Suspected cyberattacks spoil food at supermarkets in seven European countries by tampering with their refrigerators

Supermarkets in several European countries have reported that their fridges and freezers were tampered with remotely, with temperatures rising above 40 ºC and spoiling hundreds of thousands of euros' worth of food. According to the IT Pro article, published on 3 November 2026, the incidents occurred in the early hours of Monday, and initial indications point to a cyberattack on internet-connected refrigeration systems. The report cites more than 40 affected stores across seven countries.

According to the reports, dozens of Delhaize and Carrefour supermarkets were affected in Belgium and Luxembourg, along with some Spar stores, according to Le Soir. Incidents were also reported at the Swedish chains ICA and Coop. Irish wholesaler Musgrave said 13 SuperValu stores were hit, according to Reuters. A small number of supermarkets in the Netherlands, Estonia and Finland were also reportedly affected.

According to RTL Info, Delhaize store managers received a text message at around 4:00 warning of sudden temperature spikes in refrigeration units, while initial indications place the attack at around 2:00. A manager at an Ica Kvantum store in Sjöbo, Sweden, estimated the value of the destroyed goods at several hundred thousand kronor and described it to DN as "a form of terrorism".

The incidents come just weeks after a similar attack on French supermarkets, in which temperatures were remotely raised to 50 ºC overnight, causing millions of euros in damage to both food and the stores themselves. It is not yet known whether the two episodes are linked. Stephan Moelans, CEO of Sabcobel, a refrigeration specialist that operates the systems in Delhaize supermarkets, told RTL Info he believes the attackers used the same method as in the October attack. He also told the Belga news agency that, since the attack in France, Sabcobel had been working to "protect our customers' fridges against this vulnerability", but that the units required physical modifications.

Experts warn that these incidents may encourage further attacks, particularly because tampering with refrigeration causes major damage without the need for sophisticated malware. Patrick Lamplmair, CTO and co-founder of cybersecurity firm Tributech, said: "This is no longer an isolated incident. It's a method that works, and attackers will keep using it until it stops working." He notes that it is attractive because it is cheap and the damage is immediate: rather than stealing data or demanding a ransom, attackers manipulate temperature controls and destroy stock in a single night.

The article recalls that the previous week Forescout's Vedere Labs warned that, following the attacks in France, other European countries could be next. Its research identified 12,976 observations of internet-exposed refrigeration services across 99 countries, particularly in Italy and Greece. Daniel dos Santos, vice president of research at Forescout, explained that many companies treat refrigeration systems as long-term investments, so equipment can remain in service long after software support ends, and there is often no budget to replace or upgrade it. He described it as a gap between the equipment's physical lifespan and its supported digital life.

On solutions, Lamplmair argues that patching alone is not enough, as it will always lag behind attackers. In his view, the lasting solution is to stop trusting the network and verify at the asset itself: every command must prove its origin and that it has not been altered, and every setpoint must be checked against physical limits before being executed. Hence his remark: "A freezer should never accept an instruction to heat up to 50 ºC, no matter who sends it." He argues that these safeguards should be built in by design and notes that, under the EU Cyber Resilience Act, manufacturers of connected products will become legally responsible for this; operators should already be asking their suppliers how commands are verified.

Dos Santos recommends identifying internet-exposed systems, removing direct public access and providing maintenance via secure remote access with strong authentication. He also advises removing default or shared maintenance credentials, patching supported equipment and budgeting to replace equipment that is no longer supported. He concludes that protecting the physical processes a business depends on should be part of everyday cyber-resilience planning.

It should be stressed that the article refers to "suspected" attacks: it does not identify those responsible, does not confirm the exact technical vector and acknowledges that it is not known whether the French cases and the latest ones are linked.