600/69 Tuesday, November 3, 2026
Reports have emerged of abnormal refrigeration system behavior at supermarkets across several European countries, with temperatures inside refrigerators and freezers rising unexpectedly and some incidents reportedly linked to cyberattacks. On November 2, 2026, retailers Ahold Delhaize and Colruyt disclosed IT incidents affecting refrigeration systems at dozens of stores in Belgium and Luxembourg. Supermarket chains ICA and Coop in Sweden, as well as a supermarket operator in Estonia, reported similar problems. In some cases, freezer temperatures were reportedly raised to as high as 50°C, creating a risk of spoilage for fresh and frozen products. However, there is currently no confirmation that all of the incidents were caused by the same threat actor or are directly connected.
In Belgium, Delhaize stores experienced abnormal increases in refrigeration temperatures. An executive from Sabcobel, the company that manages Delhaize refrigeration systems, stated that attackers changed evaporator operations to Defrost mode, a process intended to melt ice inside refrigeration equipment, causing the systems to generate heat instead of maintaining cold temperatures. Colruyt Group reported that refrigeration systems at five of its stores were attacked. In Sweden, an ICA Kvantum store in Sjöbo said its refrigeration system was targeted in a cyberattack that pushed temperatures to approximately 50°C, while ICA Baronen in Stockholm was also reportedly affected. The incident began at around 2:00 a.m. and was detected by staff at approximately 5:30 a.m. Coop also reported similar problems at six stores in central Sweden. In Estonia, Kitman Coldtech disclosed that a supermarket refrigeration system had been configured to 50°C.
The incidents follow cyberattacks against refrigeration systems at hundreds of supermarkets in France in October 2026, where attackers reportedly targeted Danfoss refrigeration controllers using login credentials to access internet-exposed management systems before continuously activating Defrost mode. This caused temperatures to rise to around 50°C, resulting in product losses and, in some cases, reported fires. Sweden’s cybersecurity authorities noted that many Operational Technology (OT) devices remain directly accessible from the internet, increasing the risk of unauthorized access. Operators are advised to review and update industrial control systems, apply available security patches, and restrict external access to OT devices to reduce the likelihood of unauthorized system control. The identity of the threat actors behind the latest incidents has not yet been confirmed.