Europe’s cold chain gets hit again
Europe’s supermarket cold chain faced a fresh operational shock on Monday, November 2, 2026, as fridges and freezers in several countries suddenly warmed, spoiled food and triggered investigations into apparent or suspected cyberattacks. The incidents were reported in Sweden, Belgium, Luxembourg, Ireland and Estonia, with the Associated Press saying some retailers were forced to dispose of ruined goods after refrigeration systems malfunctioned in ways that appeared to be cyber-related .
The timing matters. This was not a single broken compressor or a local power failure. It followed a similar October incident in France, where attackers remotely manipulated refrigeration systems in hundreds of stores, sending temperatures sharply upward and turning supermarket cooling equipment into a visible food-safety problem . On November 2, the pattern appeared to repeat across borders: overnight changes, sudden warming, affected fresh and frozen stock, and retailers scrambling before morning trading.
The most important lesson is not that supermarkets use software. Everyone does. It is that mundane connected equipment can become a physical-risk target. A hacked billing system may stop a checkout line; a hacked freezer can destroy food, interrupt supply, create regulatory exposure and undermine trust before any corporate laptop shows a ransom note.
What was affected
The known footprint was uneven but broad. AP reported problems in Sweden, Belgium, Luxembourg, Ireland and Estonia . CBS News, citing AFP and Reuters, said grocery chains in at least three European countries reported unexpected temperature spikes on Monday that ruined food, describing the incidents as the second such wave in less than a month .
Belgium appears to have been one of the main centers of disruption. Delhaize said an IT incident affected refrigeration systems in several dozen stores, while Carrefour said a cyberattack targeting refrigeration systems affected 15 of its more than 700 Belgian stores . Reuters reported that Ahold Delhaize and Colruyt said overnight issues hit fridges and freezers in dozens of stores in Belgium and Luxembourg, while Swedish chains ICA and Coop reported similar temperature spikes .
Euronews reported that about 40 Delhaize stores were impacted, with Carrefour and Spar also affected, and said one Belgian incident produced around €100,000 worth of discarded food . That figure should be read as an early store-level indicator rather than a final system-wide estimate, but it shows how quickly a “small” operational-technology incident can become a balance-sheet loss.
Sweden saw a parallel pattern. ICA said a limited number of stores were affected overnight, while Coop reported problems in six stores, according to AP and CBS . One ICA store in Sjöbo, southern Sweden, posted that its fridges and freezers had been hacked and set to 50°C, forcing staff to discard affected products . CBS said Swedish supermarkets had to throw away spoiled food and that one affected ICA outlet explicitly blamed a hack .
The disruption was not limited to the largest chains. In Estonia, a refrigeration technology company said attackers accessed a computer controlling a client’s refrigeration system and raised the temperature to 50°C; the company said the problem was handled within minutes and caused no significant damage, while the Selver chain said one outlet was affected . In Ireland, AP reported that 13 SuperValu stores were affected and that chilled and frozen products were removed from sale as a precaution . In the Netherlands, NL Times reported that at least 17 businesses, mainly butcher shops and small local grocery stores, had refrigeration and freezer temperature settings altered, while large supermarkets were not known to be affected .
The technical pattern: defrost as a weapon
The reported mechanism is disturbingly simple. In Belgium, Stephan Moelans, chief executive of refrigeration company Sabcobel, told Belga that the incident was a cyberattack in which evaporators were switched into defrost mode; Reuters repeated that account and noted Sabcobel operates Delhaize systems . CBS quoted Moelans saying technicians began mobilizing at 1 a.m. and worked through the night and morning to disconnect affected units from the network .
This is the operational-technology twist. Attackers do not necessarily need to steal data, encrypt servers or damage hardware. If they can change a setpoint, trigger defrost or lock out remote control, the store itself becomes the damage surface. A freezer that should protect stock becomes a heater, and the safety response is blunt: if the cold chain is broken, retailers must remove products from sale.
The Record reported that the latest wave resembles the French attacks three weeks earlier, in which internet-exposed remote controllers for refrigeration systems were compromised across numerous supermarkets . It also reported that no group had claimed responsibility for Monday’s hack or the earlier French incident, and that no law enforcement or government agency had publicly identified the perpetrators . That caution is essential. The behavior looks malicious, and several companies or contractors have described it as a cyberattack, but attribution remains unresolved.
Why food safety makes this different
For shoppers, a closed freezer aisle is an inconvenience. For retailers, it is a safety, compliance and logistics event. Fresh and frozen goods depend on continuous temperature control; once that assurance is lost, the cost is not only the product in the cabinet but also the labor to inspect, discard, restock and reassure customers.
The incidents also show how connected refrigeration creates a “silent critical infrastructure” problem. Supermarket cooling is not usually discussed like electricity grids or hospitals, but it performs a public function: preserving meat, dairy, seafood, prepared foods and frozen goods across dense urban networks. The November 2 events did not need to stop trucks, disable payment systems or close every store to create pressure. They attacked preservation itself.
That is why segmentation, authentication and offline safeguards now belong in the retail security conversation. Cybersecurity teams have traditionally prioritized endpoints, cloud identity, payment systems and ransomware recovery. Those remain vital. But the freezer attacks show that remote maintenance paths, contractor credentials, exposed controllers and default configurations can be equally consequential when they connect to physical processes.
What retailers should do now
The immediate response is practical, not glamorous. Retailers and refrigeration contractors should identify every remotely accessible controller, remove direct internet exposure, and require secure remote access rather than unmanaged public interfaces. SOCRadar’s November 2 analysis recommended taking exposed controllers offline, using secured VPN or protected-network access, reviewing defrost schedules and temperature setpoints, updating firmware, changing default passwords and replacing end-of-life controllers that no longer receive security updates .
Independent temperature monitoring is just as important. If the refrigeration controller itself is compromised, an alarm that depends on the same system may not be enough. Retailers need out-of-band temperature sensors, local manual override procedures, store-level escalation lists and clear discard rules that work at 3 a.m., not only during office hours.
The business lesson is sharper still: operational technology cannot remain a facilities-only asset. Refrigeration vendors, store operators, IT security teams and food-safety managers need a shared inventory and a shared incident plan. If a contractor can reach a freezer from outside the store, the retailer must know how, with which credentials, through which network path and with what logging.
The second wave across Europe has made one thing clear. The cold chain is no longer just a logistics discipline; it is a cybersecurity boundary. When attackers can set Europe’s freezers to hard mode, resilience means keeping the food cold even when the network gets hot.
Comments
Be the first to comment.