Europe Supermarket Freezer Cyberattack Prompts Belgian Criminal Probe

Refrigeration controllers sit at the quiet centre of the modern supermarket. They hold chilled cabinets at a few degrees, keep frozen goods far below zero, and are increasingly reached over the internet so that engineers can tune them without travelling to every store. That convenience became a liability on 2 November 2026, when attackers reached into those controllers across seven European countries and pushed supermarket refrigeration into defrost mode overnight, leaving retailers to throw away food and regulators to ask how consumer infrastructure had been left so exposed.

The geography was unusually wide for a single night. Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland all reported problems, and several chains confirmed they had been hacked rather than merely disrupted. The pattern matched an earlier wave in France, where hundreds of supermarkets were hit in October and millions of euros of food was destroyed. Retailers and suppliers quickly converged on one explanation: the attackers did not need to break into every shop, because the same remote management route appeared to reach all of them.

Belgium emerged as the centre of the response. Around 40 Delhaize stores in Belgium and Luxembourg were affected, Carrefour reported 15 Belgian stores, Colruyt reported five Spar shops, and about 15 Intermarche outlets also reported problems. IKEA said its store in Mons was hit. By Monday afternoon a Belgian media tally counted at least 76 supermarkets and other retail outlets with refrigeration problems, spread across both Flanders and Wallonia. Some shops used refrigerated trucks to protect stock; others simply pulled suspect items from sale.

The mechanism was described with unusual consistency. Sabcobel, the Belgian maker of the affected units, said evaporators were switched to defrost mode, the same method believed to have been used against French supermarkets in October. Stephan Moelans, the Sabcobel chief executive, said the fix is not a simple software patch: the units need physical modification, and the simplest long term answer is to manage fridges over a secure internet connection, a step most customers took after the French incident.

Key Facts

BBC reported on 2 November 2026 that dozens of supermarkets in seven European countries were hit by a cyber-attack on refrigerators and freezers, with around 40 Delhaize stores in Belgium and Luxembourg affected and smaller numbers in Sweden, Ireland, the Netherlands, Estonia and Finland. Sabcobel said evaporators were switched into defrost mode. Moelans told Belga that staff worked all night and morning to disconnect the affected units from the network.

Euronews reported on 2 November 2026 that Belgium's Centre for Cybersecurity, known as the CCB, was aware of an incident targeting refrigeration systems, and that the country's federal prosecutor's office had opened an investigation. CCB spokesperson Katrien Eggers said the agency was aware of an incident but had no further information, and that there were no reports yet on who was behind it. Belgian media reported fridge temperatures climbing to 17C in some cases, while Swedish ICA and Coop units were reported at 50C.

The Guardian reported on 2 November 2026 that chains in at least seven countries said temperatures soared overnight, and that EU food and agriculture commissioner Christophe Hansen called the repeated attacks deeply concerning and a deliberate attempt to disrupt the food supply chain and undermine consumer confidence. Sweden's Coop told Aftonbladet that six shops were hit, while ICA said a limited number of stores were affected by an incident overnight.

Xinhua reported via The Star on 3 November 2026 that Belgium's federal prosecutor's office had opened a criminal investigation into the attack early on Monday, and that at least 76 supermarkets and other retail outlets in Belgium had reported refrigeration problems by Monday afternoon. Carrefour Belgium said about 15 of more than 700 stores were slightly affected, mainly in frozen sections. In Ireland, SuperValu said a specific model in 13 of 223 shops was affected and chilled and frozen goods were pulled from sale. A Danfoss spokesperson told NOS that at least 17 Dutch companies had their cooling systems attacked, and a Selver store in Estonia was affected.

The costs were uneven but concrete. A Delhaize branch in Hoeilaart, in Flanders, told Het Laatste Nieuws it lost EUR 100,000 (GBP 83,500) of produce, excluding losses from closing. Moelans said losses could reach tens of thousands of euros per store if the cold chain was disrupted for too long. Sabcobel knew of about 20 affected units among the hundreds it manages, and technicians were mobilised at 01:00. The French wave in October, which Euronews said began on 12 October, hit as many as 700 supermarkets, caused fires and food losses estimated in the tens of millions of euros.

Analysis

What this really means is that the weakest point in the food supply chain is no longer the warehouse or the delivery truck but the small internet connected controller on the wall of a stockroom. These devices were installed to save money on maintenance visits. They were not designed to face the public internet, and in too many cases they were never moved behind a secure connection even after the French incident showed what could happen. The attack required no sophisticated malware and no insider. It required a reachable device and a command that the device was built to obey.

Danfoss, which supplied software in both the French and the new incidents, told VTM NIEUWS that customers who had not updated were affected and that the vulnerability lies mainly in outdated software. That framing is technically reasonable and strategically uncomfortable. It places responsibility on thousands of individual store operators to patch devices that many of them did not choose, cannot easily monitor and may not even know are reachable from the public internet. Moelans said Belgian chains had strengthened security since France, yet some systems still needed hardware changes rather than software updates.

The bigger picture here is that this was an attack on availability rather than confidentiality, and availability attacks against physical systems are cheap to launch and expensive to absorb. No theft of customer data has been reported. Instead, a remote command pushed evaporators into defrost mode, the cold chain broke, and food had to be discarded. A single store losing EUR 100,000 of produce is a local wound.

Attribution remains open. The CCB said it had no information on who was responsible, and Belgium's federal prosecutor has opened a criminal file without naming a suspect. Hansen, the EU agriculture commissioner, characterised the repeated attacks as deliberate, which is a political judgement as much as a technical one. The BBC reported that US authorities were investigating August refrigeration malfunctions at military bases and possible links with French officials, which widens the question from retail crime to something closer to infrastructure probing. What connects these episodes is not a proven single actor but a single class of device.

Why It Matters

For shoppers, the immediate effect is empty chilled shelves and the quiet suspicion that the food on offer was never properly cold. Delhaize spokesperson Sarah De Meester said ranges were temporarily somewhat limited but that distribution worked normally, and Carrefour said all affected stores stayed open. In Estonia, Jann Mutso of supplier Kitman Coldtech said attackers set a refrigeration computer to 50C but that the response came within minutes and caused no significant damage, which suggests detection and isolation can work when someone is watching.

For regulators, the case tests whether voluntary guidance is enough. The European Commission said the incidents showed how cyberattacks can disrupt services, affect businesses and directly impact citizens' daily lives, and that it would keep working with member states to strengthen cybersecurity across the bloc. The Commission did not announce binding rules. Belgium and Sweden's cyber agencies monitored the incident, while the UK's NCSC said it was working with partners and that no UK incidents were reported.

For the industry, the lesson is about legacy operational technology that was never treated as critical. Retailers count stores and margins, not exposed ports. Yet a defrost command reached from outside the building can destroy more value in one night than many stores earn in a year.

Next Up

Belgium's federal prosecutor will continue its criminal investigation, with the CCB still unable to say who was behind the operation. Sweden's cybersecurity centre has said the country has quite a lot of exposed operational technology that needs patching, and suppliers such as Sabcobel and Danfoss are pointing customers toward hardware changes and secure remote connections. The practical test is whether those upgrades happen across entire estates before another overnight wave, rather than store by store after the next incident.

The wider question is whether the European Commission moves from statements to requirements for internet connected refrigeration and similar building systems. Until then, the defence rests on the choices of individual retailers and the willingness of suppliers to make the secure configuration the default rather than an optional upgrade.