Supermarkets in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland found their fridges and freezers warming up on the night of 1-2 November 2026. Inside some cabinets the temperature climbed to 50°C. It is the second wave in three weeks: on 11 October up to 700 supermarkets in France were hit the same way, with losses put at tens of millions of euros. The Paris prosecutor's office is investigating that case, with the national cyber agency ANSSI involved.
Who was hit
Delhaize reported around 40 affected stores in Belgium and Luxembourg. Its store in Hoeilaart alone threw away about €100,000 of goods. Carrefour Belgium counted 15 of its 700 shops, Colruyt and Spar 5, Intermarché 15. In Sweden, Coop had 7 of about 800 stores affected and ICA a limited number, including the store in Sjöbo. SuperValu in Ireland said 13 of its 223 stores were affected and that the problem was tied to a "specific model" of equipment. Estonia's Selver had one store, Finland's Kesko some of its K-stores, and in the Netherlands Danfoss told the broadcaster NOS that at least 17 smaller businesses were affected. The IKEA store in Mons, Belgium, was also on the list.
Stephan Moelans, CEO of the Belgian refrigeration installer Sabcobel, said the attackers switched the evaporators into defrost mode. According to him, the affected units need physical modifications, and a software update alone will not fix them. EU commissioner Christophe Hansen called the attacks "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it".
Nobody has claimed responsibility and no ransom was demanded. Tom Hegel of SentinelOne told the Guardian that this points to sabotage rather than crime for money.
Controllers reachable from the internet
Reports link both waves to Danfoss refrigeration controllers. Censys looked at Danfoss StoreView controllers visible on the public internet and counted just over 1,000 worldwide on 2 November. France, where the first wave hit, went from 1,825 exposed devices on 11 October to 220, and 41% of those run version 4.3.1 or later, which includes the fixes. Belgium had 138 exposed controllers (68% patched), the Netherlands 51 (37%) and Sweden 50 (58%). Finland is missing from the Censys country list, so not every attacked site is necessarily visible this way.
Claroty's Team82 published research on vulnerabilities in Danfoss refrigeration controllers in August. John Billow, head of Sweden's National Cyber Security Centre, said there are "quite a lot of exposed operational technology devices" in the country.
Homes and small shops have the same weak spots. Think of a heat pump, a boiler controller or a cold room in a small shop with a web panel open to the internet, old software and default passwords. Controllers like these belong behind a VPN or at least behind a firewall that only lets in known addresses. The installer's remote access needs the same treatment. An alarm that fires when the temperature in a cabinet starts to rise is also worth setting up.