Coordinated Cyberattack Spikes Supermarket Freezer Temperatures Across Seven EU Nations

Key points

• The attack impacted at least 100 stores across Sweden, Finland, Ireland, Belgium, Luxembourg, Estonia, and the Netherlands on November 2.
• In Sweden, ICA and Coop reported disruptions; one ICA store in Boda reached 55°C, while another in Sjöbo hit 50°C.
• Belgian retailer Delhaize confirmed an overnight IT incident affecting dozens of stores, with one branch losing €100,000 in produce.
• Irish chain SuperValu reported 13 affected stores, while Dutch supplier Danfoss noted 17 targeted facilities, including butcher shops and storage units.
• The incident follows a similar attack in October that affected hundreds of French supermarkets, with no group claiming responsibility for the latest wave.

Background

This incident is part of a broader pattern of attacks on food supply chains. In October 2026, a similar cyberattack targeted hundreds of French supermarkets, causing fires and food loss. Experts note that many affected systems use legacy software from manufacturers like Danfoss and Copeland, which may lack security updates. Previous attacks on Ukrainian grain logistics in 2025 also targeted food infrastructure, though the current EU incidents remain unattributed.

How outlets are covering it

Reuters and UNITED24 Media emphasize the scale of the disruption across seven EU countries, citing over 100 affected stores. BBC highlights the financial impact in Belgium, noting a €100,000 loss at one Delhaize branch. ABC News focuses on the limited scope within major chains, noting that only a small percentage of stores were affected. Anadolu Agency and NL Times provide specific technical details, such as the use of Danfoss equipment and unsecured networks. All sources agree that the attack mirrors the October incident in France but differ in emphasis: some focus on the immediate retail impact, while others highlight the technical vulnerabilities in legacy systems.

Why it matters

The attack underscores the risks of internet-connected industrial hardware in critical infrastructure. Legacy systems with default passwords or outdated software remain vulnerable to remote manipulation, potentially causing significant economic losses and food waste. The incident may prompt retailers and manufacturers to accelerate security upgrades and network segmentation to prevent future disruptions.

What to watch

Authorities in Belgium and Sweden are monitoring the incident, and retailers are investigating the cause. No group has claimed responsibility, and the motive remains unclear. Experts expect increased scrutiny of refrigeration systems and potential regulatory pressure to secure legacy hardware. The incident may also lead to accelerated adoption of security updates and network isolation for industrial equipment.