Suspected Cyber-Attack Disables Supermarket Freezers Across Europe

Brussels, Belgium — Refrigeration systems at dozens of supermarkets across seven European countries failed overnight after what companies and national cyber-security agencies describe as a suspected cyber-attack, according to the BBC. Around 40 Delhaize stores in Belgium and Luxembourg were hit, along with a smaller number of shops in Sweden, Ireland, the Netherlands, Estonia and Finland.

Stephan Moelans, chief executive of Sabcobel, the Belgian company that manufactures and operates refrigeration systems for Delhaize, told the Belga news agency the incident was a cyber-attack. His teams worked through the night and into the morning to disconnect affected units from the network, he said.

How did the attack disable the freezers?

Sabcobel said the evaporators inside the affected units were switched into defrost mode, driving internal temperatures upward instead of keeping them cold. Moelans said the method matched one used in an attack on hundreds of French supermarkets in early October, and that his company had spent the weeks since trying to "protect our customers fridges against this vulnerability." The fix, he said, requires physical modifications to the units, not software patches alone, because most supermarket refrigeration across Europe is connected to the internet so staff and technicians can monitor and troubleshoot it remotely. "The simplest solution is to manage the fridges over a secure internet connection," Moelans said, adding that most of Sabcobel's customers switched to that setup after the French incident.

Which retailers and countries were affected?

Delhaize bore the largest share of the disruption in Belgium and Luxembourg. Carrefour said the incident touched only 15 of its Belgian stores and that it took immediate steps to keep those shops open. A spokesperson for Colruyt Group, which franchises Spar stores in Belgium, told Reuters that five shops had their fridge systems attacked. In Sweden, ICA and Coop outlets were affected; ICA said the disruption hit a "small number of ICA stores operating outside ICA's central network" and that the company was "supporting the affected stores in managing the situation." Smaller numbers of shops in Ireland, the Netherlands, Estonia and Finland were also affected, the BBC reported. The UK's National Cyber Security Centre said no incidents had been reported in Britain but that it was working with international partners and industry to "fully understand details of an incident."

How much food and money was lost?

A Delhaize branch in Hoeilaart, in Belgium's Flanders region, told the news site Het Laatste Nieuws it lost €100,000 (£83,500) worth of produce, a figure the store manager said did not account for additional losses from closing the shop. Local media reported millions of euros worth of food had to be discarded across the affected countries. In Sweden, one ICA branch in Sjöbo wrote on social media that its refrigerators and freezers "have been hacked overnight and they have set the temperature to 50 degrees." An employee at an ICA store in Stockholm was photographed throwing out bags of spoiled food, according to images distributed by AFP via Getty Images.

Numbers behind the outage

• Freezer and fridge temperatures reportedly rose as high as 50C (122F) at some stores.
• Around 40 Delhaize stores in Belgium and Luxembourg were affected, versus 15 Carrefour stores and five Colruyt-franchised Spar shops in Belgium.
• One Delhaize branch in Hoeilaart alone reported €100,000 in spoiled produce.

How does this connect to the October attack in France?

Sabcobel's Moelans said the method used against the Delhaize-linked units this week mirrors the one deployed against hundreds of French supermarkets in early October, when the same evaporator-to-defrost technique spoiled large volumes of food. That earlier incident prompted Sabcobel to begin reinforcing its systems, he said, though the company concluded that software fixes were insufficient and that physical hardware changes were required — work that had not been completed everywhere by the time this week's attack occurred.

Who is behind the attack, and who is investigating?

No attribution has been established. The BBC reported it remains unclear who is responsible. Belgium's and Sweden's national cyber-security agencies both said they were monitoring the incident, and the UK's National Cyber Security Centre said it was coordinating with international partners and industry.

Timeline

• Early October 2026 — Hundreds of French supermarkets hit by a cyber-attack using the same evaporator defrost-mode method, spoiling large quantities of food.
• Following weeks — Sabcobel works to protect customer refrigeration systems, concluding physical modifications, not software updates, are needed.
• Overnight into 2 November 2026 — Suspected cyber-attack strikes refrigeration units at supermarkets in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland.
• 2 November 2026, morning — Sabcobel disconnects affected units from the network; national cyber agencies in Belgium, Sweden and the UK confirm they are monitoring or assisting.