Supermarket Freezer Attacks Reach Belgium, Sweden, Luxembourg

Supermarket freezer attacks have moved beyond France. Overnight into Monday, November 2, 2026, refrigeration systems at dozens of stores in Belgium, Luxembourg and Sweden showed sudden temperature rises, with some freezers set as high as 50°C. Retailers threw out spoiled stock, and several stores opened late or stayed closed for the morning.

The incidents are suspected cyberattacks. Sweden’s national cybersecurity center says it is responding to multiple incidents involving store cooling systems, and the refrigeration contractor that runs Delhaize’s installations in Belgium has called the Belgian events a cyberattack. As of November 2, no group has claimed responsibility, and no authority has named a suspect or an entry point.

Which Retailers Reported Problems?

Reports from retailers, local media and wire services put the scope as follows. Store counts vary between outlets, so the table gives the range where they differ.

Country	Retailer	Reported Impact
Belgium and Luxembourg	Delhaize (Ahold Delhaize)	About 40 stores; the company describes an “IT incident” affecting fridges and freezers
Belgium	Carrefour Belgium	15 stores; all remained open
Belgium	Spar stores operated under Colruyt Group franchise	Five shops; smaller Proxy Delhaize and Shop & Go outlets were also reported
Sweden	ICA	“A limited number” of stores operating outside ICA’s central network
Sweden	Coop	Six or seven of roughly 800 stores; Coop says the situation is contained
Estonia	Unnamed grocery chain	Temperatures set to 50°C, as reported by its refrigeration technology supplier

Store-level losses are already significant. One Delhaize store in Hoeilaart, Flemish Brabant, put its lost produce at €100,000, not counting revenue lost while closed. A Stockholm ICA store said the attack hit at 2 a.m. and staff noticed it at 5:30 a.m., and stores in Sjöbo and Tomelilla in southern Sweden stayed shut for the morning.

What Happened Inside the Cooling Systems?

The clearest technical account so far comes from Belgium. Stephan Moelans, CEO of refrigeration contractor Sabcobel, which operates Delhaize’s installations, told Belgian news agency Belga that the units’ evaporators had been switched into defrost mode. He said Sabcobel started sending technicians at 1 a.m. and spent the night and morning disconnecting the affected installations.

In Sweden, one ICA store posted that its fridge and freezer temperatures had been “hacked” overnight and set to 50°C. Another store wrote that the settings matched those seen during the French attack.

Neither retailers nor authorities have named the controller brands involved in these incidents. That matters: in France, more than one vendor’s equipment was targeted, so it is not safe to assume the same product line was hit in Belgium or Sweden.

Is This Confirmed as a Cyberattack?

Not formally. The evidence so far points toward remote tampering, but the wording from each party differs:

• Sweden’s national cybersecurity center: Head John Billow confirmed the center is working on several incidents affecting grocery refrigeration and said Sweden has “quite a lot of exposed operational technology devices” that need updating or patching
• Belgian refrigeration contractor: Sabcobel’s CEO described the Belgian events as a cyberattack
• Ahold Delhaize: Calls it an IT incident under investigation
• ICA and Coop: Confirm overnight incidents affecting refrigeration and freezer systems at a limited number of stores
• Belgian and Swedish national cyber agencies: Both say they are monitoring the incidents

Ahold Delhaize separately dealt with an October security issue that forced it to shut down and later restore some IT systems, and it reported suspicious activity to Dutch police last month. No source has linked that earlier incident to the refrigeration problems.

The Same Overnight Pattern, Three Times in Three Months

The November incidents look like the French supermarket cyberattack of October 11 to 12, and both resemble refrigeration failures at U.S. military commissaries in August. A shared attacker has not been established for any of them.

The table below compares the three recent freezer attacks in detail, including the equipment named so far, which has been disclosed only for France.

The U.S. Army’s Criminal Investigation Division has said it is working with French law enforcement to understand the European outages. That coordination does not show the incidents share an attacker. Separate open-source analysis has also traced the unclaimed pattern from the commissaries to France.

Why Refrigeration Controllers Keep Getting Hit

Large stores run their refrigeration through centralized controllers that manage setpoints, alarms and defrost schedules for every case and cold room. Maintenance firms often reach these controllers remotely, and some sit directly on the internet with a web management interface.

France’s CERT-FR alert on the October attack warned that exposing these interfaces goes against basic practice and that the campaign was probably still ongoing. It said an end-of-life controller left online has a very high chance of compromise, and that a factory reset alone does not help, because the device stays vulnerable and is likely to be hit again. SOCRadar’s own October snapshot found roughly 2,900 exposed Danfoss StoreView services in France alone.

The risk is not limited to one country. Swedish officials now say they have many exposed operational technology (OT) devices to fix, and retailers often depend on contractors who control the remote access path.

Who Could Be Behind It?

No group has claimed the French, U.S. or new European incidents, and no government has attributed them. The attacks so far show no ransom demand or data theft, which makes disruption the more likely goal than profit.

Commentators have raised state-backed sabotage as one explanation, while others note that unsecured controllers are within reach of low-skilled actors. Both readings remain possible. Until there is a credible claim or official attribution, any link to a named group should be treated as speculation.

What Retailers and Refrigeration Contractors Should Check Now

CERT-FR’s guidance from the French incident applies to any retailer running remotely managed refrigeration, whatever the vendor:

• Remove refrigeration controllers from direct internet exposure, including any unit on a public IP address
• Restore remote access only through a secured VPN or protected network; filtering contractor source IPs is an emergency measure, not a fix
• Review the full controller configuration, especially defrost schedules, temperature setpoints and alarm settings
• If a controller shows signs of tampering, restart or factory reset it and reconfigure it before reconnecting, but only after the exposure is closed
• Update firmware, apply the vendor’s strictest security mode where one exists and confirm default passwords are changed
• Plan replacement of end-of-life controllers that no longer receive updates

Retailers should also ask their refrigeration contractors how they connect to each store and who holds those credentials. Independent temperature alarms that do not depend on the controller give staff a second warning at night, when every one of these incidents began.

Protect Your OT Systems and Supply Chain with SOCRadar

In every country hit so far, the attacks targeted refrigeration controllers managed remotely by contractors. CERT-FR found the compromised French controllers exposed to the internet, and Sweden’s cybersecurity center reports many exposed OT devices still waiting for updates. Security teams rarely see these systems. SOCRadar helps close that gap in three ways:

• Attack Surface Management: Finds refrigeration management interfaces and remote access services exposed across your IP space, including ones a contractor set up without your security team’s knowledge, so you can take them offline before attackers find them
• Supply Chain Intelligence: Tracks the security posture of refrigeration contractors and other OT service providers, and flags when a supplier you depend on shows signs of compromise
• Dark Web Monitoring: Watches hacktivist channels and underground forums for attack claims, leaked access or chatter that names your brand, your suppliers or the food retail sector

External visibility shows where you are exposed and who is talking about you, but only a controller’s own configuration and event logs can confirm whether it was changed. Every one of these incidents happened overnight, when no one was watching the cases. Taking exposed controllers off the internet and reviewing contractor access now is the best preparation for the next wave.