Cyberattack Disrupts Refrigeration Systems at European Supermarkets
Summary
More than 115 stores across six European countries reported refrigeration disruptions after attackers remotely changed settings or activated defrost functions. Multiple chains confirmed impacts; whether the incidents were coordinated remains unclear.
Key points
- More than 115 supermarkets and other stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia were affected.
- The article reports that attackers remotely changed freezer and cooling-system settings, shut down units, or activated defrosting, causing temperatures to rise and some stores to discard frozen food.
- Multiple chains, including ICA, Coop, Ahold Delhaize, Carrefour, and Spar Colruyt, confirmed refrigeration issues; several said stores remained open or the situation was under control.
- An ICA store manager said settings were changed to +50°C and could not be modified. Ahold Delhaize reportedly alerted managers by SMS, and some stores used refrigerated trucks to preserve stock.
- Refrigeration vendor Sabcobel's director attributed the disruption to remotely activated defrost functions and said the attacker used the same vulnerability as in similar attacks in France last month.
- The article does not establish whether the European incidents were coordinated or targeted individually. Sabcobel had not responded to BleepingComputer's inquiry at publication time.
- Sabcobel's director said a software update alone may not be sufficient and recommended managing refrigerators through a secure internet connection.
Article Details
- Victim Organization
- Multiple supermarket chains and stores, including ICA, Coop, Ahold Delhaize, Carrefour, Spar Colruyt, Intermarché, SuperValu, Selver, and an IKEA superstore
- Incident Type
- Cyberattack disrupting refrigeration and freezer systems; attackers reportedly changed temperature settings and activated defrost functions remotely.
- Incident Date
- 2026-11-02
- Disclosure Date
- 2026-11-02
- Affected Records
- More than 115 stores were reported affected across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia; at least 17 butcher shops and neighborhood stores in the Netherlands were also affected.
- Operational Impact
- Refrigerators and freezers were shut down, partially impaired, or reportedly made to generate heat. Some stores discarded frozen food or used refrigerated trucks to preserve stock; technicians disconnected affected installations. The article reports significant product losses, while some chains said stores remained open or the situation was contained.
- Ransom Or Extortion
- Not disclosed
- Claim Status
- confirmed
People
Vendors
CopelandLast month's refrigerator attacks in France impacted hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers that were compromised by remote attackers who set them to defrost mode.DanfossLast month's refrigerator attacks in France impacted hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers that were compromised by remote attackers who set them to defrost mode.DixellLast month's refrigerator attacks in France impacted hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers that were compromised by remote attackers who set them to defrost mode.SabcobelThe publication also identified Sabcobel as the vendor of refrigeration systems across several of the impacted locations.
Products
Copeland/Dixell XWEBLast month's refrigerator attacks in France impacted hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers that were compromised by remote attackers who set them to defrost mode.Danfoss AK-SM/AK-SCLast month's refrigerator attacks in France impacted hundreds of stores using Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers that were compromised by remote attackers who set them to defrost mode.
Countries
BelgiumMore than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia have been affected.EstoniaMore than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia have been affected.FranceAccording to Sabcobel's director, Stephan Moelans, the attacker leveraged the same vulnerability used in similar attacks last month in France.IrelandMore than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia have been affected.LuxembourgMore than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia have been affected.NetherlandsMore than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia have been affected.SwedenMore than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia have been affected.