Supermarket fridges in seven European countries were hit overnight. Treat refrigeration controllers as OT

In brief

Supermarkets across seven European countries had their refrigerators and freezers tampered with in a cyberattack overnight into Monday 2 November 2026, the BBC reports. The countries named are Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland.

It comes weeks after a similar attack in early October hit hundreds of French supermarkets. A link between the two is suspected but not established, and nobody is known to have claimed it.

What is confirmed

• Belgium and Luxembourg. Around 40 Delhaize supermarkets were affected, according to the BBC. Carrefour said 15 of its Belgian stores were hit and that all stores stayed open (BBC). Colruyt Group told Reuters that five Spar stores were affected (via BBC).
• The mechanism. Stephan Moelans, chief executive of the refrigeration company Sabcobel, told the Belga news agency that the attackers remotely switched the units' evaporators into defrost mode, so the cabinets warmed up. He said a software update is not enough: the installations need physical modification. Sabcobel counted about twenty affected installations among the hundreds it manages in Belgium (Belga, via La Libre).
• Ireland. Musgrave Group confirmed to The Irish Times that a "cyber incident" affected refrigeration at 13 SuperValu stores and was limited to a "specific model" of refrigerator. Chilled and frozen products were removed from sale as a precaution. Later on Monday, Musgrave said the problem had "been fully resolved".
• Sweden. ICA said a "small number" of stores outside its central network were affected (BBC). One ICA store in Sjöbo posted that the temperature of its units had been set to 50 degrees (BBC).

What is only suspected

Sabcobel said the method is believed to be the same as in the French attack in early October (BBC; Belga). It is unclear who is behind it (BBC), and no claim of responsibility has been reported. The BBC also notes that US authorities are looking into refrigeration failures at American military bases in August; we covered that in our earlier report. US authorities are working with French officials to examine whether the French attack and the August base incidents could be linked (BBC).

Why it matters

Refrigeration controllers are operational technology that often sits outside IT's asset register, yet the losses from tampering are immediate and physical. Sabcobel's chief executive said most of its customers had moved to a secure internet connection after the French attack (BBC). Sabcobel did not say whether the stores that were hit had made that switch.

What leaders should do next

1. Find every remotely managed cooling controller in stores, warehouses and data-centre plant, including those run by contractors.
2. Remove direct internet exposure. Put remote access behind a VPN or a managed gateway, and ask the installer whether the hardware needs physical changes, not only firmware.
3. Alert on setpoint and mode changes, not just on temperature, so a forced defrost at midnight is noticed before stock is lost.

Sources and scope

Facts are from the BBC (2 November 2026), The Irish Times (2 November 2026) and Belga's interview with Sabcobel as published by La Libre (2 November 2026), all checked on 3 November 2026. All three are secondary reporting of company statements. Store counts are as reported on 2 November and may change. The Carrefour and Spar figures and the Sjöbo post are single-sourced through the BBC. The recommendations are ByteNib editorial analysis.

Drafted with AI assistance and reviewed by the editor before publication.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.