INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

European Supermarket Fridge Attacks via Cyberattacks Force Food Recall

| 2026-11-03 11:08 MEDIUM LOW DDOS & DISRUPTION CYBERATTACK (GENERAL) INDUSTRY & POLICY
JSON
Executive Summary
AI-generated
Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers. More than 100 stores in several European countries saw their fridges and freezers heat up overnight from Sunday to Monday, and several retailers have blamed a cyberattack. A new wave of fridge cyberattacks hit supermarket refrigeration systems across five European countries, raising temperatures and causing food losses.
Technical Mitigations AI-generated
• Limiting remote management access for cold storage equipment operators is an effective way to block or hunt for attackers.
Technical Observables 2 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 2 IoCs Create Free Account
urls 1 domains 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
BENELUX BENELUX NORDICS NORDICS mediamedia retailretail manufacturingmanufacturing governmentgovernment
Incident Timeline
‎2026/10/03
Threat actors used a similar vulnerability exploited in previous attacks to compromise refrigeration controllers of European supermarkets, including Ahold and others.
target_region France
According to Sabcobel's director, Stephan Moelans, the attacker leveraged the same vulnerability used in similar attacks last month in France .
Last month's refrigerator attacks in France impacted hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers that were compromised by remote attackers who set them to defrost mode.
The latest incidents follow a similar wave of fridge cyberattacks in France last month.
target_region Netherlands
Ahold also reported a cybersecurity incident to Dutch police last month, after it detected suspicious activity in its infrastructure.
‎2026/10/04
Last month, attackers remotely took control of refrigeration systems in hundreds of supermarkets and independent stores across France.
target_region France
Last month, attackers remotely took control of refrigeration systems in hundreds of supermarkets and independent stores across France.
‎Monday, November 2
Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2.
target_region Belgium
Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers.
On Monday, November 2, Ahold Delhaize and Colruyt reported an IT incident affecting dozens of stores in Belgium and Luxembourg.
target_region Sweden
Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers.
target_region Estonia
Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers.
target_region Luxembourg
On Monday, November 2, Ahold Delhaize and Colruyt reported an IT incident affecting dozens of stores in Belgium and Luxembourg.
organisation Colruyt
On Monday, November 2, Ahold Delhaize and Colruyt reported an IT incident affecting dozens of stores in Belgium and Luxembourg.
‎November 02, 2026
General Document Context New wave of fridge cyberattacks hits European supermarkets, this time in Belgium, Luxembourg, Sweden and Estonia Pierluigi Paganini November 02, 2026
target_region Belgium
New wave of fridge cyberattacks hits European supermarkets, this time in Belgium, Luxembourg, Sweden and Estonia Pierluigi Paganini November 02, 2026
target_region Sweden
New wave of fridge cyberattacks hits European supermarkets, this time in Belgium, Luxembourg, Sweden and Estonia Pierluigi Paganini November 02, 2026
target_region Estonia
New wave of fridge cyberattacks hits European supermarkets, this time in Belgium, Luxembourg, Sweden and Estonia Pierluigi Paganini November 02, 2026
target_region Luxembourg
New wave of fridge cyberattacks hits European supermarkets, this time in Belgium, Luxembourg, Sweden and Estonia Pierluigi Paganini November 02, 2026
target_region United States
General Document Context
‎2026/11/03
Threat actors targeted refrigeration equipment temperature manipulation, forcing hundreds of supermarkets in several European countries to raise temperatures as high as 50 degrees Celsius.
organisation Coop
Supermarket chains that acknowledged refrigeration issues include: ICA (Sweden) - At least 4 locations affected Coop (Sweden) - 7 locations confirmed affected Ahold Delhaize (Belgium and Luxembourg) -
Refrigeration equipment temperature manipulation...hot air also emerges In Sweden, the supermarket chain ICA and Coop saw some stores affected.
The Coop chain also reported problems with fridges and freezers at six stores in central Sweden, according to TT, though it did not immediately share details.
organisation ICA
Supermarket chains that acknowledged refrigeration issues include: ICA (Sweden) - At least 4 locations affected Coop (Sweden) - 7 locations confirmed affected Ahold Delhaize (Belgium and Luxembourg) -
Refrigeration equipment temperature manipulation...hot air also emerges In Sweden, the supermarket chain ICA and Coop saw some stores affected.
Estimates for France range from around 400 to more than 500 stores, and ICA has not said how many of its Swedish stores were hit.
organisation Carrefour
" In Belgium, only Carrefour stores in two regions were affected, and all hypermarkets remained completely operational.
Carrefour said a cyberattack targeting refrigeration had affected 15 of its more than 700 Belgian stores, and described the impact as “extremely limited.
Meanwhile, Belgian newspaper Le Soir reported that dozens of Delhaize and Carrefour stores were affected.
organisation Sabcobel
In Belgium, the refrigeration equipment manufacturer Sabcobel's CEO, Stéphane Moulart, explained that the attackers had manipulated the equipment's expansion valve to set its humidity mode.
Who Is Behind It Danfoss said the Dutch attacks were the same kind as the one in France, Sabcobel said the same method was used in Belgium, and Kitman said the method in Estonia was similar.
SabcoBel has assessed that approximately twenty of its cold storage equipment were affected.
organisation Delhaize
In Belgium, Delhaize said an “IT incident” had affected refrigeration in several dozen stores, mostly in Belgium and a few in neighbouring Luxembourg.
In Belgium, Delhaize detected unusual temperature increases in its refrigeration systems on Monday.
Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.
organisation Spar
Colruyt Group, which operates Spar stores in Belgium through a franchise system, said five stores had suffered attacks on their refrigeration systems.
Delhaize said an IT incident disrupted refrigeration at several dozen of its stores, Carrefour counted 15 affected locations out of more than 700, and Colruyt said five franchised Spar shops were attacked.
A representative of the Colruyt Group told BleepingComputer that "there is an impact on the refrigeration systems at around five Spar stores." "These stores are operated by independent entrepreneurs who have their own refrigeration systems.
organisation SuperValu
In Ireland, Musgrave Group said refrigeration systems in 13 SuperValu stores were affected by the “ cyber incident.”
In Ireland, SuperValu pulled chilled and frozen products from 13 stores where one specific refrigeration model was impacted.
Ireland Musgrave, owner of SuperValu 13 of 223 A "cyber incident" limited to one refrigeration model.
organisation Copeland
France’s cybersecurity agency ANSSI said it was “aware of the compromise of refrigeration system remote controllers,” naming Danfoss’s AK-SM and AK-SC series, Copeland’s xweb and Dixell’s xweb products.
A day later, it expanded its alert to cover Copeland and Dixell XWEB systems.
What Operators Can Do CERT-FR's alert covers Danfoss AK-SM and AK-SC series controllers, as well as Copeland xweb and Dixell xweb.
organisation Dixell
France’s cybersecurity agency ANSSI said it was “aware of the compromise of refrigeration system remote controllers,” naming Danfoss’s AK-SM and AK-SC series, Copeland’s xweb and Dixell’s xweb products.
A day later, it expanded its alert to cover Copeland and Dixell XWEB systems.
What Operators Can Do CERT-FR's alert covers Danfoss AK-SM and AK-SC series controllers, as well as Copeland xweb and Dixell xweb.
organisation Intermarché
Around 700 supermarkets had their refrigeration units forced into defrost mode, including Intermarché, Carrefour, Coopérative U and Monoprix stores.
Grocery chains including Intermarché, Carrefour, Monoprix, Leclerc and Coopérative U were affected, with monetary losses estimated in the tens of millions of euros as spoiled food stock had to be thrown away.
E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. At least 300 Intermarché and Netto stores were affected.
organisation Monoprix
Around 700 supermarkets had their refrigeration units forced into defrost mode, including Intermarché, Carrefour, Coopérative U and Monoprix stores.
Grocery chains including Intermarché, Carrefour, Monoprix, Leclerc and Coopérative U were affected, with monetary losses estimated in the tens of millions of euros as spoiled food stock had to be thrown away.
E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. At least 300 Intermarché and Netto stores were affected.
organisation Belga
Stephan Moelans, CEO of Belgian refrigeration firm Sabcobel, told the Belga news agency that the attackers forced the units’ evaporators into defrost mode , as happened in France.
Stephan Moelans, CEO of Sabcobel, the company that manages Delhaize’s refrigeration systems, told news agency Belga that hackers had switched the units’ evaporators to defrost mode.
organisation Colruyt Group
Belgium Spar, under Colruyt Group 5, run by independent owners Their fridge systems were attacked.
Colruyt Group, which operates Spar stores in Belgium through a franchise system, said five stores had suffered attacks on their refrigeration systems.
organisation ICA Kvantum
One ICA Kvantum store in Sjöbo, in southern Sweden, was more direct.
ICA Kvantum in Sjöbo said on Facebook that a cyberattack caused the refrigeration problems.
organisation Reuters
Sweden Coop 6 (to TT and AFP) or 7 (to Reuters and Bloomberg), of about 800 A cyber incident in which someone tampered with its refrigeration without permission.
Reuters states .
organisation ANSSI
CERT-FR, the incident response team of France’s cybersecurity agency ANSSI, initially linked the compromises to Danfoss AK-SM and AK-SC series controllers.
France’s cybersecurity agency ANSSI said it was “aware of the compromise of refrigeration system remote controllers,” naming Danfoss’s AK-SM and AK-SC series, Copeland’s xweb and Dixell’s xweb products.
organisation ICA Group
Ica is providing support in handling the incident, Ica Group press officer Gustaf Nilsson tells TT.”
ICA Group spokesperson Gustaf Nilsson t old the TT news agency that “a limited number” of stores were affected overnight by an incident involving refrigeration systems.
organisation Stéphane Moulart
In Belgium, the refrigeration equipment manufacturer Sabcobel's CEO, Stéphane Moulart, explained that the attackers had manipulated the equipment's expansion valve to set its humidity mode.
organisation Ahold Delhaize (
Supermarket chains that acknowledged refrigeration issues include: ICA (Sweden) - At least 4 locations affected Coop (Sweden) - 7 locations confirmed affected Ahold Delhaize (Belgium and Luxembourg) -
organisation Carrefour (Belgium
Around 40 locations affected Carrefour (Belgium) - 15 locations affected Spar Colruyt (Belgium) - 5 locations affected Intermarché (Belgium) -
organisation Intermarché (Belgium
Around 40 locations affected Carrefour (Belgium) - 15 locations affected Spar Colruyt (Belgium) - 5 locations affected Intermarché (Belgium) -
organisation Ikea
Additional stores are dealing with the same problems in Belgium, including an Ikea superstore in Mons, grocery stores, and chocoloate shops.
organisation Centre for Cybersecurity
Belgium's Centre for Cybersecurity told reporters on Monday that it had no further information.
organisation Le Soir
Meanwhile, Belgian newspaper Le Soir reported that dozens of Delhaize and Carrefour stores were affected.
organisation AFP
Sweden Coop 6 (to TT and AFP) or 7 (to Reuters and Bloomberg), of about 800 A cyber incident in which someone tampered with its refrigeration without permission.
organisation Bloomberg
Sweden Coop 6 (to TT and AFP) or 7 (to Reuters and Bloomberg), of about 800 A cyber incident in which someone tampered with its refrigeration without permission.
organisation National Cybersecurity Centre
Sweden's National Cybersecurity Centre did not say in its notice how attackers got in.
organisation National Cybersecurity Center
Sweden's National Cybersecurity Center advised organizations to list which devices are connected to the internet, decide whether each one needs to be connected, and keep any that remain connected updated and protected with multiple layers of security.
organisation the national cybersecurity centre
In Sweden, John Billow, head of the national cybersecurity centre, told Reuters his team was working on several incidents involving refrigeration systems in grocery stores around the country.
organisation Aftonbladet
Coop told Swedish news agencies Aftonbladet and TT that six stores in central Sweden had similar problems.
Tactical Metrics
Metrics
infrastructure
‎Microsoft 365
Affected Product
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Metrics
financial
€250K
Financial Loss
He added that some individual branches reported losses of about €250,000.
Metrics
financial
€15K
Financial Impact
He estimated that about €15,000 worth of meat was ruined.
Intelligence Sources
TheRecord 2026-10-20
SecurityWeek 2026-11-03
The Cyber Express 2026-11-03
BleepingComputer 2026-11-02
Mastodon BleepingComputer 2026-11-02
Security Affairs 2026-11-02
The Hacker News 2026-11-03
Dailysecu 2026-11-03