After France, hackers are heating up the fridges at Delhaize and Carrefour across Europe

At 2 a.m. on the night of Sunday, November 1 to Monday, November 2, the freezers at an ICA store in Stockholm stopped cooling. The anomaly was only spotted at 5:30 a.m. In the store, a sign said all freezers were out of service because of a cyberattack. According to Reuters, a Swedish store wrote on social media that the temperature of its fridges had been hacked and set to 50°C.

Sweden is not an isolated case. On November 2, retailers in several European countries reported the same phenomenon: in Belgium, Luxembourg, Ireland, Estonia and the Netherlands. According to Euronews, Finnish media also mention stores of the K Group. The modus operandi recalls the attack that disrupted refrigeration at hundreds of French supermarkets on October 12, which we covered in this article. No one has claimed these attacks at this stage.

Dozens of stores hit in a single night

Belgium is the hardest-hit country. According to a count by the daily Le Soir, cited by Euronews, about 40 Delhaize Proxy stores, 15 Carrefour Shop & Go stores, 15 Intermarché stores and 5 Spar stores located in gas stations were affected. Delhaize spokesperson Sarah De Meester confirmed to Reuters “an IT incident” affecting the refrigeration systems of dozens of stores in Belgium and Luxembourg. At Carrefour Belgium, spokesperson Mich Vergauwen is more direct: “It's a cyberattack, there is no other reason.” He considers the impact very limited. According to Euronews, Delhaize suspended its ordering systems in Luxembourg as a precaution.

Elsewhere, the retailer Musgrave reports 13 SuperValu stores affected in Ireland, again according to Euronews. In Sweden, Coop told the daily Aftonbladet that six of its stores were affected. In Estonia, the service provider Kitman Coldtech reported a supermarket whose temperature had been set to 50°C. According to a Danfoss spokesperson cited by Euronews, the refrigeration systems of at least 17 Dutch companies were also attacked. In Belgium, media report setpoints of up to 70°C and food thrown away worth several hundred thousand euros.

The same mechanism as in France?

Stephan Moelans runs Sabcobel, the installer that manages Delhaize's refrigeration systems. According to him, the attack switched the evaporators to defrost mode, and he told the Belga news agency that the mechanism was exactly the same as in France. He also believes that a software update will not be enough and that physical modifications will be necessary. Sabcobel counts about twenty affected installations out of the hundreds it manages in Belgium. According to him, most of its customers had already been using a secure connection since the French attack.

According to Euronews, Danfoss supplied the software for the affected installations, in France as well as this time. The Danish manufacturer blames outdated software and says it has asked its customers to adopt its new version. After the October attack, it had said, according to Reuters, that many of the affected devices were end-of-life and no longer received software or security updates. In Sweden, John Billow, director of the national cybersecurity center, told Reuters that his teams had spotted a significant number of industrial devices exposed on the internet in recent weeks, and had called for them to be updated.

What should you do if you manage refrigeration systems?

No sophisticated vulnerability has been described at this stage: in France, weak passwords were enough, according to ANSSI (France's national cybersecurity agency). The basic precautions therefore apply to any remotely managed refrigeration system, in a store or a warehouse.

• Do not leave any supervision interface directly accessible from the internet: use a VPN or a secure connection managed by your installer.
• Change default or overly simple passwords, and check the list of authorized accounts.
• Take inventory of your Danfoss controllers and identify models that are no longer updated. CERT-FR (France's government computer emergency response team) had published an alert on the AK-SM and AK-SC controllers.
• Enable temperature alerts that are independent of the controller, to detect a drift overnight without waiting for the store to open.

The question of the operation's purpose remains. The Centre for Cybersecurity Belgium (CCB) only says it is aware of an incident, with no further information. No authority has named a culprit. One thing is certain: three weeks after the French warning, many devices were still reachable.

Update of November 13, 2026

The attacks that disrupted refrigerated display cases in European supermarkets on the night of November 1 to 2 have been claimed. According to the Belgian site RetailDetail, two pro-Russian hacker groups, NoName057(16) and Z-Pentest, claimed these attacks on the Telegram messaging app. They released about 2,500 lines presented as extracted from a database of Danfoss, the Danish manufacturer of refrigeration controllers, with usernames and passwords. Z-Pentest blames the “systemic negligence” of European and American operators.

This claim calls for caution. According to RetailDetail, the Telegram channels have since disappeared, and no independent evidence confirms the involvement of these groups. NoName057(16) is mostly known for distributed denial-of-service (DDoS) attacks, which overwhelm websites; it has already targeted Belgian government bodies and media. Danfoss said there was no indication that its internal IT infrastructure had been compromised, without confirming the theft of credentials.

On the authorities' side, the European Commission convened a crisis meeting including ENISA, the European Union Agency for Cybersecurity, and Europol, again according to RetailDetail. The Centre for Cybersecurity Belgium (CCB) had warned as early as October 13 about vulnerabilities in these systems.