Thousands of commercial refrigeration units across more than ten European countries experienced a sharp temperature spike after hackers exploited remote defrost functions in a coordinated sweep on November 2, 2026. The incident forced major supermarket chains in Belgium, Sweden, and several other nations to discard large quantities of perishable food and temporarily close stores, echoing a similar wave of attacks that hit French retailers weeks earlier.
Compromised Refrigeration Controllers Across European Retailers
The unauthorized intrusions targeted industrial cooling equipment connected to public networks, specifically exploiting vulnerabilities within the AK-SM controller management systems manufactured by Danfoss. Security researchers noted that attackers scanned internet-facing management pages, leveraging weak default passwords and known security flaws.
In Belgium, more than seventy retail locations run by chains such as Delhaize, Carrefour, Intermarché, and Spar suffered deliberate disruptions when remote commands forced evaporators into continuous defrost mode. Store managers arriving for early shifts found refrigeration units blowing heated air, pushing internal temperatures as high as fifteen degrees Celsius in some display cases and up to fifty degrees Celsius in extreme instances. Technicians across Europe spent hours disconnecting vulnerable hardware from local networks to stop the automated heating cycle.
Mich Vergauwen, a spokesperson for Carrefour in Belgium, reported disruptions in roughly fifteen of the chain’s 700 stores, stating that it was a cyberattack with no other possible reason. IKEA Belgium confirmed that a cyberattack hit its store in Mons in southwestern Belgium during the early hours of Monday, causing a sharp temperature spike in freezers. Other Belgian grocery operators, including Colruyt and Intermarché, also suffered technical issues affecting their refrigeration systems. In Estonia, ERR News reported that a supermarket chain was affected, with the CEO of Kitman Coldtech stating that a client and other Estonian customers had been victimized. In Finland, the Ilta-Sanomat reported that the national cybersecurity center detected several successful attacks on cooling installations, though damage remained limited. In the Netherlands, public broadcaster NOS cited a Danfoss spokesperson indicating that roughly seventeen businesses, including neighborhood butchers and small shops, were hit, while major Dutch supermarkets did not appear to have been affected. In Luxembourg, RTL Today confirmed that several Delhaize supermarkets were affected. In Sweden, ICA and Coop reported parallel incidents on Monday morning, with an ICA store noting that the attack started between 2:00 AM and 3:00 AM and was discovered at 5:30 AM after freezers reached maximum temperatures.
Stephan Moelans, CEO of Sabcobel, recounted spending the entire night and morning disconnecting affected equipment from the network, noting that the attackers utilized the exact same forced-defrost mechanism seen previously.
Supermarkets Discard Food After Refrigeration System Failures
Supermarket operators in Sweden, Ireland, Estonia, Finland, the Netherlands, Luxembourg, Portugal, and Italy reported parallel incidents affecting food stocks and cold-storage facilities. In Ireland, thirteen SuperValu locations detected sudden temperature drops or spikes through automated monitoring systems, prompting immediate removal of refrigerated and frozen goods from sale and delayed morning openings. Swedish retailers ICA and Coop also confronted compromised temperature settings, while smaller commercial butchers and neighborhood shops in the Netherlands reported operational failures across at least seventeen independent business sites.
Retail trade representatives emphasized that while the operational impact forced precautionary food disposal, most storefronts managed to restock or isolate affected inventory before opening hours. Safety officials noted that the deliberate heating sequence also presented a secondary physical risk. Claire Baudiment, an administrator at Clusif, told BFM Tech that the risk, potentially, was fire. And in that case, the losses could have been significantly higher
.
An independent merchant affected by the incident stated that the situation was catastrophic because all fresh and frozen merchandise had to be discarded. Similar incidents were documented when six U.S. military bases suffered refrigeration failures in August 2026, leading to an investigation by the Army Criminal Investigation Division, though federal alerts invited anticipation rather than confirming targeted systems domestically.
Authorities Investigate Cyberattacks Targeting Critical Refrigeration Infrastructure
Following the second wave of intrusions on November 1 and November 2, the European Commission, the European Union Agency for Cybersecurity (ENISA), and Europol stepped in to coordinate a unified continental response.
In the United States, the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and three federal departments issued a joint advisory on November 5 warning critical infrastructure operators about industrial refrigeration vulnerabilities.
On November 5, the Kremlin denied any involvement in the cyberattacks targeting supermarket refrigeration and freezing units across roughly ten European countries, despite the incidents being claimed by two pro-Russian cybercriminal groups, NoName057(16) and Z-Pentest, identified by Western services as close to Moscow. Pieter-Paulus Vertongen, CEO of Aaltra, explained that the attack method was simplistic, allowing hackers to gain access using passwords generated from public information. Kumar Sokka, managing director of Acre Security, pointed out that refrigerators represent just the most visible example of a much broader category of connected physical security systems susceptible to immediate physical consequences from digital intrusions. Gianni Cuozzo, founder and CEO of Italian cybersecurity firm Exein, warned that artificial intelligence shortens the window between vulnerability discovery and operational attack execution, urging real-time preventive device defenses regardless of available patches.