What happened in the night of 1-2 November

In the early hours of Monday 2 November 2026, refrigeration and freezing equipment at supermarkets across at least six European countries was remotely manipulated. Evaporators in chillers and freezers were switched into defrost mode, pushing temperatures toward 50°C (122°F). Chilled and frozen food became unsafe, large quantities were thrown away, and some stores suspended sales. AFP tallied more than 100 affected stores.

The strike reached some of the continent's biggest grocery chains across borders in a single overnight window. There was no explosion and no injuries were reported, but prosecutors in Belgium have opened a criminal investigation.

Belgium and Luxembourg: the heaviest damage

Belgium bore the brunt. Roughly 40 Delhaize supermarkets were hit; Ahold Delhaize, the chain's parent company, described the episode as an IT incident. Carrefour confirmed 15 of its Belgian stores, the Colruyt Group reported problems at five Spar franchises it runs, and around 15 Intermarché stores were hit. Also affected: the Proxy Delhaize network, the IKEA store in Mons - which reported a cyberattack on its refrigeration - and Shop & Go shops at Q8 fuel stations.

Sabcobel, the refrigeration firm that operates systems for Delhaize, said the attack began around midnight on Sunday. Its chief executive Stephan Moelans described it as a cyberattack, and technicians worked through the night disconnecting affected equipment from the network. Belgian prosecutors have opened a criminal investigation, while Colruyt and Intermarché reported refrigeration problems without confirming a cyberattack.

Sweden, Ireland, the Netherlands and Estonia

In Sweden, Coop confirmed unauthorized manipulation - a cyber incident - at 7 of its 800 stores, with several ICA stores affected. In Sjöbo, freezers were set to 50°C; another freezer was recorded at 55°C (131°F). Sweden's National Cybersecurity Centre chief John Billow said investigators had found "quite a lot of exposed operational technology devices" needing updates or patches.

In Ireland, the Musgrave Group confirmed a suspected cyberattack on a specific refrigerator model at 13 SuperValu stores; chilled and frozen products were removed from sale. In the Netherlands, equipment maker Danfoss told broadcaster NOS that cooling systems at no fewer than 17 Dutch businesses - butcher shops and small grocers - had been attacked, adding they used default passwords and sat outside secure networks. In Estonia, broadcaster ERR reported the Selver chain had been compromised.

The BBC counts Luxembourg among the affected countries. Denmark reported attacks as well, and Finnish retailers said they were investigating whether irregularities in their systems were linked. Sources disagree on the exact country count, which is why the confirmed figure stays at at least six.

How the supermarket freezer cyberattack worked

The technique appears straightforward. Modern supermarket refrigeration runs through networked controllers that regulate compressor cycles, evaporator defrost schedules and temperature alarms. An attacker with remote access can force a unit out of its cooling cycle and into defrost - exactly what happened here. Once defrost ran unimpeded, cabinet temperatures climbed to roughly 50°C and stayed there long enough to ruin the stock. The midnight timing - with no staff watching the alarms - maximized the damage.

How the attackers got in is still under investigation, but early detail points to exposed, poorly defended control systems. Sweden's cybersecurity centre found numerous operational technology devices reachable online and needing patches; the Dutch systems Danfoss examined used default passwords and were outside secure networks. Default credentials on internet-facing controllers let intruders log in without sophisticated malware.

Official responses and investigations

National cybersecurity agencies in Belgium and Sweden are assessing the attacks; reporting indicates the United Kingdom is monitoring too. EU Agriculture and Food Commissioner Christophe Hansen called them a deliberate attempt to disrupt European food security (via Danish broadcaster DR).

Belgian prosecutors are treating the episode as a cybercrime. Retailers contained the damage fast: equipment was taken offline and disconnected from networks, exposed stock was discarded, and affected cabinets were taken out of service. Ahold Delhaize framed the event as an IT incident; Coop in Sweden called it a cyber incident involving unauthorized manipulation of its systems.

No government or agency has publicly named the attacker, and investigators have not confirmed any link between the countries' incidents beyond timing and method. A similar technique does not by itself prove a single coordinated actor.

The October France attacks came first

This is not Europe's first encounter with this playbook. In October 2026, hackers remotely changed settings at roughly 700 French supermarkets - more than 500 reportedly affected - manipulating refrigeration much as this week's attackers did. The Paris prosecutor opened a formal investigation, and Prime Minister Sébastien Lecornu tasked France's cybersecurity agency ANSSI with responding. The resemblance is striking, but investigators have not publicly confirmed the two campaigns are connected.

Caution also applies to a viral X post claiming the campaign extended to train delays and gas-station card-payment outages: those wider disruption claims do not appear in mainstream reporting and should be treated as unverified rumor unless officials confirm them. We have seen how fast misleading material spreads after a disaster, as with viral hurricane posts that turned out to be a year old. A trend alone is never evidence.

What shoppers should do

Retailers removed exposed products from sale, but anyone who bought chilled or frozen goods from an affected store overnight should be careful: if a product spent hours above safe temperature - and 50°C is far above it - the standard rule applies. When in doubt, throw it out; refreezing food after it has thawed and warmed does not make it safe.

Watch for notices at store entrances and on shelves; retailers suspended sales of suspect stock and are restocking after checks. Do not buy from equipment that appears to be undergoing checks, and report anything unusual - such as cabinets blowing warm air - to store staff.

The broader lesson is cyber hygiene for connected equipment, the same instinct behind our whiteout survival guide: default passwords and unpatched, internet-reachable controllers were exactly the weaknesses exploited here, per early findings from Sweden and Danfoss.

What our records show, and what they miss

What is confirmed: the overnight window from 1 to 2 November, the defrost-mode manipulation, temperatures around 50°C, more than 100 stores affected per AFP, at least six countries, the named chains and store counts, the default-password and unpatched-device findings, and the investigations now open in Belgium - plus the earlier French case of roughly 700 targeted supermarkets.

What is missing: who did it, how they first got in, whether the six countries' incidents and the October French attacks are one operation, and the full store list - several retailers confirmed problems without confirming a cyberattack. The viral train and card-payment claims are not in mainstream reporting and stay classified as rumor. Our recent verified coverage has ranged from the Arnab landfall on the Andhra coast to the Learjet 60 crash in Florida and the HPCL Visakhapatnam refinery fire - each published only after verification, and this article follows the same rule.

The short version

  • Overnight from 1 to 2 November, hackers forced supermarket refrigeration into defrost mode across at least six European countries; AFP tallied more than 100 stores hit.
  • Belgium was hit hardest (roughly 40 Delhaize stores, plus Carrefour, Spar and Intermarché); Sweden, Ireland, the Netherlands, Estonia and Luxembourg were also affected, with Denmark reporting attacks and Finland investigating.
  • Cabinets were driven to around 50°C, food was discarded, sales suspended, and investigators say the attackers exploited exposed refrigeration controllers - default passwords and unpatched systems.
  • Belgium has opened a criminal investigation; the earlier French attacks are under formal investigation. No attacker has been named, and claims of wider disruptions such as train delays and card-payment outages are unverified.
  • Shoppers should discard any food from affected stores that may have warmed and watch for store notices: when in doubt, throw it out.