After France, hackers overheat supermarket refrigeration in nine countries

At 4 a.m. on Monday, November 2, the freezer cases in several Coop supermarkets in Sicily stopped responding. According to Giuseppe Spadaro, a manager at Radenza, which operates the stores, the attack targeted the system that remotely controls the refrigerated units. The same day, retailers in eight other European countries reported the same problem.

The next day, Tuesday, November 3, the European Commission held two coordination meetings. Early in the morning, it brought together ENISA, the EU cybersecurity agency, Europol and its own departments. Late in the morning, it convened EU-CyCLONe, the network that coordinates national authorities during a large-scale cyber crisis, with member states, including the affected countries.

From Sicily to Estonia, stores throwing out products

Nine countries are affected: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. That is the tally compiled by Toute l'Europe and Euronews from statements by retailers, authorities and national media. In Belgium, around 15 of the 700 Carrefour stores were hit, as was the Ikea store in Mons. Delhaize, Colruyt and Intermarché also reported problems, and the federal prosecutor's office opened an investigation. “It's a cyberattack, there is no other reason,” said Mich Vergauwen, spokesperson for Carrefour Belgium.

Elsewhere, the Musgrave group has 13 SuperValu stores affected in Ireland, and Les Mousquetaires has seven Intermarché stores affected in Portugal. In Luxembourg, four Delhaize supermarkets are affected, and in Sweden, six of the roughly 800 Coop stores. In Estonia, equipment was pushed up to 50°C (122°F), according to public broadcaster ERR. Some stores had to throw out their products. No group has claimed these attacks.

The same supplier as in France

Danfoss is the Danish company whose refrigeration controllers were among the equipment targeted in the October 12 attack on French stores. It told Bloomberg that its products had been targeted again. In Sweden, the retailer ICA refers all questions to this supplier. In France, according to Danfoss, most of the affected devices were older products that no longer received security updates. ANSSI, France's national cybersecurity agency, also found that basic security flaws, including weak passwords, had been exploited. In Belgium, the refrigeration contractor Sabcobel acknowledges that it began securing its installations after the French incident, but did not have time to upgrade them all.

In Brussels, the tone is serious but cautious. Christophe Hansen, the commissioner for agriculture and food, called the attacks “extremely worrying.” In his view, food security is not under threat for now, but the losses are very real for retailers. Commission spokesperson Thomas Regnier pointed out that it is not up to the Commission to attribute these incidents: investigations are led by national authorities.

Is your refrigeration remotely controlled? The steps to take

Both waves have one thing in common: refrigeration controllers reachable from the internet, often old ones. In October, CERT-FR (the French government's computer emergency response team) had published an alert on Danfoss AK-SM and AK-SC controllers. The best practices:

• check that no refrigeration control interface is directly accessible from the internet;
• change default or overly simple passwords, and ask the refrigeration contractor who holds access;
• inventory devices that no longer receive updates and plan their replacement;
• make sure staff can still check temperatures and act if remote access is disrupted, as recommended by Paolo Falcioni, director general of APPLiA, which represents European home appliance manufacturers.

The central question remains: who is behind these attacks, and why strike three weeks after France? Speaking to The Guardian, Rafe Pilling of security vendor Sophos ruled out neither a state demonstrating its capabilities nor a lone hacker. National investigations will have to settle it.

Update of November 13, 2026

France has named a party responsible for the attack that hit its supermarkets in October. On November 9, Foreign Minister Jean-Noël Barrot stated that “responsibility for this attack lies with the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran.” In the night of October 11 to 12, it had hit around 700 retail sites. According to AFP, the Cyber Crisis Coordination Center (C4) brings together, among others, ANSSI (the French national cybersecurity agency) and the DGSE (the French foreign intelligence service). It relies on “a body of evidence”: the Revolutionary Guards would be the sponsors, and Shahid Kaveh, an offensive cyber unit linked to them, the perpetrator.

The same day, Paris prosecutor Laure Beccuau announced that investigating judges had been assigned an investigation targeting “the head of the Iranian group Shahid Kaveh” and “his two deputies.” Paris has summoned Iran's ambassador and promises “sanctions at the European level.” Kaja Kallas, the European Union's top diplomat, said the Foreign Affairs Council would discuss it the following Monday.

This attribution covers only the October attack in France. For the November 2 wave in nine other countries, no authority has named anyone responsible. According to the site RetailDetail, two pro-Russian groups, NoName057(16) and Z-Pentest, claimed it on Telegram. They published what they presented as 2,500 rows from a Danfoss database, with usernames and passwords. Their channels have since disappeared, and no independent evidence supports these claims. The Kremlin denied any involvement on November 5, AFP reports.