Officials and company representatives said on 3 November that 4 supermarkets in Germany and 6 in Romania were affected; the UK was also hit. Retailers discarded food as refrigeration temperatures rose.
Cyberattacks on refrigeration systems affected at least 11 European countries on 2 November, officials said, as supermarkets and food suppliers faced rising temperatures and spoiled stock. Germany and Romania were added to the countries where problems had previously been reported, while the UK was also hit. Al Jazeera reported that officials and company representatives said on 3 November that four supermarkets in Germany and six in Romania were affected.
The incidents followed an October attack in France in which hackers seized cooling units at up to 700 supermarkets, French police said. Danfoss said it had identified security flaws the previous year and had long recommended customers install updates. France’s cybersecurity agency ANSSI subsequently confirmed that supermarkets using controllers from two other companies were also targeted. Refrigeration controls can be connected to the internet for remote monitoring and management; cybersecurity engineer Kevin Tellier said some controls intended for closed networks had been exposed online.
Local media reported at the time that food worth millions of euros had to be discarded after the October attack in France.
In Belgium, a Delhaize branch in Hoeilaart estimated damage at more than €100,000 after food including frozen pizzas and ice cream had to be discarded. Sabcobel, which operates Delhaize’s refrigeration systems, said technicians worked overnight and through the morning to disconnect affected units. CEO Stephan Moelans called the incident a cyberattack and attributed the warming to defrost functions activated remotely.
Delhaize said dozens of its stores in Belgium and Luxembourg were affected by an IT incident; the BBC reported around 40. The company said fresh and frozen ranges were temporarily limited, but distribution centers and deliveries operated normally.
Germany is investigating after officials received alerts, and its information security agency has advised recipients to assume their devices are insecure.
Carrefour said 15 of its 700 Belgian stores were affected, but all remained open because only a few refrigeration units, mainly freezers, were involved; spokesperson Mich Vergauwen called it a cyberattack. Colruyt reported problems at around five independently operated Spar stores with their own refrigeration systems, while Intermarché reported problems at 15 shops. Le Soir also reported affected Shop & Go outlets at Q8 service stations. IKEA said a cyberattack suddenly raised freezer temperatures at its Mons store; it removed food as a precaution and expected waste. It could not rule out other locations being affected.
In Sweden, supermarket chain Coop said its 7 affected stores had resumed normal operations. It had previously described issues ranging from completely shut-down refrigerators and freezers to partially functioning units, with one system beginning to generate heat. The company said the affected equipment had been connected to old 4G networks and that it had accelerated an upgrade to 5G networks and modern modems that began after the October attacks.
In Ireland, SuperValu said a specific refrigerator model at 13 of its 223 stores was affected and chilled and frozen products were removed from sale; owner Musgrave confirmed a cyber incident and said food was discarded. Italy’s cybersecurity agency said at least four Coop supermarkets in Sicily and one business in Tuscany were affected. Giuseppe Spadaro, director of a group operating Coop stores in Sicily, said four of its 300 stores were hit, causing thousands of euros in damage and forcing them to throw everything away. In Portugal, Mosqueteiros said incidents at seven Intermarché stores were linked to a cyberattack that appeared to target an external refrigeration-system provider.
ICA said a small number of Swedish stores outside its central network were affected. Its Sjöbo branch said its fridges and freezers were set to 50°C; it discarded food and reopened after closing. ICA Nära in Böda remained open without fresh or frozen produce. Danfoss said refrigeration systems at at least 17 companies in the Netherlands, including butcher shops and neighborhood stores, were attacked. Finland’s Kesko reported irregular temperatures at a few smaller stores and said it was investigating; network interference had not been ruled out.
Estonia’s Selver said one outlet was affected. Separately, refrigeration supplier Kitman Coldtech said attackers accessed an unnamed supermarket chain’s control computer and set the temperature to 50°C. CEO Jann Mutso said intervention within minutes prevented significant damage; he said the affected units were older Danfoss models similar to those targeted in France.
Richard Horne, chief executive of the UK’s National Cyber Security Centre, said hackers had targeted small meat-processing firms and the impact was minimal. The center said it knew of a couple of instances in which vulnerable technology had been exploited. Horne said it had worked through the night to alert handfuls of potentially affected UK organizations.
The British Association of Independent Meat Suppliers said affected members lost no meat because their affected refrigeration units were empty. At London wholesaler Langridge Organic, managing director Alex Pearce said staff intervened before stock was damaged; the company disconnected its cold-storage units from the internet. No UK grocery chain had been directly affected as of 3 November.
The meat suppliers' association said one company’s cold units reached up to 100°C, while two others reported units beginning to defrost. Pearce said hackers had set several Langridge units to defrost for more than four hours at 150°C; he said the wholesaler used the same control system, developed by US software company Copeland, that was involved in the French supermarket incidents.
Belgium’s federal prosecutors have opened an investigation. The motive remains unknown, and no one has claimed responsibility. Horne said on 3 November that it was too early to say who was behind the hacks; it also remains unclear whether the European incidents were coordinated or used the same methods as the French attack.
The UK center’s operations director, Paul Chichester, said it was working with affected organizations and would continue monitoring the incidents. He said the impact was minimal at the moment.
Chichester said the center could not comment on who carried out the attacks, which he said did not use superintelligence (SI) and exploited longstanding vulnerabilities. Belgian and Swedish cybersecurity agencies said they were monitoring the incidents. Sweden’s cybersecurity center head John Billow said it was working on several grocery refrigeration incidents and had identified exposed operational technology needing updates or patches. EU agriculture and food commissioner Christophe Hansen called the attacks a deliberate attempt to disrupt Europe’s food supplies, saying food security was not currently at risk but food waste and business impacts were real.
Lupovis CEO Xavier Bellekens said infrastructure probing the firm’s decoy Danfoss controllers overlapped with infrastructure previously associated with Russian-linked operations. The actors remained anonymous and he could not identify a group; the finding does not establish who attacked the supermarkets.
3 min
From 16 November 2026, developers must declare whether apps share locations or offer dating and relationship features. Apple says apps with the latter will receive a minimum rating of 18+.
2 min
The not-for-profit successor is wholly owned by Smart Energy Code Company and replaces Capita subsidiary Smart DCC under a public-interest model.
2 min
