Supermarket freezers across Europe hit by second suspected cyber-attack

What it is

A Guardian report dated 2 November 2026 on a second wave of suspected sabotage against supermarket refrigeration. Retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported temperatures of up to 50C overnight. The first wave, in France in October 2026, hit as many as 700 shops. The page names no CVE, firmware version or indicator of compromise.

How it works

The page gives little technical detail.

• In France, attackers remotely overrode settings on thousands of freezers, fridges and chiller cabinets, moving them from as low as -27C to well over 50C. The controllers were mostly from Danfoss. The French national cybersecurity agency later found that controllers from two other, unnamed vendors were also targeted.
• In Estonia, Kitman Coldtech said attackers accessed a computer that controls a chain's refrigeration system and raised the temperature to 50C.
• In Belgium, Sabcobel (which runs Delhaize's refrigeration) said the evaporators were switched to defrost mode.
• No ransom demand has been made and nobody has claimed responsibility. SentinelOne's Tom Hegel says this points to sabotage rather than extortion.

Preconditions / Affected

• Exposure is the common thread. Tributech's Patrick Lamplmair said thousands of controllers were still reachable from the internet after the French attack. Sweden's national cybersecurity centre said the country has "quite a lot of exposed operational technology devices" that need updating or patching.
• Danfoss said it identified security flaws last year and had "long recommended" that customers install updates. The page does not name the flaws or the fixed versions.
• Ireland's SuperValu said the affected systems were limited to one specific model, in 13 of its 223 shops. The model is not named.

What to do

The page states no formal guidance. The actions it implies or reports:

• Apply vendor updates to refrigeration controllers. Danfoss says fixes for last year's flaws exist.
• Take controllers and building management systems off the internet. Hegel notes that retail estates also include door access panels and point-of-sale gear.
• Be ready to isolate affected units quickly. Sabcobel started mobilising technicians at 1am and spent the night disconnecting affected installations. Kitman said it responded within minutes in Estonia and reported no significant damage.

Caveats

• The attacker, method and entry point are not established. Most retailers did not confirm the cause. Ahold Delhaize did not specify one, though its contractor Sabcobel called it a cyber-attack.
• Losses in France were estimated in the tens of millions of euros, with individual shops losing from tens of thousands to more than €130,000. No loss figures are given for the second wave.
• Ikea Belgium removed some food as a precaution in its Mons shop. Ahold Delhaize said distribution centres and deliveries were unaffected.