Fridge cyberattacks hit supermarkets in Belgium, Luxembourg, Sweden and Estonia, setting refrigeration to defrost mode at 50°C
A new wave of attacks on supermarket refrigeration systems hit retailers in Belgium, Luxembourg, Sweden and Estonia overnight on 2 November 2026, raising fridge and freezer temperatures and causing food losses. Affected chains include Delhaize (Ahold Delhaize), Colruyt/Spar, Carrefour, ICA, Coop and an unnamed Estonian chain. The incidents follow a similar mid-October attack on hundreds of French supermarkets that targeted Danfoss equipment. No actor has claimed responsibility and authorities have not attributed the attacks.
Detalhes técnicos
- Attackers appear to have remotely triggered the forced defrost function in continuous mode with a 50°C setpoint. Sabcobel's CEO said evaporators were switched to defrost mode.
- In Sweden, stores reported temperatures set to 50°C. Consultant Emil Olofsson (Integrity 360) said some units reached 80°C and caught fire, a figure that differs from the police number.
- Scale: about 40 Delhaize stores in Belgium were reportedly affected, five Colruyt-run Spar stores, at least 6 ICA stores and 6 Coop stores in central Sweden. Le Soir reported dozens of Delhaize and Carrefour stores.
- Likely access: in the French case, Olofsson said attackers obtained login credentials for control systems exposed directly to the internet. He called the hack simple, so it may have been done by amateurs. The Swedish cyber centre's John Billow noted many exposed OT devices in Sweden.
- The cause of the Swedish incidents is officially unknown. Ahold's separate October report to Dutch police has no reported link to these incidents.
Remediação
- Remove OT and refrigeration control interfaces from direct internet exposure.
- Patch and update exposed devices, as Swedish authorities have urged.
- Rotate and protect credentials for control systems.
Linha do tempo
-
Fridge cyberattacks hit supermarkets in Belgium, Luxembourg, Sweden and Estonia, setting refrigeration to defrost mode at 50°C
ler a análise desta fonte ocultar
A new wave of attacks on supermarket refrigeration systems hit retailers in Belgium, Luxembourg, Sweden and Estonia overnight on 2 November 2026, raising fridge and freezer temperatures and causing food losses. Affected chains include Delhaize (Ahold Delhaize), Colruyt/Spar, Carrefour, ICA, Coop and an unnamed Estonian chain. The incidents follow a similar mid-October attack on hundreds of French supermarkets that targeted Danfoss equipment. No actor has claimed responsibility and authorities have not attributed the attacks.
Technical Details
- Attackers appear to have remotely triggered the forced defrost function in continuous mode with a 50°C setpoint. Sabcobel's CEO said evaporators were switched to defrost mode.
- In Sweden, stores reported temperatures set to 50°C. Consultant Emil Olofsson (Integrity 360) said some units reached 80°C and caught fire, a figure that differs from the police number.
- Scale: about 40 Delhaize stores in Belgium were reportedly affected, five Colruyt-run Spar stores, at least 6 ICA stores and 6 Coop stores in central Sweden. Le Soir reported dozens of Delhaize and Carrefour stores.
- Likely access: in the French case, Olofsson said attackers obtained login credentials for control systems exposed directly to the internet. He called the hack simple, so it may have been done by amateurs. The Swedish cyber centre's John Billow noted many exposed OT devices in Sweden.
- The cause of the Swedish incidents is officially unknown. Ahold's separate October report to Dutch police has no reported link to these incidents.
Remediation
- Remove OT and refrigeration control interfaces from direct internet exposure.
- Patch and update exposed devices, as Swedish authorities have urged.
- Rotate and protect credentials for control systems.