Hackers remotely sabotage refrigeration at more than 115 European supermarkets

Attackers have remotely tampered with refrigeration systems at more than 115 supermarkets across six European countries, forcing stores to discard spoiled stock and scramble to protect inventory, according to BleepingComputer. The outlet frames it as a second wave of refrigeration cyberattacks following a larger incident in France last month.

What happened

BleepingComputer reports that attackers remotely changed temperature settings on freezers and cooling systems overnight into Monday, November 2. In some cases they shut units down or activated defrost cycles, driving temperatures up and causing product losses, and store managers had to intervene early in the morning. An ICA store manager in Sweden said settings had been changed to +50°C (122°F) overnight and could not be modified, so the store discarded its frozen food. Sweden's Coop reported impacts ranging from fully shut-down units to partially working ones, including one case where a system began generating heat.

Who is affected

According to BleepingComputer, more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia were affected. Chains that acknowledged problems include ICA (at least four locations) and Coop (seven of more than 800 stores) in Sweden; Ahold Delhaize (around 40 locations in Belgium and Luxembourg); Carrefour (15 of 700 Belgian stores, with no hypermarkets affected); about five independently operated Spar stores; around 15 Intermarché stores; SuperValu in Ireland (13 stores); and one Selver store in Estonia. The report says additional butcher shops and neighborhood stores in the Netherlands and an IKEA store in Mons were also hit. Ahold Delhaize warned managers by SMS around 4 a.m., and some stores used refrigerated trucks to preserve stock.

Technical details

BleepingComputer, citing RTL, identified the refrigeration vendor as Sabcobel, whose director Stephan Moelans said the attacker used the same vulnerability as in the French attacks last month and attributed the disruption to remotely activated defrost functions. The report says the related French incident in October affected hundreds of stores after remote attackers compromised Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers and set them to defrost mode, prompting a French CERT alert (CERTFR-2026-ALE-012). The current attacker has not been identified, and it is unclear whether the incidents were one coordinated attack or separate targeted intrusions. BleepingComputer said it had not received a response from Sabcobel at publication time.

What to do

Affected stores were disconnected from the vulnerable systems and supported by their chains and vendors; Sabcobel technicians began disconnecting affected installations from about 1 a.m., and Carrefour said quick action let all its stores stay open. Moelans warned that a software update alone is not enough because the refrigerators also need physical modifications, and he recommended managing refrigeration equipment through a secure internet connection, which he said most clients adopted after the French attack. The incidents underscore the exposure of internet-connected operational technology in retail, where remotely reachable building and refrigeration controllers can be manipulated to cause real-world losses.