Incident note: supermarket freezer attacks
Supermarket refrigeration was reportedly attacked across Europe in October and November 2026. This note separates what is confirmed from what is only reported, and says what is not yet known.
- Written
- 2 November 2026
- Status
- Still developing
- Based on
- Published reports only
- Our own data
- None on this incident
We run decoy web apps, so we have no view of these networks and no first-hand evidence about this incident. This note only reads and sorts what has been published. We update it when the facts change and list each change at the bottom.
Confirmed by companies or officials
| What | Who said so |
|---|---|
| Temperatures rose in freezers and fridges at stores in several countries overnight into 2 November 2026. | Named in coverage: ICA and Coop in Sweden, SuperValu in Ireland, Ahold Delhaize and Spar in Belgium, Ahold Delhaize in Luxembourg, and at least one chain in Estonia. |
| SuperValu said a specific refrigeration model was hit by a “cyber incident” at 13 of its 223 stores. | Company statement, as reported by Reuters. |
| Sweden's national cyber security centre is responding and says it found many exposed operational technology devices that need updating. | Official statement, as reported by Reuters. |
| A Belgian refrigeration firm's chief executive said the units' evaporators were switched to defrost mode. An Estonian firm's chief executive said temperatures were set to 50°C. | Statements by people who service the equipment, as reported by Reuters. |
Reported, not confirmed
| What | How solid it is |
|---|---|
| Defrost mode was switched on remotely, overriding the units' temperature limits. | One outlet. Consistent with the statements above but not stated by an official body. |
| A similar attack hit hundreds of supermarkets in France in early October, with temperatures up to 50°C, spoiled food and fires at several stores. | Reuters coverage dated 13 October. We have not checked this independently. |
| The Netherlands was also affected. | One outlet, not confirmed in the others. |
| Losses are likely to reach millions of dollars. | An estimate attributed to Bloomberg, not a measured figure. |
Where sources disagree
| What | What we found |
|---|---|
| Which Belgian chains were hit. | Reuters names Ahold Delhaize stores and five Spar shops. Another outlet lists Delhaize, Carrefour and Spar. We have not resolved this. |
Not known yet
- How the attackers got access: stolen passwords, controllers reachable from the internet, a shared remote-management platform, or something else.
- Which vendor or model of controller is involved, and whether it is one product or several.
- Whether the France attack and this one are linked.
- Who is responsible. No one has claimed it, and the officials and coverage we read do not attribute it. Links to wider conflicts are speculation.
Things worth checking if you run refrigeration or building controllers
- Find out whether any refrigeration or building controller you run can be reached from the internet, and who set that up. Our checklist is on the defence tools page.
- Ask your refrigeration contractor in writing what remote access exists, who holds the credentials, and how updates are applied.
- Keep a temperature alarm that does not depend on the same controller and network, and test that the alert reaches a person.
- Write down what to do when temperatures rise: who to call and where to move stock.
These are things to look at, not an assurance of anything. We do not know how these attacks worked, so we cannot say which of them would have mattered.
What we are doing about it
We are adding one decoy that looks like the web console of a cold-room monitor, with an invented brand and fake data. It controls nothing and has no sign-in form. It will show whether the scanners that already reach our decoys also look for pages like this, and whether that changes after incidents. We have written the questions down before collecting any data, and we will publish the result whatever it is, including none.
Sources
Changes to this note
2 November 2026: first version.