Supermarket Cyberattack Expands to Nine European Countries, Spoiling Millions in Food

A coordinated cyberattack on supermarket refrigeration systems has expanded to nine European countries, forcing retailers to discard millions of euros worth of spoiled food. The breach struck overnight on November 2, 2026, targeting internet-connected cooling units from Ireland to Estonia. Hackers remotely cranked the appliances' temperatures as high as 50 degrees Celsius.[1][2][4]

The attackers exploited legacy operational technology, primarily older refrigeration controllers that remained exposed to the public internet. By accessing the systems—often protected by weak or default passwords—the hackers forced the units' evaporators into a continuous defrost mode. The resulting heat wave ruined chilled and frozen goods before morning staff could intervene.[1][5]

Cybersecurity researchers analyzing the compromised hardware found that many of the targeted controllers ran web servers accessible directly from the internet. In several cases, the systems utilized hardcoded credentials, such as using "admin" for the username and the current date for the password. This predictable security flaw allowed attackers to easily script and automate the intrusions.[1]

In Sweden, the grocery chains ICA and Coop reported severe disruptions, with some units reportedly catching fire as temperatures spiked. An ICA Kvantum franchise in Sjöbo announced on social media that its systems had been hacked and set to 50 degrees Celsius. Staff were forced to empty the aisles and throw away the ruined inventory.[1][2][4]

The compromised locations in Sweden were connected to older 4G mobile networks rather than updated 5G systems, which left their infrastructure more exposed to external interference. Coop spokesman Carlos Cancino confirmed the six affected stores in central Sweden were hit by a cyber incident, though he noted the chain did not know who was behind it.[2]

Expanding Across the Continent

The sabotage quickly widened beyond Scandinavia, heavily impacting the Benelux region. Ahold Delhaize reported an IT incident affecting dozens of its supermarkets in Belgium and Luxembourg, temporarily limiting its range of fresh products. Carrefour also confirmed that 15 of its 700 Belgian stores were hit, though it described the immediate impact as limited.[4][5]

Belgian refrigeration company Sabcobel, which manages systems for Delhaize, mobilized technicians at 1 a.m. to physically disconnect the compromised units. Sabcobel chief executive Stephan Moelans confirmed the evaporators were maliciously switched to defrost, noting that some units required physical changes rather than just a software update.[5]

The financial toll on individual franchise owners was immediate and severe. Luc De Laet, founder of the Belgian butchery chain De Laet & Van Haver, was woken at 3:30 a.m. to find his store's fridges turned up to 18 degrees Celsius. "It's very scary. They are hacking the system that is doing the registration of the temperature, and they can program it at a distance," he told Reuters, noting the attack ruined 15,000 euros worth of meat.[2][5]

In Ireland, the Musgrave Group removed chilled and frozen products from 13 SuperValu locations after its monitoring systems detected the intrusion. Meanwhile, in Estonia, hackers accessed a computer controlling a supermarket's refrigeration system and raised the temperature to 50 degrees Celsius. Kitman Coldtech, the local technology supplier, reported that the attack was mitigated within minutes.[3][4]

By late Monday, industry sources confirmed that the attacks had also reached Italy, Portugal, and Finland. The Radenza group reported incidents at four stores in Sicily, while the Finnish retailer Kesko detected irregular temperatures in several smaller grocery outlets. The rapid geographic spread confirmed that the attackers were scanning broadly for the same vulnerability.[1][4]

A Vulnerable Supply Chain

This week's sabotage mirrors an unprecedented October 12 attack that struck roughly 700 supermarkets across France. In that incident, hackers breached cooling units at major chains including Intermarché and E.Leclerc, causing tens of millions of euros in losses. The French attacks exposed the severe risks of connecting essential retail equipment to the public internet.[1][4]

Both the French and current European attacks heavily targeted discontinued controllers manufactured by the Danish firm Danfoss. Following the October breach, Danfoss stated that the affected equipment consisted of legacy products that no longer receive software or security updates. The company emphasized that customers must actively secure these older units behind protected networks.[1][5]

The vulnerability may have been exploited even earlier outside of Europe. In August 2026, a series of mysterious refrigeration malfunctions hit commissaries at least six United States military bases. The Pentagon launched an investigation into those suspected hacks, which displayed the same pattern of remote temperature manipulation seen in the European supermarkets.[1]

The crisis has highlighted a regulatory gap in Europe's upcoming cybersecurity legislation. Under the Cyber Resilience Act, manufacturers must report attacks affecting unsupported products, but they are not strictly required to issue patches for older equipment. Products placed on the market before December 2027 generally escape the broader security requirements unless they are substantially modified.[1]

Disruption Over Ransom

No group has claimed responsibility for either wave of attacks, and cybersecurity agencies have not formally attributed the sabotage to a specific state actor. The European Union's police agency, Europol, confirmed it is coordinating with national authorities but declined to provide details on the ongoing investigation. The lack of ransomware demands suggests a motive rooted purely in disruption.[1][4]

European officials have expressed alarm over the coordinated nature of the infrastructure breaches. The EU food and agriculture commissioner, Christophe Hansen, condemned the intrusions, calling them a deliberate attempt to disrupt the continent's food supply chain and undermine consumers' confidence in it.[1]

Security analysts remain divided on the attackers' identity, weighing the likelihood of state-sponsored sabotage against opportunistic hacktivism. The method requires relatively low sophistication, relying on exposed operational technology rather than advanced zero-day exploits. Similar tactics were previously used by Russian state-linked groups against Polish water and energy infrastructure in 2025.[1]

Rafe Pilling, a threat researcher, noted that the absence of a ransom demand points away from traditional cybercrime. "The two most plausible attribution scenarios for me are some kind of state-based signalling and demonstration of capability or some kind of lone-wolf hacker," Pilling told The Guardian.[1]

The attacks demonstrate a shift in cyber warfare tactics, moving from data theft to physical hardware manipulation. Retailers are now scrambling to secure their networks, with cybersecurity agencies urging supermarkets to place refrigeration controllers behind secure virtual private networks.[1][5]

Until these legacy systems are isolated, the European food supply chain remains highly vulnerable to remote temperature manipulation. The financial toll of the ruined inventory continues to climb, and the ease of the exploit guarantees that unsecured operational technology will remain a primary target for malicious actors.[1][4]