Three weeks after hackers cooked the freezers at hundreds of French supermarkets, it happened again overnight into Monday, Nov. 2, and this time it crossed borders. Retailers in Belgium, Luxembourg, Sweden, Ireland and Estonia reported fridges and freezers heating up in the small hours, Reuters reported. Nobody has claimed responsibility, and no government has named a suspect.
At an ICA franchise store in Stockholm, the sales manager, Engla Ingwall, told Reuters the attack began at 2 a.m. and wasn’t noticed for hours. By then every freezer had reached 50 degrees Celsius (122 Fahrenheit). “Everything is destroyed,” she said.
How many countries were hit depends on who’s counting. The BBC put the figure at seven, adding Finland and the Netherlands, according to a Sinclair-network report that cited it. We couldn’t read the BBC article itself, and we found no retailer or official in Finland or the Netherlands confirming an incident. The table below sorts what each country’s own companies and agencies have said from what has only been reported.
Country by country, as of Monday evening
| Country | Who’s affected | On whose word |
|---|---|---|
| Belgium | Delhaize (reports say about 40 stores), Carrefour (15 of 700), Colruyt’s Spar shops (5), one IKEA store, one De Laet & Van Haver butcher shop | The companies, to Reuters and Belga |
| Luxembourg | Delhaize and Colruyt stores; no count given | Ahold Delhaize and Colruyt, to Reuters |
| Sweden | ICA (a “limited number” of stores) and Coop (six or seven stores) | ICA and Coop; Sweden’s NCSC says it’s handling several incidents |
| Ireland | SuperValu, 13 of 223 stores | Musgrave, the chain’s owner |
| Estonia | One unnamed chain, units set to 50°C | Supplier Kitman Coldtech, to broadcaster ERR |
| Finland, Netherlands | Not specified | BBC, as cited by others; unconfirmed |
| United Kingdom | No stores reported hit | Coverage we read |
Some of the numbers don’t match. Coop told Aftonbladet that six stores had problems, while a later Reuters update put it at seven of its roughly 800. The Irish Times said Swedish freezers were turned up as high as 55 degrees, against the 50 degrees reported by stores in Stockholm and Sjöbo. Delhaize itself has said only “dozens” and called it an “IT incident” without naming a cause. The “about 40” figure comes from social posts and a report that gave no source.
Ireland’s case was over by the afternoon.
Musgrave said a “specific model” of refrigeration was affected, pulled chilled and frozen products from sale in the 13 stores, and then said the matter had been fully resolved, the Irish Times reported. The company hasn’t named the model or said what the stock was worth.
A defrost cycle, left running
The method appears to be the one used in France. Stephan Moelans, chief executive of Sabcobel, the firm that runs Delhaize’s refrigeration systems, told the Belgian news agency Belga that the attackers had switched the units’ evaporators into defrost mode. That’s a routine function that warms the coils to melt ice. Left on, it turns a freezer into an oven. Moelans said his team spent the night disconnecting affected units from the network.
He also suggested the fix had been available for weeks. Most of his customers moved to a secure connection “after the attack in France,” he said, according to a report by Sinclair’s National News Desk. He didn’t say whether Delhaize was among them.
Luc De Laet, who owns the Belgian butchery chain De Laet & Van Haver, told Reuters that his store in Hove, south of Antwerp, lost about €15,000 of meat, with its fridges climbing to 18 degrees. The hackers, he said, “can program it at a distance.” He called the police and didn’t know whether anyone was investigating.
Danfoss, the Danish manufacturer whose controllers were at the center of the French attack, turns up again. Reuters reported that at least some of Monday’s affected units used its temperature-control technology, and Coop said Danfoss was among its suppliers. Danfoss said it had been working with customers on fixes, Reuters reported.
Nobody has said which models were involved this time. We couldn’t load Danfoss’s newsroom to check for a new statement.
France’s alert never closed
The clearest official record is the one France published during the first wave. CERT-FR, the incident-response arm of the French cybersecurity agency ANSSI, issued alert CERTFR-2026-ALE-012 on Oct. 12 and updated it through Oct. 16. On Monday its site still listed the alert as active.
The alert reaches further than the Danfoss story most outlets have told. It names four product lines with “numerous compromises”: Danfoss’s AK-SM and AK-SC series, and the xweb controllers sold by Copeland and Dixell. An Oct. 13 update added more targeted equipment to the list. The alert warns that attack campaigns against this equipment are “probably still ongoing,” and says exposing a management interface to the internet goes against good practice. Its sample fix for Danfoss units was to update the firmware, set the security level to strict and change default passwords.
Monday’s incidents suggest that warning wasn’t acted on everywhere. Sweden’s national cybersecurity center (NCSC) posted its own notice Monday evening, saying it was in contact with affected businesses and with counterparts in other Nordic and European countries. It asked organizations to list which devices are connected to the internet, consider whether they need to be, and patch them if so. Its head, John Billow, told Reuters the agency had found “quite a lot of exposed operational technology devices” in Sweden in recent weeks. He said the center couldn’t speculate on who was responsible.
Nobody has said who did it
Belgium’s Centre for Cybersecurity was blunter. “It may never be determined” who is behind the attack, spokesperson Katrien Eggers said in comments carried by Reuters, adding that AI now helps attackers exploit weak systems. Christophe Hansen, the EU’s agriculture commissioner, called the incidents “a deliberate attempt to disrupt” the food supply chain, according to Reuters and Al Jazeera. He didn’t say who he thought was making the attempt.
Tom Hegel, a researcher at the security firm SentinelOne, told Reuters that the absence of financial demands in recent cases points to sabotage. He also said this kind of intrusion leaves little behind, so “a teenager and an intelligence service would look much the same” to defenders. Reuters said it could not establish who carried out Monday’s attacks or whether they were linked to France. Moscow has repeatedly denied involvement in sabotage or hybrid warfare in Europe.
The French investigation, opened by the Paris prosecutor in October, hasn’t produced a public suspect either. Our October reporting covered the first wave and the Danfoss firmware warnings and who has attacked equipment like this before. The French alert is CERTFR-2026-ALE-012, and Sweden’s notice is on the NCSC website, in Swedish.
Sources
- CERT-FR, “Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération,” CERTFR-2026-ALE-012 (Oct. 12, 2026, updated Oct. 16). Used for: affected product lines, the “still ongoing” warning, recommended fixes and the alert’s status.
- Nationellt cybersäkerhetscenter (Sweden), “Cyberangrepp mot uppkopplade frys- och kylsystem” (Nov. 2, 2026). Used for: the agency’s contacts and its three recommendations.
- Reuters via The Korea Times, “New cyberattack on supermarket fridges sweeps across Europe” (Nov. 2, 2026). Used for: Coop’s seven stores and Danfoss link, Carrefour and IKEA, Eggers, Hansen and Hegel.
- Reuters via CNBC, “Cyberattack on fridges hits supermarkets across Europe” (Nov. 2, 2026). Used for: Ingwall, Billow, Moelans via Belga, Estonia, Colruyt and De Laet.
- Al Jazeera, “Suspected cyberattacks trigger supermarket fridge failures across Europe” (Nov. 2, 2026). Used for: the five-country list, SuperValu’s 13 of 223, Kitman Coldtech, Hansen and the Commission.
- The Irish Times, “SuperValu says it has ‘fully resolved’ issues after cyberattack on its fridge systems” (Nov. 2, 2026). Used for: Musgrave’s statements and the 55-degree figure.
- Security Affairs, “New wave of fridge cyberattacks hits European supermarkets” (Nov. 2, 2026). Used for: the Sjöbo store, Coop’s six stores via Aftonbladet and TT, and the defrost mechanism.
- The National News Desk via ABC6, “Suspected cyberattacks in seven European countries impact freezers in supermarkets” (Nov. 2, 2026). Used for: the BBC’s seven-country list and Moelans on secure connections.