Refrigeration systems at supermarkets and other food businesses were disrupted by suspected cyber incidents across several European countries overnight on November 2, 2026. Retailers and suppliers reported affected sites in Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia. Similar refrigeration problems were reported in Finland, but their cause was still being investigated. Authorities had not identified an attacker or established that the incidents were linked to the earlier French supermarket attack.

The incidents matter because digitally managed cooling equipment can affect food safety and store operations when its controls are remotely accessible. The Reuters account, BBC reporting and local broadcasters describe a cross-border set of incidents, but the exact scope and cause differ by location.

What happened to the supermarket refrigerators?

In Sweden, a franchise store in Stockholm told Reuters that its freezers had been tampered with overnight and reached 50°C. Swedish chains ICA and Coop confirmed refrigeration incidents at a limited number of stores; Coop said seven of its more than 800 Swedish stores were affected. In Belgium, Carrefour reported that 15 of its 700 stores had been affected. Irish wholesaler Musgrave said 13 SuperValu stores were affected by an incident involving a specific refrigeration model.

Musgrave’s Irish stores had returned to normal by Monday evening, according to RTÉ’s later update. The company said the affected chilled and frozen products were removed as a precaution, the issue was resolved and replenishment was underway.

The figures are reports from different companies and countries, not a verified combined total. The Dutch public broadcaster NOS quoted refrigeration supplier Danfoss as saying at least 17 Dutch businesses were affected, including butcher shops, small neighborhood stores and a frozen-food storage site—not just supermarkets. BBC reported around 40 Delhaize stores in Belgium and Luxembourg, while other retailers reported smaller, chain-specific counts.

Not all locations reported the same impact. Estonia’s public broadcaster ERR reported one affected Selver outlet; a local supplier said staff responded quickly, the freezer temperature rose only a few degrees and products were not damaged. In Belgium, refrigeration operator Sabcobel told reporters that some units had been switched into defrost mode. That account describes the Belgian systems it manages; it does not establish a single technique across every reported incident.

Are the European incidents linked to the French attack?

That has not been established. The latest events echo an October attack in France in which supermarket cooling controls were manipulated and food was discarded. However, Reuters said it could not determine who was behind the November 2 incidents or whether they were connected to the French case. Some affected operators and suppliers described cyber incidents or unauthorized changes, while other reports—particularly in Finland—still described refrigeration malfunctions under investigation. No group has publicly claimed responsibility.

Why are supermarket fridges connected to the internet?

Large refrigeration systems use controllers to monitor temperatures, run defrost cycles and trigger alarms. Internet or remote connectivity lets service contractors diagnose faults and adjust equipment without travelling to every store. The same connection can create risk if management interfaces are exposed or remote accounts are not secured.

That risk is not just theoretical, but exposure figures need careful interpretation. In research published before this week’s incidents, Forescout’s Vedere Labs identified 12,976 internet-exposed refrigeration-control service observations across 6,017 public IP addresses in 99 countries and territories. The researchers explain that one IP address can expose multiple services and one interface can represent several downstream systems. These were observations of exposed services—not a count of unique hacked fridges, and not evidence that those systems were compromised.

What should retailers and facility operators take away?

For operators of connected refrigeration and other operational-technology systems, the U.S. Cybersecurity and Infrastructure Security Agency’s general OT guidance recommends removing direct public-internet access, replacing default passwords with unique credentials, protecting necessary remote access, separating operational systems from corporate networks and maintaining a way to operate systems manually. CISA’s guidance is general advice for OT operators; it is not a finding about the cause of these European incidents.

For retailers, the episode also highlights the need to know who manages each controller, which outside accounts can change temperature or defrost settings, and how those changes are logged. Remote maintenance is useful, but access should be limited to what a contractor needs and monitored alongside temperature alarms and physical operating conditions.

Frequently asked questions

Which European countries reported refrigeration incidents?

Reports on November 2 described apparent cyber incidents affecting refrigeration systems in Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia. Similar problems were reported at Finnish stores, but their cause was still being investigated.

Has an attacker been identified?

No. As of the latest reports reviewed for this article, authorities and companies had not publicly identified a perpetrator, and no group had claimed responsibility.

Were the incidents connected to the French supermarket attack?

That remains unknown. The incidents are similar in their effect on refrigeration controls, but Reuters reported that no link had been established.

Were all affected stores closed?

No. Store-level impact varied. Musgrave said its affected SuperValu stores were operating normally again by Monday evening; some other retailers reported keeping locations open while removing affected chilled or frozen products.