Cyberattacks leave European stores throwing away food

Retailers across seven European countries reported refrigeration failures on November 2, 2026, after suspected cyberattacks disrupted temperature controls, forcing supermarkets to withdraw chilled and frozen food and discard spoiled stock.

Reports of affected businesses emerged from Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden. An ICA Kvantum supermarket in Sjöbo, southern Sweden, reported that its freezer settings had been changed to 50°C.

The incidents followed attacks on hundreds of French supermarkets in October. Investigators have not established whether the latest disruptions were coordinated or connected to the French cases, and no group has claimed responsibility for the European attacks.

European retailers withdraw food as cooling systems fail

Ahold Delhaize reported an overnight IT incident affecting refrigeration systems at several Belgian stores. Carrefour confirmed problems at 15 of its 700 Belgian outlets, while refrigeration systems at about five Spar stores were also affected.

In Ireland, Musgrave Group confirmed a cybersecurity incident involving refrigeration equipment at 13 SuperValu supermarkets. Affected stores temporarily removed chilled and frozen products from sale as a precaution.

Sweden’s ICA Kvantum store in Sjöbo described the 50°C setting, equivalent to 122°F, in a Facebook post and attributed the problem to suspected hacking. ICA Sverige told Bloomberg that an overnight incident had affected refrigeration and freezer systems at a limited number of stores, but did not initially confirm the cause. Coop separately confirmed hacking incidents affecting seven stores.

Finland’s Kesko reported abnormal overnight temperatures in refrigeration equipment at a small number of K-food grocery stores. Automated alerts and checks by employees arriving for work prompted an investigation. Kesko had not ruled out an IT-related cause and explained that the affected equipment operated outside its centrally protected systems.

Local media also reported similar incidents in Estonia. The broader reporting subsequently included businesses in Luxembourg and the Netherlands, expanding the initial five-country account.

The losses could be substantial for individual retailers. The New York Times reported that spoiled food at one Delhaize supermarket in Belgium was worth €100,000, approximately THB3.8 million, after a refrigeration alarm sounded at around 4am.

Internet-exposed controls create a route to physical damage

Supermarket refrigeration systems increasingly allow staff and contractors to monitor and adjust equipment remotely. Central controls can manage dozens or hundreds of units, reducing operating costs but creating security risks when access is inadequately protected.

Kevin Tellier, a cybersecurity engineer at Synacktiv, explained to France 24 that many refrigeration controllers use a web interface through which authorised users can change temperatures. Although these controls should normally operate within a closed network, some are accessible directly from the internet.

Vincent Strubel, head of France’s national cybersecurity agency, attributed the October attacks to basic security shortcomings in comments to AFP. Strubel highlighted equipment exposed directly to the internet without adequate protection and the use of weak passwords.

The French incidents involved refrigeration controllers manufactured by Denmark’s Danfoss. The company identified both obsolete products that no longer receive security updates and supported products running outdated software among the affected equipment.

Danfoss has advised customers to update supported systems, replace obsolete equipment, strengthen network protection and remove direct internet exposure where applicable. The existence of a software vulnerability, however, does not establish which method attackers used in a particular incident.

Tom Hegel, a cybersecurity researcher at SentinelOne, explained to the BBC that access to these controls can turn ordinary functions, including defrosting, into a means of disruption. Changing settings can destroy physical stock without requiring attackers to steal money or customer information.

French, Israeli and US incidents remain separate investigations

The October attacks in France reportedly affected as many as 700 stores, including outlets operated by Intermarché, Coopérative U and Carrefour. Refrigeration failures forced retailers to dispose of spoiled food.

Ahold Delhaize also experienced a separate cybersecurity incident in the Netherlands in October, disrupting services for several days and leaving gaps on supermarket shelves. A connection between that disruption and the refrigeration attacks has not been established.

Olivier Daloy, a cybersecurity specialist at Zscaler, told AFP that identifying the perpetrators was particularly difficult. Tellier also cautioned that the relatively unsophisticated nature of the refrigeration attacks did not reveal whether those responsible had substantial resources.

An earlier incident in Israel demonstrated the potential for equipment damage. Omri Segev Moyal, chief executive and co-founder of cybersecurity company Profero, told NPR that attackers targeting a major food retailer in May had overworked refrigeration compressors until they failed and produced smoke.

Moyal’s description concerned mechanical failure, not an explosive device. The Israeli incident also involved malware designed to erase computer data and compromised printers producing threats and propaganda.

Moyal attributed the Israeli attack to an Iranian hacking group that US and Israeli officials had linked to Iran’s military. That assessment does not establish any connection to the European incidents.

In the United States, refrigeration outages at military bases in August remained under investigation. The US Army Criminal Investigation Division confirmed that cyber specialists were examining failures at military commissaries and coordinating with French law enforcement. The Pentagon had not confirmed that cyberattacks caused the US outages.

Connected appliances require protection beyond the supermarket

Internet-connected household appliances can also present security risks, although the BBC reported no evidence that domestic appliances were targeted in the latest European supermarket incidents.

Smart fridges, washing machines, heating and air-conditioning systems allow owners to monitor or control equipment remotely. Cameras, doorbells, alarms, digital locks and thermostats can offer similar connectivity.

RTÉ reported that compromised devices could expose personal information, allow unauthorised changes to settings or prevent owners from accessing equipment. Poorly protected devices may also provide a route into other systems on a home or business network.

Earlier research illustrates the range of possible consequences. In 2015, researchers demonstrated a Samsung smart-fridge weakness that could expose some transmitted information. A separate remote-hacking demonstration involving a Jeep that year prompted the recall of about 1.4 million vehicles.

The Stuxnet malware, identified in 2010, damaged Iranian uranium-enrichment centrifuges, illustrating how malicious software can affect physical machinery. Such examples do not establish that different devices or infrastructure systems have equivalent vulnerabilities.

Ciaran Martin, former head of Britain’s National Cyber Security Centre, has argued that manufacturers should build security into products rather than leave consumers solely responsible for managing the risks.

UK rules that took effect in April 2024 introduced minimum security requirements for relevant consumer smart devices. These include restrictions on universal default passwords, a channel for reporting vulnerabilities and disclosure of the minimum period for which security updates will be provided.

For households, cybersecurity guidance includes replacing default passwords, enabling multifactor authentication where available and installing security updates. Consumers should also consider replacing connected devices that no longer receive security support.

For businesses, reducing unnecessary internet exposure and separating equipment controls from other networks can limit risk. Older machinery presents additional challenges because installing updates may require downtime and interrupt trading.

Hegel stressed that retailers need clear responsibility for equipment security, extending beyond the contractors responsible for repairs. Security specialists also raised concern that artificial intelligence could help attackers identify weaknesses more efficiently, although this does not establish that it was used in these incidents.

Richard Jones, a senior lecturer in criminology at the University of Edinburgh, told The New York Times that the attacks challenged assumptions in Western countries that food security could be taken for granted.