- Belgium and Luxembourg: Around 40 Delhaize stores were affected (an “IT incident” involving refrigeration systems). About 15 Carrefour stores in Belgium and five Spar/Colruyt franchise shops also reported problems. One Belgian refrigeration firm (Sabcobel) described units being switched into defrost mode so they warmed up.
- Sweden: A limited number of ICA stores and roughly 6–7 Coop stores saw temperatures spike (reports of 50–55 °C / 122–131 °F in some freezers). Staff emptied freezers and discarded spoiled stock; some stores temporarily limited fresh/frozen ranges.
- Ireland: 13 SuperValu stores (Musgrave) were impacted; chilled and frozen products were removed from sale.
- Other countries: Incidents reported in Estonia, the Netherlands and Finland (including some K-stores / Kesko). One IKEA location in Belgium was also noted.
Most affected stores stayed open or reopened quickly after isolating systems, with distribution centres largely unaffected. Losses included discarded food (one Belgian store cited roughly €100,000 in one case).
Context and method
This closely resembles a larger October 2026 incident in France, in which hackers remotely took control of refrigeration controllers (widely linked to older Danfoss systems such as AK-SM 800 / AK-SC 355 models). Units were forced into prolonged defrost mode, driving temperatures as high as 50 °C (and higher in some reports), spoiling large quantities of food and occasionally triggering fires or sprinklers. Losses there ran into the millions of euros across hundreds of stores.
In the latest wave, the same pattern—remote access to internet-connected refrigeration controllers, elevating temperatures—has been described by suppliers and retailers. Investigations are under way; no perpetrators have been publicly identified. Cybersecurity bodies in affected countries (including Sweden’s) have noted exposure of operational technology devices and the need for patching.
The attacks highlight risks from internet-exposed industrial/IoT refrigeration systems used for remote monitoring and maintenance. Retailers and suppliers have been disconnecting vulnerable units from networks and applying physical or software mitigations.
