During the night of Nov 1 to Nov 2, refrigeration systems at supermarkets in several European countries started warming up. It is the second such wave after the Oct 12 attack on French chains (covered on this site).

• Belgium and Luxembourg: Delhaize says about 40 stores saw sudden temperature rises in fridges and freezers (up to about 15 °C) and that it is investigating what it first called an IT incident. Carrefour Belgium confirms a cyberattack affecting 15 stores, and about five independent Spar operators report similar problems (VRT). Per Reuters, the CEO of Sabcobel, the refrigeration company that runs Delhaize's systems, told Belga it was a cyberattack in which evaporators were switched into defrost mode. Belgium's CCB says it is aware of an incident targeting supermarket refrigeration but has no further details.
• Sweden: ICA says a limited number of stores that connect outside ICA's central network were affected; one ICA store in Sjöbo said its fridges and freezers were "hacked" and set to +50 °C, and an Öland store found a freezer at 55 °C. Coop says six to seven of its roughly 800 stores, mainly around Gävle, were hit and that it had already ordered a system upgrade after the French attack. Sweden's national cybersecurity center (at FRA) says it is in contact with those affected; its head told Reuters the center had recently found many exposed operational-technology devices in Sweden that need patching.
• Elsewhere: the BBC reports 13 SuperValu stores in Ireland were affected, and Reuters, citing Estonian broadcaster ERR, says an Estonian chain saw temperatures set to 50 °C.
• Losses: single stores report €60,000 to €100,000 of spoiled stock, and the BBC cites local reports of millions of euros in total.

Not yet known: who did it, and whether the same vendor products or remote-maintenance accounts were used in every country. In France, CERT-FR pointed at internet-exposed Danfoss and Copeland/Dixell controllers; no authority has said the Nov 2 incidents used the same route.

What to do if you run refrigeration or building controls: take controller web interfaces and remote-maintenance portals off the internet or put them behind a VPN, change default and shared maintainer passwords, require MFA for any supplier remote access, and set temperature and defrost-mode alarms that page someone outside the controller vendor's own console.