cybersecurity Belgium named Danfoss AK-SC and AK-SM series equipment and Copeland xweb consoles in an advisory issued on 13 October 2026. Dutch broadcaster NOS reported that Copeland equipment was also targeted in Belgium this week.
The underlying flaws were public before either attack. The security firm Claroty published research on the Danfoss AK-SM 800A on 9 August 2026, documenting an authentication bypass tracked as CVE-2025-41450 and a command-injection flaw tracked as CVE-2025-41451, which Claroty’s own advisory rates at CVSS v3 8.2 and 7.6 and says Danfoss fixed in firmware R4.3.1. How the attackers got in on 2 November has not been established publicly. In Estonia, a contractor told The Record that attackers reached an older Danfoss system.
Which Retailers and Countries Were Hit
Reporting places affected stores in six countries: Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden. Store counts come from the retailers themselves and vary in precision.
| Country | Retailer | Stores affected |
|---|---|---|
| Belgium | Carrefour | 15 of more than 700 |
| Belgium | Colruyt Group (Spar franchises) | 5 |
| Belgium | Delhaize (Ahold Delhaize) | “A number of” stores; Le Soir reported about 40 Delhaize Proxy outlets |
| Belgium | IKEA | 1, with other sites not ruled out |
| Sweden | ICA | A small number; not quantified |
| Sweden | Coop | Six or seven of about 800, depending on the outlet |
| Sweden | Axfood | Freezers at a grocery home-delivery depot near Gothenburg |
| Ireland | SuperValu (Musgrave) | 13 of 223 |
| Estonia, Luxembourg, Netherlands | Various | More than a dozen stores combined |
The Record reported that more than 50 Belgian stores had been identified by Monday. Carrefour said the impact on its estate was limited, naming 15 of its more than 700 Belgian stores. Losses were not confined to large chains: a Belgian butcher, De Laet & Van Haver, found its fridges set to 18C and estimated about 15,000 euros, roughly $16,800, of ruined meat.
Is the Food Safe to Buy in Affected Stores?
In the stores that reported problems, the suspect stock was withdrawn rather than sold. Musgrave pulled chilled and frozen products from 13 SuperValu stores on Monday morning as a precaution, kept the stores open, and said other goods were unaffected, the Irish Times reported.
By Monday afternoon Musgrave said the matter had “been fully resolved”, that its stores were operating normally and that refrigerator restocking was “well advanced”. The company said its “monitoring systems alerted us to the issue, and we took immediate action”. It declined to name the affected stores or say how much stock was lost; the Irish Times understands the cost runs to thousands of euros.
In Belgium, temperatures in fridges and freezers rose above legally permitted limits, which is why stock was discarded rather than returned to sale. Shoppers who bought chilled or frozen food from an affected store on 2 November should check that retailer’s own notices, because no chain has published a product-level recall and the lists of affected stores have not been made public.
Why a Software Update Does Not Close This Hole
Patching alone will not settle this, because much of the affected equipment can no longer be patched. After the October attack in France, both Danfoss and Copeland said the compromised devices were mainly discontinued products that no longer receive security updates, The Record reported.
Sabcobel, the Belgian installer that manages refrigeration systems for Delhaize, said the affected units need physical modifications rather than a software update. Its chief executive, Stephan Moelans, said technicians were mobilised at 1am and that about 20 of the hundreds of units the company manages in Belgium were affected.
The Record also reported that a Danfoss newsletter in October announced a “hard End of Service” policy for legacy products, citing “recent European cybersecurity legislation” and saying continued support “would place Danfoss under new legal obligations to maintain security updates”. That detail comes from The Record’s reporting and has not been confirmed elsewhere.
There is currently no legal duty on manufacturers to fix products attacked this way. The EU Cyber Resilience Act tightens that from December 2027, when connected products must carry support periods matched to their expected lifetimes. Until then, the practical advice is the advice the Centre for Cybersecurity Belgium gave in October: audit the equipment, make sure no management interface is reachable from the public internet, and treat firewall filtering of a supplier’s IP addresses as a stopgap rather than a fix.
The October wave in France followed the same route into the same class of device, as set out in our report on the French supermarket cyberattack on Danfoss fridge controllers.
What Investigators Have Established
Nobody has been identified, and no group has claimed either wave. Belgium’s Federal Public Prosecutor’s Office opened an investigation on Monday 2 November, its spokesperson confirmed.
Katrien Eggers, a spokesperson for the Centre for Cybersecurity Belgium, said the agency was aware of the incident but had no further detail, adding: “It is not known who is behind this attack, and it may never be possible to identify them.” Eggers said the agency is concerned about the rising number of incidents, “partly due to the targeted use of AI”, while stressing that the CCB does not know whether AI was used in these attacks.
Reuters reported that it could not establish who was behind Monday’s attacks or whether they were connected to the French incidents. Tom Hegel of the security firm SentinelOne told Reuters that attacks of this kind usually involve extortion, political motives or nation-state operations, and that the absence of any financial demand points towards sabotage. That reading is an assessment, not a finding. State-linked intrusions into physical infrastructure have been documented before, as in the Volt Typhoon campaign that used hacked home routers as relays.
The European Commission has treated the pattern as deliberate. Christophe Hansen, the EU Agriculture Commissioner, called the attacks “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”. France’s cybersecurity agency ANSSI said in October that it was aware of attacks on refrigeration remote controllers from several different brands, and the Paris prosecutor’s office put the number of victims in the French wave at about 700.
Where Things Stand as of 3 November 2026
The disruption was contained within a day. Musgrave declared its incident fully resolved on 2 November, and the Belgian, Swedish and Irish retailers that reported problems have restocked or are restocking. No chain has reported a second overnight incident since.
What is unresolved is attribution and the equipment itself. The Belgian federal investigation is open with no suspects named, no group has claimed responsibility for either wave, and the controllers at the centre of both attacks remain in service in stores across Europe, in many cases past the point where their makers will issue security updates.
Frequently Asked Questions
What Caused the Supermarket Fridge Cyberattack?
Attackers reached internet-connected refrigeration controllers and triggered prolonged defrost cycles, which heated fridges and freezers instead of cooling them. Equipment from Danfoss and Copeland has been named. The entry method used on 2 November has not been disclosed.
Which Countries Were Affected?
Affected stores were reported in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden. Belgium accounted for the largest share, with more than 50 stores identified by Monday. Some outlets list a seventh country, Finland, which has not been widely confirmed.
How Hot Did the Freezers Get?
Freezers reached 50C, about 122F, in a Swedish ICA store and in the Estonian incident. A Belgian butcher found fridges set to 18C. In Belgium, temperatures went above the legally permitted limits for chilled and frozen storage.
Who Is Behind the Attacks?
Nobody knows publicly. No group has claimed responsibility for the November or the October wave, and Belgium’s cybersecurity agency has said it may never be possible to identify those responsible. A Belgian federal criminal investigation opened on 2 November.
Was Any Customer Data Stolen?
No retailer has reported a loss of customer data. The reported damage is to refrigerated stock and to the control systems themselves, not to payment or loyalty records.
