Hackers heat supermarket freezers to 50C across Belgium, Sweden and Ireland: a second attack in a month

Supermarkets across northern Europe woke up on Monday, November 2, to freezers and fridges running far above their set temperatures after what store operators described as an overnight cyberattack, Reuters reported. The wave stretched from Sweden to Belgium and Ireland and follows an attack on cooling units at hundreds of French supermarkets last month.

What is confirmed so far

• Belgium and Luxembourg: Ahold Delhaize and Colruyt said an IT incident overnight hit fridges and freezers in dozens of stores. Colruyt said five Spar shops it supplies under franchise were affected. Carrefour said 15 of its 700 Belgian stores were hit.
• Sweden: ICA said a "limited number" of stores had a refrigeration incident, and Coop told the paper Aftonbladet that six stores were affected. An ICA franchise manager in Stockholm told Reuters the freezers reached 50 degrees Celsius and that the attack, which began around 2 a.m., was only noticed hours later.
• Ireland: wholesaler Musgrave said 13 SuperValu stores had refrigeration systems hit and that it pulled some chilled and frozen products from sale.
• Estonia: a supermarket chain was also affected, with temperatures set to 50C, according to the supplier Kitman Coldtech via public broadcaster ERR.

The head of Belgian refrigeration contractor Sabcobel, which runs Delhaize's systems, told Belga that the attack switched evaporators into defrost mode, and that his team spent the night disconnecting affected units from the network. Sweden's national cybersecurity center said it is working on several incidents and that it has "identified quite a lot of exposed operational technology devices" that need patching. Reuters could not establish who was behind the attacks or whether they are linked to the French incident, and nobody has claimed responsibility.

Why there is no ransom story yet

Tom Hegel, a researcher at SentinelOne, told Reuters that attacks like these are usually extortion, politically motivated, or state-level, and that the lack of financial demands in the recent supermarket cases points toward sabotage. We cannot say more than that: attribution is open, and Russia has repeatedly denied involvement in sabotage or hybrid warfare, according to Reuters.

The number that shows how exposed the sector is

Large chains lose stock when this happens, but the damage is far larger per store for small operators. A Belgian butchery owner, Luc De Laet, told Reuters he found his display fridges at 18C in the morning and that about 15,000 euros ($16,764) of meat was ruined. For a single shop, that is a heavy loss from one night.

The weak point is the controller, not the fridge. Modern refrigeration is monitored and programmed remotely, so a compromised vendor portal or an unpatched controller can reach every store on that platform at once. That is why one contractor's network can produce dozens of affected shops across a country.

Who it hits in the US

Nothing in the Reuters report places this attack outside Europe, and we are not suggesting US stores are affected. But the exposure is the same kind of equipment. Our business listings show roughly 109,000 independent grocery operations and about 605,000 independent restaurants in the United States, plus about 35,600 bakeries, all of which depend on remotely monitored refrigeration. Many rely on a single HVAC or refrigeration contractor with remote access, and on a food-safety log that assumes the temperature alarm works.

• Check who has remote access to your cooler and freezer controllers, and whether the default password was ever changed.
• Keep a standalone thermometer with its own battery alarm that is not on the same network.
• Read your policy: ask your agent in writing whether spoilage from a cyber event is covered.
• Check your local health department's rule on discarding food held above safe temperature before you need it.

See our counts by trade at /playbook/restaurants.

The market angle

Ahold Delhaize and Carrefour are the publicly listed chains named in the report, while ICA and Coop are privately held. Our own chart shows Ahold Delhaize about 7.6% below its August 3 peak in the latest price data we pulled on November 2. We do not have a verified move for any of these stocks that traces to the cyberattack, so we are not drawing one. What to watch: whether the companies disclose the cost of spoiled stock, and whether regulators in Belgium, Sweden and France treat the three incidents as one campaign.

Sources: Reuters, via CNBC, November 2, 2026; price history via Yahoo Finance; independent business counts from the Chronicle's listings database (chains excluded). This is market information, not investment advice.