Second Suspected Cyberattack on Refrigerators in Europe

⏱️ Reading time: 10 min

European supermarket refrigerators failed again in the early hours of November 2, 2026, just weeks after a hack that ruined tons of food in France. Chains in Sweden, Belgium, and Luxembourg reported temperature spikes in their cold rooms overnight, and the new supermarket cyberattack reignited concerns about how exposed internet-connected refrigeration systems really are.

📑 En este artículo

1. TL;DR
2. What an internet-connected refrigeration controller is
3. What happened in the supermarket cyberattack
4. The backstory: the French refrigerator hack
5. The mechanism: why disabling an alarm is enough to ruin a cold room
6. Impact and analysis of the attack on refrigeration systems
7. Why the cold chain is an attractive target
8. What’s next after the intrusion into the Danfoss controllers
9. Frequently Asked Questions
   1. Which countries reported the new supermarket cyberattack?
   2. What is a Danfoss controller, and why was it targeted in France?
   3. How much did supermarkets lose in the French refrigerator hack?
   4. Who is investigating the attack on refrigeration systems in France?
   5. Is there confirmed attribution for the intrusion into the Danfoss controllers?
10. References

The Swedish group Coop confirmed six affected stores, while ICA reported being aware of a limited number of locations with refrigeration and freezing failures. In Belgium and Luxembourg, the Dutch company Ahold Delhaize detected the same pattern across dozens of supermarkets and convenience stores.

TL;DR

• Coop, ICA, and Ahold Delhaize report refrigerator failures in Sweden, Belgium, and Luxembourg on November 1 and 2, 2026.
• Technicians disconnected equipment from the power grid to stop the temperature rise.
• The attack comes weeks after the refrigerator hack that affected up to 700 stores in France.
• In France, the attackers used Danfoss controllers to raise the temperature from -27°C to over 50°C.
• ANSSI is investigating the French case while European chains review their refrigeration systems.

What an internet-connected refrigeration controller is

An internet-connected refrigeration controller is the device that regulates the temperature of industrial refrigerators and freezers and allows it to be adjusted remotely. It’s the component attackers manipulated in the first supermarket cyberattack, in France, and the one Sweden, Belgium, and Luxembourg are now reviewing.

What happened in the supermarket cyberattack

The Swedish chain Coop confirmed to Aftonbladet that six of its stores were affected, while ICA said it was “aware that a limited number of stores were affected by an overnight incident that impacted their refrigeration and freezing systems.”

In Belgium and Luxembourg, the Dutch group Ahold Delhaize reported an “IT incident” at dozens of supermarkets, according to spokeswoman Sarah De Meester. The Belgian newspaper Le Soir identified five Spar stores, several Shop & Go convenience stores attached to Q8 gas stations, and some Proxy Delhaize minimarkets among the affected locations.

“We started mobilizing technicians at 1 a.m.,” said Stephan Moelans, CEO of Sabcobel, a company specializing in refrigeration system installation, to the same newspaper. “We spent the whole night and morning disconnecting the affected facilities from the power grid.”

None of the three chains specified how many tons of product were lost or confirmed whether merchandise had to be discarded, unlike what happened in France. The lack of concrete figures suggests the European incident, for now, was contained before causing the same economic damage as the French attack, though the investigation is just beginning.

The backstory: the French refrigerator hack

French police said in October that a group of attackers took control of the cooling systems of up to 700 supermarkets in a large-scale attack that caused massive losses of refrigerated and frozen food. The attackers remotely reconfigured thousands of freezers, refrigerators, and display cases, pushing temperatures from as low as -27°C to over 50°C.

Chains including Intermarché, Coopérative U, Carrefour, Leclerc, and Monoprix were among those affected. Stores had to discard large quantities of fresh meat, dairy, and frozen products. Losses ranged from tens of thousands of euros to over €130,000 per location, and two stores in Alsace reported a combined loss of €270,000.

Most supermarket refrigerated aisles are connected to the internet to enable remote maintenance and system failure alerts. In the French attack, hackers breached controllers supplied mostly by the Danish company Danfoss. They disabled the alarms before adjusting the thermostats or extending the defrost cycle for hours.

Although neither French police nor ANSSI publicly detailed how the attackers gained access to the controllers, the pattern (exposed remote management panels and alarms disabled before touching the thermostat) matches the typical sequence of an attack on industrial control systems: first reconnaissance, then access, and only at the end, visible manipulation.

The Paris prosecutor’s office opened a formal investigation into the attack, and Prime Minister Sébastien Lecornu instructed the national cybersecurity agency, ANSSI, to investigate the case. ANSSI later confirmed that supermarkets using controllers from two other companies were also targeted.

The mechanism: why disabling an alarm is enough to ruin a cold room

A commercial cold room isn’t controlled by a standalone thermostat. The central controller receives data from temperature sensors and manages the compression cycle. Every few hours it triggers a defrost cycle that briefly heats the coil, to prevent ice from blocking airflow.

If someone with remote access stretches that cycle from minutes to hours, the heater stays on far longer than the system can tolerate. The second step of the attack in France was disabling the temperature alarms, the mechanism that normally alerts a manager or an on-call technician when a room heats up outside the safe range.

flowchart TD
A["Remote attacker"] --> B["Connected refrigeration controller"]
B --> C["Disables temperature alarms"]
B --> D["Extends the defrost cycle"]
C --> E["No one gets notified"]
D --> F["Cold room temperature rises"]
E --> F

Without that alarm, no one finds out until the merchandise is already damaged or until an employee notices the problem by chance, as happened in Sweden in the early hours of November 2. The cost isn’t in the attack itself, but in what it takes to fix it under pressure: mobilizing technicians overnight, manually disconnecting each facility from the power grid, as Sabcobel did in Belgium, and inventorying and discarding everything that exceeded the safe temperature range.

Refrigeration controllers rarely get the same level of patching as a corporate laptop. Many are still running factory firmware years after installation, protected only by a default password the installer never changed. It’s the same root cause behind much of the industrial control system incidents, from water pumps to building climate systems.

Impact and analysis of the attack on refrigeration systems

The November episode confirms something the French attack had already hinted at: the risk isn’t concentrated in a single vendor. When ANSSI confirmed that the French attackers also targeted controllers from two other brands, it became clear that the exposure spans the entire European cold chain, not an isolated manufacturer.

For a supermarket chain, the economic calculation is simple. The cost of keeping refrigeration controllers exposed to the internet without network segmentation is much lower, in the short term, than isolating them behind a network separate from the rest of the store. The attack in France, with losses of up to €130,000 per location, shows that short-term difference reverses quickly once an attacker shows up with the right credentials.

For an insurer, an attack that destroys perishable inventory is different from one that only paralyzes IT systems: there’s no reversing it once the food has spoiled. That pushes chains to invest in containment, such as redundant alarms and physical sensors independent of the connected controller, instead of relying solely on data backups, which do nothing when the problem is thermal.

Why the cold chain is an attractive target

Unlike ransomware, which encrypts files and allows time to negotiate, an attack on refrigeration works against a biological clock: food spoils even if the company decides not to pay anything or negotiate with anyone. That turns every hour of exposure into a direct economic loss, without the attacker ever needing to demand a ransom.

Industrial refrigeration systems are usually connected to the internet for legitimate reasons: they alert when a unit fails, enable remote diagnostics without sending a technician to every store, and adjust cycles based on electrical demand. That same access that enables those benefits is what, without proper network segmentation or strong authentication, opens the door to an attacker.

The pattern repeats across other internet-exposed industrial control systems. Cameras, water pumps, and climate control units have been targeted by similar attacks in recent years, almost always due to the same combination of default credentials and administration panels accessible from outside the corporate network.

What’s next after the intrusion into the Danfoss controllers

Ahold Delhaize already had a recent track record: last month it reported a separate cybersecurity incident to Dutch police, according to the original report. That history suggests the company will face questions about whether it strengthened its remote access controls after that first warning.

In France, the Paris prosecutor’s investigation remains open, and ANSSI still hasn’t published any public attribution of who is behind the attack. Meanwhile, Danfoss maintains its recommendation to update the firmware on older controllers, the same recommendation the company says has been in circulation since last year.

To be clear about the limits of what’s known today: both the Sweden, Belgium, and Luxembourg episode and the French one remain classified as “suspected” attacks. Neither the chains nor ANSSI has publicly confirmed which group is behind them, and as of this report’s publication there were no official loss figures outside France.

If you manage connected refrigeration systems, review Danfoss’s security advisory on its official website today and confirm that your controllers’ firmware is on the recommended version.

Frequently Asked Questions

Which countries reported the new supermarket cyberattack?

Sweden, Belgium, and Luxembourg reported refrigeration system failures overnight on November 1 to 2, 2026, with the chains Coop, ICA, and Ahold Delhaize among those affected.

What is a Danfoss controller, and why was it targeted in France?

Danfoss is the Danish manufacturer of refrigeration controllers that operated most of the equipment affected in the French attack. The company said it had identified the security flaws since 2025 and had recommended installing updates.

How much did supermarkets lose in the French refrigerator hack?

Losses ranged from tens of thousands of euros to over €130,000 per store, with two locations in Alsace reporting a combined loss of €270,000.

Who is investigating the attack on refrigeration systems in France?

The Paris prosecutor’s office opened a formal investigation, and Prime Minister Sébastien Lecornu instructed ANSSI, the national cybersecurity agency, to investigate the case.

Is there confirmed attribution for the intrusion into the Danfoss controllers?

No. Both the French attack and the one in Sweden, Belgium, and Luxembourg remain classified as “suspected” incidents, with no group or state actor publicly confirmed.

References

• The Guardian: original report on the second suspected cyberattack in Sweden, Belgium, and Luxembourg, with context on the French hack.
• Danfoss: Danish manufacturer of the refrigeration controllers affected in the French attack.
• ANSSI: France’s national cybersecurity agency in charge of investigating the incident.
• Wikipedia: corporate background on the Dutch-Belgian group that operates the affected chains in Belgium and Luxembourg.

📱 Enjoy this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.

Featured image: Foto de ThisisEngineering en Unsplash