European Supermarket Refrigeration Disruptions Draw Unverified Attack Claims
Summary
Retailers in Belgium, Luxembourg and Sweden reported overnight refrigeration disruptions, with temperatures reportedly reaching 50°C. NoName057(16) and Z-Pentest claimed responsibility, but the claims remain unverified and no entry point is known.
Key points
- Retailers in Belgium, Luxembourg and Sweden reported refrigeration disruptions overnight on November 1–2, 2026; some stores reported temperatures as high as 50°C, spoiled stock or delayed openings.
- Sabcobel’s CEO said affected Belgian units had their evaporators switched into defrost mode; technicians disconnected the installations.
- Sweden’s national cybersecurity center is responding to several cooling-system incidents. Retailer and contractor descriptions vary, and the incidents have not all been formally confirmed as cyberattacks.
- NoName057(16) and Z-Pentest claimed responsibility on November 3 and named Danfoss and Dixell XWEB equipment, but no retailer or authority confirmed the equipment or the groups’ claims.
- The article reports incidents in additional European countries and says no shared attacker has been established across the recent waves.
- CERT-FR guidance includes removing controllers from direct internet exposure, securing remote access, reviewing configurations, updating firmware and replacing end-of-life devices.
Article Details
- Event Type
- Suspected cyberattacks involving remotely managed supermarket refrigeration systems in Belgium, Luxembourg, and Sweden; the incidents have not been officially attributed.
- Impact
- Refrigeration systems reportedly switched to defrost mode or had temperature settings raised as high as 50°C. Retailers reported spoiled stock, delayed openings, and temporary closures; one Delhaize store estimated €100,000 in lost produce. The incidents affected dozens of stores, with counts varying by retailer and report.
People
John BillowHead of Sweden’s national cybersecurity center; he confirmed the center was responding to incidents affecting grocery refrigeration and noted exposed operational technology devices requiring updates or patches.Stephan MoelansCEO of Sabcobel; he described the Belgian events as a cyberattack and said affected installations were disconnected.
Threat Actors
NoName057(16)Claimed responsibility for the refrigeration attacks, but the claim is unverified and no authority has attributed the incidents to the group. It also claimed a DDoS attack on Danfoss and a leak of alleged credentials; neither claim was verified by Danfoss or authorities.Z-PentestClaimed responsibility for the refrigeration attacks, but the claim is unverified and no authority has attributed the incidents to the group.
Vendors
CopelandEquipment namedDanfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb controllersDanfossThe groups claiming the attacks named Danfoss and Dixell XWEB equipment; no retailer or authority has confirmed this.DixellThe groups claiming the attacks named Danfoss and Dixell XWEB equipment; no retailer or authority has confirmed this.SabcobelStephan Moelans, CEO of refrigeration contractor Sabcobel, which operates Delhaize’s installations, told Belgian news agency Belga that the units’ evaporators had been switched into defrost mode.
Products
Copeland XWEBEquipment namedDanfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb controllersDanfoss StoreViewSOCRadar’s own October snapshot found roughly 2,900 exposed Danfoss StoreView services in France alone.Dixell XWEBThe groups claiming the attacks named Danfoss and Dixell XWEB equipment; no retailer or authority has confirmed this.
Countries
BelgiumOvernight into Monday, November 2, 2026, refrigeration systems at dozens of stores in Belgium, Luxembourg and Sweden showed sudden temperature rises, with some freezers set as high as 50°C.EstoniaEstonia Unnamed grocery chain Temperatures set to 50°C, as reported by its refrigeration technology supplierFranceSupermarket freezer attacks have moved beyond France.GermanyIncidents have since been reported in Germany, Ireland, Italy, the Netherlands, Portugal and Finland, where Kesko reported temperature anomalies at a few smaller stores.IrelandIncidents have since been reported in Germany, Ireland, Italy, the Netherlands, Portugal and Finland, where Kesko reported temperature anomalies at a few smaller stores.ItalyIncidents have since been reported in Germany, Ireland, Italy, the Netherlands, Portugal and Finland, where Kesko reported temperature anomalies at a few smaller stores.LuxembourgOvernight into Monday, November 2, 2026, refrigeration systems at dozens of stores in Belgium, Luxembourg and Sweden showed sudden temperature rises, with some freezers set as high as 50°C.NetherlandsIncidents have since been reported in Germany, Ireland, Italy, the Netherlands, Portugal and Finland, where Kesko reported temperature anomalies at a few smaller stores.PortugalIncidents have since been reported in Germany, Ireland, Italy, the Netherlands, Portugal and Finland, where Kesko reported temperature anomalies at a few smaller stores.SwedenOvernight into Monday, November 2, 2026, refrigeration systems at dozens of stores in Belgium, Luxembourg and Sweden showed sudden temperature rises, with some freezers set as high as 50°C.United StatesThe November incidents look like the French supermarket cyberattack of October 11 to 12, and both resemble refrigeration failures at U.S.
Industries
Food retailDark Web Monitoring: Watches hacktivist channels and underground forums for attack claims, leaked access or chatter that names your brand, your suppliers or the food retail sectorMilitary commissariesmilitary commissaries in August. A shared attacker has not been established for any of them.