European supermarket fridges hacked in a single night
On 2 November 2026 attackers changed temperature and defrost settings on remote refrigeration controllers at supermarkets, butchers, caterers and French blood banks across Europe. Reports point to older internet-exposed controllers, much like the French supermarket attacks of October, and the culprit is still unknown.
Key facts
- OrganisationsSuperValu (Musgrave) in Ireland, Coop and ICA stores in Sweden, Selver in Estonia, Coop Sicily, 17 small Dutch food firms, UK meat suppliers, German supermarkets and France's blood service EFS, among others. Reports also name Delhaize, Carrefour and Colruyt in Belgium and Luxembourg.
- What happenedAttackers raised temperature or defrost settings on refrigeration controllers. Musgrave pulled chilled and frozen food from 13 SuperValu stores, and Selver says a freezer was pushed towards 50 C before staff reacted within ten minutes.
- Not affectedEFS says no blood products were lost and collection continued. Musgrave says the stores stayed open and the issue was resolved the same day. Romania's cyber directorate says no other infrastructure was compromised.
- Cause or entry pointNo single entry point is confirmed. Danfoss told NOS the Dutch systems sat on unsecured networks with default passwords, Kitman Coldtech says older Danfoss controllers were hit in Estonia, and Coop says its stores used old 4G links. EFS says its refrigeration supplier was the route in.
- ClaimedNo group has claimed the attacks. The EU declined to name a culprit, and Romania's cyber directorate called the attack semi-amateurish with no sign of a state actor.
- AuthoritiesThe EU food commissioner called it a deliberate attempt to disrupt the food supply chain. Belgian federal prosecutors opened an investigation, Gardaí are assisting Ireland's NCSC, Italy's ACN issued a sector alert, and EFS is working with France's ANSSI.
Timeline
- 12 Oct 2026CERT-FR warned that Danfoss AK-SC and AK-SM and Copeland and Dixell XWEB refrigeration controllers exposed to the internet were being compromised after attacks on French supermarkets. CERT-FR
- 13 Oct 2026Danfoss advised Dutch customers to disconnect controllers from the internet or reconnect only through a secure network. NL Times
- 2 Nov 2026Refrigeration controllers were tampered with overnight across Europe. Musgrave removed chilled and frozen food from 13 SuperValu stores, Coop reported seven Swedish shops hit and Danfoss confirmed 17 Dutch businesses affected. The Irish Times · New Straits Times (AFP) · NL Times
- 2 Nov 2026Selver and Kitman Coldtech said a store freezer on an older Danfoss system was pushed towards 50 C. EFS saw temperature and defrost thresholds raised at three cold-storage sites. ERR News · BleepingComputer
- 3 Nov 2026Italy's ACN reported a NIS notification from a Tuscan catering firm and urged operators to take controllers off the internet. The EU said the incidents were not isolated, and UK NCSC chief Richard Horne said vulnerable technology had been exploited in the UK. ACN (Italy) · The Local (AFP)
- 4 Nov 2026EFS said no blood products were lost and that its refrigeration supplier was targeted. Coolworld Rentals confirmed an incident in its remote monitoring software, and Gardaí were reported to be assisting Ireland's NCSC. BleepingComputer · Irish Examiner
Affected organisations
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
| ✅ ConfirmedTuscan collective catering company | Italy | 3 Nov 2026 | Other | Not disclosed | None | Confirmed. ACN said it received a NIS incident notification from a Tuscan catering firm hit in the cold-chain attacks. | ACN✓ 7 Nov |
 ✅ ConfirmedSelverVia a vendor | Estonia | 2 Nov 2026 | Retail | Intrusion | None | Confirmed. Selver and refrigeration contractor Kitman Coldtech confirmed hackers raised a store freezer to 50 C through an older Danfoss control system; staff reacted within ten minutes. | ERR News✓ 7 Nov |
| ✅ ConfirmedIndependent meat suppliers (AIMS members) | United Kingdom | 2 Nov 2026 | Retail | Not disclosed | None | Confirmed. The Association of Independent Meat Suppliers said fridges at two members defrosted and a third saw cold-unit temperatures rise during the Europe-wide refrigeration attack wave. | The Local (AFP)✓ 7 Nov |
| ✅ ConfirmedSupermarkets including Edeka and CAP MarketsVia a vendor | Germany | 2 Nov 2026 | Retail | Not disclosed | None | Confirmed. Officials and company representatives confirmed four German supermarket outlets were hit in the 2 November refrigeration attack wave. | The Local (AFP) · Wikipedia✓ 7 Nov |
 ✅ ConfirmedÉtablissement français du sang (EFS)Via a vendor | France | 2 Nov 2026 | Health | Not disclosed | None | Confirmed. EFS said attackers raised temperature and defrost thresholds at three plasma cold-storage sites through its refrigeration supplier, and no blood products were lost. | BleepingComputer · NY1 (AP)✓ 7 Nov |
| ✅ Confirmed17 Dutch food businessesVia a vendor | Netherlands | 2 Nov 2026 | Retail | Not disclosed | None | Confirmed. Danfoss confirmed to NOS that refrigeration systems at 17 Dutch businesses, mainly butchers and small grocers, were attacked. | NL Times✓ 7 Nov |
| ✅ ConfirmedCoop supermarkets in Sicily | Italy | 2 Nov 2026 | Retail | Not disclosed | None | Confirmed. Coop said four of its 300 Sicilian stores were hit in the refrigeration attack wave, and the government called the impact highly limited. | The Local (AFP) · New Straits Times (AFP)✓ 7 Nov |
 ✅ ConfirmedMusgrave (SuperValu) | Ireland | 2 Nov 2026 | Retail | Not disclosed | None | Confirmed. Musgrave said a cyber incident hit refrigeration in 13 SuperValu stores, its monitoring flagged it, and the issue was fully resolved the same day. | The Irish Times · New Straits Times (AFP)✓ 7 Nov |
 ✅ ConfirmedCoop | Sweden | 2 Nov 2026 | Retail | Not disclosed | None | Confirmed. Coop confirmed a cyber incident hit cooling at seven stores in Gävle and Sundsvall, which were on older 4G connections. | New Straits Times (AFP) · Sweden Herald✓ 7 Nov |
 ✅ ConfirmedICA storesVia a vendor | Sweden | 2 Nov 2026 | Retail | Not disclosed | None | Confirmed. Ica Kvantum Sjöbo said a cyberattack caused its cooling failure, and ICA Group said the affected stores were those using Danfoss systems. | Sweden Herald✓ 7 Nov |
What to do
- If you run Danfoss AK-SM or AK-SC, or Copeland or Dixell XWEB controllers, take them off the public internet and follow CERT-FR alert CERTFR-2026-ALE-012.
- Change default passwords on refrigeration controllers and allow remote access only through a VPN with multi-factor authentication, as Italy's ACN advises.
- Check defrost schedules and temperature setpoints, and replace controllers the maker no longer supports.
- Businesses in Ireland can report a cyber incident to the NCSC at ncsc.gov.ie and to An Garda Síochána.
FAQ
Which supermarkets were hit by the fridge cyberattack?
Reports name SuperValu in Ireland, Coop and ICA stores in Sweden, Selver in Estonia, Coop in Sicily, Delhaize, Carrefour and Colruyt in Belgium and Luxembourg, plus small Dutch shops, German supermarkets and UK meat suppliers.
Was food at SuperValu safe?
Musgrave says it removed chilled and frozen food from 13 stores as a precaution after its monitoring raised an alert, and that the issue was fully resolved the same day.
Who was behind the European fridge hacks?
Nobody knows yet. No group has claimed the attacks, the EU has not named a culprit, and Romania's cyber directorate said it does not suspect a state actor.
Related stories
- Crédit Mutuel Arkéa loses about 100 million euros to fraudulent transfers France · 4 Nov 2026
- Philippine agencies named in a wave of hack and leak claims Philippines · 7 Nov 2026
- Bank Rakyat website defacement Malaysia · 6 Nov 2026
- M1 customer data breach Singapore · 6 Nov 2026
Checked 7 Nov 2026. Methodology · Data CC BY 4.0