Europe’s Second Wave of Supermarket Freezer Hacks Exposes Critical Infrastructure Gaps

Key points

• On November 2, 2026, cyberattacks hit supermarket refrigeration systems in Belgium, Luxembourg, Estonia, the Netherlands, Ireland, Sweden, and Finland, causing temperatures to rise to 50°C.
• Major retailers affected include Ahold Delhaize, Carrefour, Intermarché, ICA, and IKEA. In Belgium, approximately 40 Delhaize stores and 15 Carrefour stores were impacted.
• The attacks exploited vulnerabilities in internet-connected refrigeration controllers, many of which were older models that no longer receive security updates or had default passwords.
• No group has claimed responsibility, but cybersecurity experts suggest state-sponsored actors or lone-wolf hackers may be behind the incidents due to the lack of ransom demands.
• The UK’s National Cyber Security Centre (NCSC) reported a couple of instances where vulnerable technology was exploited in the food supply chain, though no major supermarkets were directly hit.
• Experts warn that AI-driven vulnerability detection could make such attacks faster and more widespread, as defenders struggle to patch legacy systems at the same speed.

Background

This incident follows a major cyberattack in October 2026 that targeted approximately 700 French supermarkets, causing temperatures to spike to 80°C and spoiling millions of euros worth of food. The October attack exploited outdated firmware and default passwords in refrigeration controllers. Earlier in August 2026, similar freezer malfunctions were reported at six U.S. military bases, which the Pentagon is investigating as a suspected hack. The recurring nature of these attacks highlights persistent vulnerabilities in industrial internet of things (IoT) devices and the lack of timely security updates in critical infrastructure.

How outlets are covering it

Euronews and The Guardian emphasize the strategic vulnerability of internet-connected appliances, noting that the simplicity of the hack—exploiting unpatched legacy systems—makes attribution difficult. Euronews highlights the role of AI in lowering the barrier for sophisticated attacks, while The Guardian focuses on the psychological impact of food shortages and the lack of ransom demands, suggesting state-sponsored or lone-wolf motives. CNBC provides detailed retailer-specific impacts, noting that Ahold Delhaize and Carrefour were heavily affected in Belgium, and that IKEA and ICA also reported incidents. CNBC also highlights the failure of retailers to patch systems after the October attack, despite warnings from CERT-FR. The BBC reports on the UK’s limited but notable impact, with the NCSC alerting affected organizations and the British Association of Independent Meat Suppliers noting that some members were 'collateral' to the attacks. The BBC also underscores the broader issue of under-invested technology infrastructure, with NCSC chief Dr. Richard Horne calling for urgent renewal of systems. All sources agree that the attacks are likely to continue due to the persistent vulnerability of legacy systems and the ease with which hackers can exploit them.

Why it matters

The repeated targeting of supermarket refrigeration systems highlights a critical gap in the cybersecurity of industrial IoT devices, which are often overlooked in favor of traditional IT systems. The potential for AI to accelerate and scale such attacks raises concerns about the resilience of critical infrastructure, including food supply chains. The incidents also underscore the need for better coordination between retailers, cybersecurity agencies, and manufacturers to ensure timely patching and secure configurations. As more appliances become internet-connected, the risk of similar attacks expanding to other sectors, such as heating, security, and medical devices, increases, posing significant risks to public safety and economic stability.

What to watch

Cybersecurity experts and national agencies are expected to continue investigating the November 2 attacks, though attribution remains uncertain. Retailers and manufacturers are likely to accelerate efforts to patch vulnerable systems and isolate critical infrastructure from the internet. The UK’s NCSC and other European agencies may issue further guidance on securing IoT devices. As AI-driven attacks become more prevalent, there may be increased pressure on governments and businesses to invest in cybersecurity for legacy systems. Future attacks could target other critical infrastructure, such as energy, water, or healthcare, if similar vulnerabilities are not addressed. The lack of a clear culprit may lead to further speculation and potential escalation, particularly if state-sponsored actors are involved.