--- title: Second wave of supermarket refrigeration sabotage: about 40 Delhaize stores in Belgium and Luxembourg, 15 Carrefour Belgium stores, and ICA and Coop stores in Sweden had freezer temperatures pushed up overnight | ctxsec url: https://ctxsec.com/items/europe-supermarket-fridge-cyberattack-belgium-sweden-nov-2 description: "Overnight into Nov 2, refrigeration and freezer controls at dozens of European supermarkets were tampered with, three weeks after the Oct 12 attack on hundreds of French stores. Delhaize says about 40 stores in Belgium and Luxembourg saw sudden temperature rises, Carrefour Belgium confirms a cyberattack on 15 stores, and ICA and Coop confirm incidents at a limited number of Swedish stores, with one ICA store reporting freezers set to +50 \u00b0C. Sweden's national cybersecurity center and Belgium's CCB are working the incidents. No one has claimed it and the entry point is not public." status: "official (statements from Delhaize, Carrefour Belgium, ICA and Coop; Sweden's NCSC and Belgium's CCB confirm they are handling it); attacker and entry point not disclosed" published: 2026-11-02 --- > Overnight into Nov 2, refrigeration and freezer controls at dozens of European supermarkets were tampered with, three weeks after the Oct 12 attack on hundreds of French stores. Delhaize says about 40 stores in Belgium and Luxembourg saw sudden temperature rises, Carrefour Belgium confirms a cyberattack on 15 stores, and ICA and Coop confirm incidents at a limited number of Swedish stores, with one ICA store reporting freezers set to +50 °C. Sweden's national cybersecurity center and Belgium's CCB are working the incidents. No one has claimed it and the entry point is not public. [← Cybersecurity News](/news) · [markdown](/items/europe-supermarket-fridge-cyberattack-belgium-sweden-nov-2.md) official (statements from Delhaize, Carrefour Belgium, ICA and Coop; Sweden's NCSC and Belgium's CCB confirm they are handling it); attacker and entry point not disclosed 2026-11-02 ### Second wave of supermarket refrigeration sabotage: about 40 Delhaize stores in Belgium and Luxembourg, 15 Carrefour Belgium stores, and ICA and Coop stores in Sweden had freezer temperatures pushed up overnight During the night of **Nov 1 to Nov 2**, refrigeration systems at supermarkets in several European countries started warming up. It is the second such wave after the **Oct 12** attack on French chains (covered on this site). - **Belgium and Luxembourg:** Delhaize says about **40 stores** saw sudden temperature rises in fridges and freezers (up to about 15 °C) and that it is investigating what it first called an IT incident. **Carrefour Belgium** confirms a cyberattack affecting **15 stores**, and about five independent **Spar** operators report similar problems (VRT). Per Reuters, the CEO of Sabcobel, the refrigeration company that runs Delhaize's systems, told Belga it was a cyberattack in which evaporators were switched into defrost mode. Belgium's **CCB** says it is aware of an incident targeting supermarket refrigeration but has no further details. - **Sweden:** ICA says a limited number of stores that connect _outside ICA's central network_ were affected; one ICA store in Sjöbo said its fridges and freezers were "hacked" and set to +50 °C, and an Öland store found a freezer at 55 °C. Coop says six to seven of its roughly 800 stores, mainly around Gävle, were hit and that it had already ordered a system upgrade after the French attack. Sweden's national cybersecurity center (at FRA) says it is in contact with those affected; its head told Reuters the center had recently found many exposed operational-technology devices in Sweden that need patching. - **Elsewhere:** the BBC reports 13 SuperValu stores in Ireland were affected, and Reuters, citing Estonian broadcaster ERR, says an Estonian chain saw temperatures set to 50 °C. - **Losses:** single stores report €60,000 to €100,000 of spoiled stock, and the BBC cites local reports of millions of euros in total. **Not yet known:** who did it, and whether the same vendor products or remote-maintenance accounts were used in every country. In France, CERT-FR pointed at internet-exposed Danfoss and Copeland/Dixell controllers; no authority has said the Nov 2 incidents used the same route. **What to do if you run refrigeration or building controls:** take controller web interfaces and remote-maintenance portals off the internet or put them behind a VPN, change default and shared maintainer passwords, require MFA for any supplier remote access, and set temperature and defrost-mode alarms that page someone outside the controller vendor's own console. Sources: [BBC News: Supermarket freezers in Belgium, Sweden and Luxembourg hit by suspected cyber-attack (Nov 2)](https://www.bbc.com/news/articles/cq1kd1nee80eo) · [Reuters via NBC News: European supermarkets hit by new fridge cyberattack (Nov 2)](https://www.nbcnews.com/world/europe/european-supermarkets-hit-new-fridge-cyberattack-rcna606972) · [VRT NWS: Delhaize, Carrefour and Spar cooling systems hit (Nov 2, in Dutch)](https://www.vrt.be/vrtnws/nl/2026/11/02/cyberaanval-delhaize/) · [De Morgen live page: CCB confirms incident (Nov 2, in Dutch)](https://www.demorgen.be/nieuws/live-koelkasten-verscheidene-winkelketens-getroffen-door-cyberaanval-ook-problemen-gemeld-in-andere-europese-landen~b9d993ad/) · [SVT: ICA and Coop fridges and freezers hacked; NCSC involved (Nov 2, in Swedish)](https://www.svt.se/nyheter/lokalt/skane/icas-kylar-och-frysar-i-sjobo-hackade-haller-ej-temperaturen) · [SVT: Coop freezers in Gävleborg knocked out (Nov 2, in Swedish)](https://www.svt.se/nyheter/lokalt/gavleborg/coops-frysar-i-gavleborg-utslagna-i-misstankt-hackerattack)