Second wave of attacks hits supermarket refrigerators across four European countries

A second wave of suspected cyberattacks has hit supermarket refrigerators across Europe, raising fridge temperatures and spoiling food at dozens of stores in Belgium, Ireland, Luxembourg and Sweden.¹

Ahold Delhaize and Colruyt confirmed the hacks overnight. One Belgian company that operates Delhaize’s systems said the attackers changed the units’ settings to defrost.¹ Affected stores have had to throw out goods that thawed or were otherwise no longer fit to sell.¹

These are the first confirmed details of the new wave. How many stores are affected, and what the losses add up to, has not been stated.

It follows an earlier incident last month in France, where deliberately raised temperatures caused spoilage at hundreds of supermarkets.¹ Security researchers traced that one to internet-connected refrigerators made by Danish company Danfoss, which was no longer providing security updates for them.¹ In August, security company Claroty had warned that those units were exposed to remote hacks and outages.¹ Whether the same equipment is involved this time has not been confirmed.

Seen it before: a device that nobody updates, reachable from the internet, with a warning published weeks ahead of the incident.

The pattern is not new for the food supply chain. In 2025, a cyberattack on distributor UNFI led to shortages and empty shelves at U.S. grocery stores.¹ U.S. Department of Defense officials are reportedly investigating whether freezer units on military bases were hacked by Iran-backed hackers, and Iranian hackers were also blamed for attacks on U.S. water providers earlier this year.¹ Those are reports and attributions, not findings tied to the European incidents.

Our read: Refrigeration is an easy thing to ignore until it fails, and it is now failing in two rounds a month apart. If the cause turns out to be the same unsupported hardware flagged in August, this is a maintenance story as much as an attack story. What would change that reading is evidence of a different vendor or a different method. Where the facts stop: no attacker has been identified in the reporting, and we are not guessing at one. The next thing to watch is whether the retailers or the equipment makers disclose what was compromised and how.

This account rests on a single outlet’s reporting, which cites the retailers’ confirmations.¹

Footnotes

1. TechCrunch, “A fresh wave of cyberattacks has hit Europe’s supermarket refrigerators, destroying food across countries”. Retrieved November 2, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹