Supermarket freezers hit by suspected cyberattack across six European countries

Supermarket freezers and fridges in at least six European countries warmed up overnight in what retailers and a refrigeration contractor described as a suspected cyberattack. The problems began in the night of Sunday, November 1 to Monday, November 2, 2026, and hit stores in Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia. Ahold Delhaize and Colruyt reported an overnight IT incident affecting cooling in their Belgian and Luxembourg shops, Irish chain SuperValu pulled chilled and frozen food from 13 stores, and Belgium's federal prosecutor's office opened an investigation. No group has claimed responsibility. The wave came weeks after a similar attack on cooling units at hundreds of supermarkets in France in October.

A supermarket cooling system is a network of compressors, evaporators and sensors. The evaporator is the cold coil inside the cabinet that pulls heat out of the air. Every few hours it is switched into defrost mode, a short warm cycle that melts the ice building up on it. Modern systems are managed remotely over the internet, so engineers can watch temperatures and change settings without visiting the store. That convenience is also the weak point: according to the Sabcobel chief, someone used that access to put the units into defrost mode and keep them there, so the cabinets slowly warmed through the night while shops were closed.

The damage is mostly food. Chilled and frozen goods that rise above safe temperatures for too long have to be thrown away, which is why SuperValu cleared its shelves in 13 stores. The Sabcobel chief said technicians were mobilised from 1 am to disconnect the affected units from the network.

The pattern matters more than any single store. The French attack in October reportedly pushed temperatures as high as 50°C in some freezers at chains including E.Leclerc, Intermarché, Carrefour and Monoprix. Two waves in a few weeks, across several countries and many retail groups, point to a shared weakness in connected refrigeration equipment rather than a problem at one chain. One cybersecurity researcher noted that no ransom demand has been reported, which points to sabotage rather than extortion. That remains an assessment, not a finding: neither investigation has named a culprit.

For the technology industry, the episode is a reminder that "smart" equipment in shops, warehouses and factories is now part of the attack surface. Operational technology, the hardware that runs physical processes, was long kept off the internet. Remote management has changed that, and security has not always kept pace.

Peepals calculation: The retailers that gave store counts reported at least 39 affected stores between them: Carrefour 15, SuperValu 13, Coop 6 and Colruyt 5 (15 + 13 + 6 + 5 = 39). Ahold Delhaize and Colruyt together reported problems in dozens of stores without an exact Delhaize figure, so the real total is higher. For Carrefour Belgium, 15 of about 700 stores is about 2% (15 ÷ 700 ≈ 0.021). Our calculation from the reported figures.

Short-term: Affected stores are throwing away spoiled chilled and frozen stock, and, as Sabcobel described, disconnecting affected cooling units from the network.

Long-term: Retailers and their refrigeration contractors face questions about how remote access to cooling systems is secured. If investigators confirm one equipment model as the common link, its maker and users across Europe will come under scrutiny.

Who is affected: Supermarket chains in six countries and their staff; refrigeration service firms such as Sabcobel; shoppers who found gaps on chilled and frozen shelves; and any business that runs internet-connected cooling, from cold stores to pharmacies.

What to watch next: The findings of Belgium's federal prosecutor and of the Paris prosecutor's cybercrime investigation into the October attack.

Questions and Answers