Supermarkets: refrigeration hacked remotely in more than 115 stores

A night of outages in six countries

During the night of Sunday 1 to Monday 2 November 2026, the refrigeration systems of more than 115 stores were altered remotely. The affected stores are in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, reports Bleeping Computer, which obtained confirmation from several retail chains. The attackers changed the temperature settings of freezers and cooling systems. They also switched off some units or triggered defrost cycles. Temperatures therefore rose. This caused significant stock losses and forced store managers to step in early in the morning. At this stage, nobody knows whether this was a coordinated operation or a series of separate attacks against each site.

The chains affected

Ahold Delhaize is the hardest-hit chain, with around forty stores in Belgium and Luxembourg. In Belgium, Carrefour reports 15 affected stores out of 700, in both Flanders and Wallonia, and no hypermarkets. Intermarché reports around fifteen. Spar Colruyt reports 5. They are run by independent entrepreneurs who have their own refrigeration installations. In Sweden, Coop lists 7 stores out of more than 800. ICA reports at least 4, which operate outside its central network. In Ireland, 13 SuperValu stores are affected, and in Estonia, one Selver store.

In the Netherlands, at least 17 butcher’s shops and convenience stores are affected. In Belgium, the same failures also hit an Ikea store in Mons, as well as grocery shops and chocolate shops.

On the ground, stock to be saved

The situation varies from one store to another. At Coop, some fridges and freezers stopped completely, while others were only partly working. In one case, the system even started producing heat. An ICA store manager told the TV channel TV4 that the temperature had been set to +50 °C during the night and could not be changed. The store had to throw away its frozen products.

According to the broadcaster RTL, Ahold Delhaize alerted its store managers by text message at around 4 a.m. Some stores brought in refrigerated trucks to save their stock. Carrefour says all its stores stayed open, with only a few units affected, mainly freezers. ICA, Ahold Delhaize and Spar Colruyt say they are helping the affected stores get back to normal. Coop says the incident is under control.

A flaw already exploited in France

RTL identified Sabcobel as the supplier of the refrigeration installations in several of the affected stores. The company’s director says the attacker used the same flaw as in similar attacks in France last month. According to the director, the failures came from defrost functions that were activated remotely. Technicians began disconnecting the affected installations from 1 a.m. The director adds that a simple software update is not enough: the equipment must also be physically modified.

That last point shows how fragile this kind of connected equipment is. With conventional software, you can roll out a fix in a single update. Here, someone has to work on each installation. Until that work is done, a flaw found in France last month can still be used elsewhere.

For the affected stores, getting back to a safe situation will take more than a patch: a technician will have to visit every installation.