Cyberattack Knocks Out Refrigeration at European Supermarkets
Chains in Belgium, Sweden, Ireland and Estonia, among others, reported coolers overheating; France's cybersecurity agency had warned about this equipment in October.
Coolers and freezers at dozens of supermarkets across Europe began overheating overnight Sunday into Monday, and several chains are blaming a cyberattack. Delhaize, Colruyt and Carrefour in Belgium, the Swedish chains ICA and Coop, SuperValu in Ireland and Selver in Estonia are among those reporting problems.
Ahold Delhaize described "an IT incident" affecting refrigeration in several dozen stores. Carrefour Belgium counted 15 of its 700 locations hit, and spokeswoman Mich Vergauwen left no room for doubt: "It's a cyberattack, there is no other reason." The head of Sabcobel, the contractor that runs Delhaize's refrigeration, said the evaporators were forced into defrost mode and that the mechanism matches the one seen in France.
Store counts are still incomplete: five at Spar Colruyt, between four and seven at each Swedish chain named, 13 at SuperValu and one at Selver. European Agriculture Commissioner Christophe Hansen called it a "deliberate attempt to disrupt" and said food security is not at risk.
France saw the pattern first. On Oct. 12, the CERT-FR, the incident-response team for the French cybersecurity agency, published alert CERTFR-2026-ALE-012 on refrigeration controllers connected to the internet, then expanded it on Oct. 13 and Oct. 16. A controller is the small computer that sets each unit's temperature and defrost cycles. The alert lists Copeland xweb and Dixell xweb units and Danfoss AK-SC and AK-SM series.
Much remains unclear. No one has claimed the attacks or been publicly blamed, and nothing confirms that Monday's incidents belong to the same campaign as France's. The alert gives no CVE and no affected versions, so it is not known whether the equipment in Belgium or Sweden is the same models.
There are no similar reports in Mexico so far. For any business with refrigeration tied to the internet, the CERT-FR recommends taking the controllers offline, checking defrost intervals and reconnecting only through a VPN or protected network; on Danfoss units, switching on the "Strict" security mode and changing default passwords. It also warns that an unsupported, exposed unit is very likely to be compromised.
