Cyberattacks disrupted refrigeration systems at supermarkets and other food businesses across Europe on November 2, 2026, causing some refrigerators and freezers to malfunction. Attackers remotely changed cooling settings at affected locations, forcing retailers to remove products from sale or discard spoiled food. Initial reports identified more than 115 affected locations, although the total remains provisional as businesses and authorities continue assessing the incidents. The attacks have raised serious concerns about the security of internet-connected refrigeration equipment.
Retailers identified problems during the early hours of November 2, 2026, after refrigeration equipment began showing unexpected temperatures. At one ICA supermarket in Sweden, staff reported freezer settings reaching 50ยฐC (122ยฐF). Other affected locations described refrigerators shutting down, entering defrost mode, or, in one case, producing heat instead of cooling. These problems forced some stores to discard food and temporarily stop using affected equipment. The reported failures varied between locations.
Retailers reporting refrigeration problems included Carrefour and Ahold Delhaize in Belgium and Luxembourg, ICA and Coop in Sweden, and SuperValu in Ireland. Carrefour said 15 of its more than 700 Belgian stores were affected; Coop reported seven affected stores; and SuperValu’s operator Musgrave identified 13 Irish locations. A Reuters update published on November 3 reported that ICA had counted 23 affected stores, while Ahold Delhaize described disruption at several dozen sites. Smaller food businesses also experienced problems in the Netherlands, with additional incidents reported in Estonia, Finland, Germany, and other European countries. Some retailers temporarily disconnected vulnerable refrigeration equipment from the internet while reviewing security protections.
The attacks also reached food suppliers in the United Kingdom. On November 3, the UK’s National Cyber Security Centre (NCSC) confirmed that it was working with affected organizations and described the nationwide impact as minimal. The Association of Independent Meat Suppliers said several of its members experienced unexpected defrosting or overheating of refrigeration equipment. However, the association reported that no meat was lost at those businesses. The incidents show that the cyberattacks affected more than supermarkets, although widespread disruption to UK food supplies has not been established.
The precise method used in every November intrusion remains under investigation. Supermarkets commonly use connected control systems to monitor temperatures, manage cooling equipment, and improve energy efficiency. This equipment forms part of operational technology (OT), which controls physical processes. In an October security alert, France’s CERT-FR identified compromised remote refrigeration controllers, including Danfoss AK-SM and AK-SC as well as Copeland and Dixell XWEB systems. However, that alert does not establish that every location affected in November used the same equipment or suffered exploitation of the same vulnerability.
Older or poorly protected refrigeration controllers can become exposed when their management interfaces are accessible through the public internet. Danfoss’s published security advisories document vulnerabilities in some AK-SM 8xxA software versions, including authentication and command-injection flaws. Attackers may also exploit weak credentials or outdated software to interfere with connected equipment. However, the existence of a known vulnerability does not prove that it caused every November incident. Businesses should check their exact equipment models, installed software versions, and manufacturer recommendations.
The November attacks followed a major cyberattack in France on October 12, 2026, when hackers interfered with refrigeration systems at hundreds of supermarkets. The earlier incident caused food losses and prompted warnings about vulnerable remote-access equipment. Although the October and November attacks showed similar patterns, investigators have not confirmed that the same hackers were responsible for every incident. The repeated disruptions highlight the continuing risks facing businesses that depend on connected cooling systems.
The financial impact of these attacks can be significant. Supermarkets depend on refrigeration systems to keep meat, dairy products, frozen foods, and other perishable items at safe temperatures. When cooling equipment stops working properly, businesses may need to discard products that can no longer be safely sold. Repairs, emergency inspections, and temporary business interruptions can create additional expenses.
The incidents highlight the cybersecurity risks associated with connected equipment and operational technology. Internet of Things (IoT) devices and industrial control systems can use network connections to exchange information, monitor conditions, and manage equipment remotely. Although these capabilities improve efficiency, poorly secured connections can expose important systems to unauthorized access. In the case of refrigeration equipment, a digital intrusion can create physical consequences, including spoiled food, disrupted operations, and additional safety checks. For more background on how digital systems monitor and control physical equipment, read our guide to supervisory control and data acquisition (SCADA).
Businesses using connected refrigeration systems should identify exposed controllers, remove unnecessary public-internet access, replace default passwords, install manufacturer-approved security updates, and review equipment configurations. The UK NCSC’s operational technology guidance recommends reducing unnecessary internet exposure. Where remote access is required, operators should use a secure VPN or protected network and limit access to authorized staff and suppliers. Separating operational systems from ordinary business networks can further reduce security risks. Businesses should coordinate incident-response actions with refrigeration specialists to maintain safe temperatures and reliable monitoring while affected systems are secured. Businesses looking to strengthen account access and network separation can also read our Zero Trust security guide for small businesses.
Authorities have not publicly identified who carried out the latest attacks or established whether every incident was connected. No verified evidence shows that artificial intelligence was used in the attacks. Investigations are continuing as retailers, cybersecurity agencies, and equipment providers work to protect affected systems and prevent further disruption.
The November 2026 supermarket cyberattacks show that hackers do not need to target banking systems or personal information to cause serious damage. By exploiting weaknesses in connected equipment, attackers can disrupt essential business operations and potentially affect food safety. The incidents serve as an important reminder that cybersecurity protection must extend beyond computers and smartphones to include the physical devices businesses rely on every day.
