Cyberattacks disrupt refrigeration at European supermarkets
After suspected attacks, retailers are pulling chilled goods from sale. Coop, Migros and Aldi Suisse report no comparable cases so far.
In several European countries, refrigeration systems in grocery stores failed or became too warm on Monday, 2 November 2026, following suspected cyberattacks. According to agency and media reports, those affected include Belgium, Sweden, Ireland, Luxembourg, Estonia and the Netherlands. Retailers withdrew chilled and frozen goods from sale. Coop, Migros and Aldi Suisse initially reported no comparable incidents in Switzerland.
The attacks did not target only the stores' office IT but the control systems of the refrigeration technology itself. At the Belgian service provider Sabcobel, the systems were switched into defrost mode remotely, according to its head Stephan Moelans. Technicians had been working since the night, SRF reported, citing the Belga agency.
Not every affected freezer reached 50 degrees
For Belgium, the SRF report names around 40 Delhaize branches, 15 Carrefour stores and five Spar shops. These figures do not amount to a robust Europe-wide damage total. Nor can they be used to conclude that all goods in every affected store have spoiled.
The frequently cited figure of 50 degrees comes, among other sources, from an ICA Kvantum branch in Sjöbo, Sweden. According to the AP news agency, the store said its refrigeration systems had been set to that temperature. A changed target temperature, however, is not a measurement of the temperature of every individual food item. That would require actual readings and the duration of the warming.
In Ireland, 13 SuperValu stores were affected, according to the operator Musgrave. Chilled and frozen products were withdrawn from sale as a precaution. On Monday afternoon the company said, according to AP, that the incident had been fully resolved and that shelves were being restocked.
Temperature records decide the fate of the goods
In food safety, what counts is the course of the cold chain. The Irish food authority FSAI requires butcher businesses to carry out regular temperature checks and to keep records for refrigerators, cold rooms and freezers. Frozen food must be stored there at minus 18 degrees or colder. For poultry it recommends a maximum of four degrees, for offal three degrees and for other meat five degrees.
The authority warns that harmful bacteria can multiply rapidly between five and 63 degrees. Whether a particular item may still be sold after a disruption therefore cannot be read off from a refrigerator that is running again. A return to the normal setting does not prove that the products were stored correctly during the outage.
A warning had been available since October
France's cyber defence unit CERT-FR had already warned on 12 October about compromised remote controls for refrigeration systems and last updated its recommendations on 16 October. It names Danfoss systems of the AK-SM and AK-SC series as well as Copeland and Dixell Xweb devices. The alert therefore concerns more than one manufacturer.
CERT-FR advises against leaving management interfaces directly reachable from the public internet. Remote access should take place only via a secured private network or a correspondingly protected access point. Operators should also review the entire configuration, including defrost times, and implement the manufacturers' recommendations.
For devices that have already been compromised, the warning says it is not enough to reset them to factory settings and reconnect them to the network unchanged. With outdated devices that receive no security updates, the original attack path otherwise remains open. The authority already pointed in October to attack campaigns that were presumably still ongoing.
Known vulnerabilities, but no clear attack chain yet
The manufacturer Danfoss documents, among other things, security gaps in versions before 4.3.1 for the newer AK-SM-8xxA series and points to software fixes. The research team Team82 at Claroty describes how the central management of such systems brings together temperature limits, operating times and alarms. An abused access point can thereby affect several functions of an installation.
These published gaps, however, are not automatically the proven entry point of every current incident. CERT-FR lists several product families; the specific software setup and the sequence of events must be investigated for each operation.
For Switzerland, SRF reported statements that the three major retailers gave to AWP. Their all-clear applies to the state of knowledge at the time, not as a technical guarantee for all refrigeration systems in the country. After an attack, two tasks stand side by side: securing remote access and establishing, on the basis of temperature records, which foods may return to sale.
Sources
- CERT-FR: alert on remote controls for refrigeration systems, as of 16 October 2026
- Danfoss: security advisory DSA-2025-08-01 on the AK-SM-8xxA series
- Claroty Team82: investigation of Danfoss refrigeration controllers
- Food Safety Authority of Ireland: chilled temperatures and control obligations
- AP: retailer statements on the incidents in Europe, 2 November 2026
- SRF: incidents in Europe and statements by Swiss retailers, 2 November 2026
- Lead image: Jonatan Svensson Glad, freezer chests at Willys, Wikimedia Commons, public domain
- Article image: Tony Webster, refrigeration thermometer, Wikimedia Commons
- Article image licence: Creative Commons Attribution 2.0
