TL;DR · 30-second read
The Short Version
On Monday, hackers broke into the computers that run fridges and freezers in supermarkets across five European countries: Sweden, Belgium, Luxembourg, Ireland and Estonia. In some stores the freezers were switched to 50 degrees Celsius, hotter than a heatwave, and staff had to throw food away.
Last month the same kind of attack hit hundreds of shops in France.
Why it matters: the same kind of remote controls run the cooling in offices, hospitals and the huge computer buildings behind the internet. Turning cooling off by computer is no longer only a theory.
Supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia had problems with their freezers and fridges on Monday, November 2, 2026. The disruptions apparently came from cyberattacks, and some stores had to dispose of ruined food, the Associated Press reported. An ICA Kvantum store in Sjöbo, southern Sweden, said its units had been hacked and set to 50 degrees Celsius (122°F). Coop said six of its stores in central Sweden were affected. ICA Group confirmed “a limited number” of affected stores but did not give a figure.
Elsewhere, Delhaize said an “IT incident” hit refrigeration in several dozen stores, mostly in Belgium and a few in Luxembourg. Carrefour said 15 of its more than 700 Belgian stores were affected. Musgrave Group said 13 SuperValu stores in Ireland were affected and the incident was “fully resolved” by Monday afternoon. In Estonia, Kitman Coldtech said attackers had accessed a computer controlling a client’s refrigeration system and raised its temperature to 50°C. The company said the problem was addressed within minutes. The attacks followed a case last month in which attackers remotely took control of refrigeration in hundreds of French supermarkets and independent stores.
Executive Summary
Within a single night, refrigeration systems at dozens of supermarkets in five countries malfunctioned in ways the affected chains described as a cyberattack, a “cyber incident” or an “IT incident.” In at least two documented cases, attackers did not disable the equipment. They changed its target temperature, telling freezers to run at 50°C. Each retailer described the damage as contained. Carrefour called its exposure “extremely limited,” Delhaize said its distribution centers were operating normally, and Musgrave restored chilled and frozen ranges the same day.
The significance goes beyond groceries. The incidents show an attack class that turns access to a cooling controller directly into physical loss: spoiled inventory, products pulled from sale and stores operating with reduced ranges. Every facility that depends on networked thermal equipment shares this exposure. That includes cold-chain warehouses, pharmaceutical storage, hospitals and data centers, whose servers depend on continuously controlled cooling. These incidents came only weeks after the French wave. That timing makes this a recurring pattern in European retail refrigeration rather than a one-off.
One Setpoint Change, a Store Full of Spoiled Stock
The mechanism matters more than the headcount of stores. A refrigeration controller is the small computer that decides when compressors run and what temperature a case should hold. The target it aims for is called the setpoint. In the Sjöbo store and the Estonian case, attackers raised the setpoint to 50°C. That is a single configuration change, not sabotage of hardware. The equipment then did what it was told and stopped keeping food cold. Unlike a typical IT breach, nothing had to be stolen or encrypted for the attack to work. Physics did the damage.
That is why cooling controls now sit inside the security perimeter rather than outside it. Once a controller can be reached over a network, whoever controls it controls the temperature, and the business consequence arrives as fast as heat builds up. Retailers measured the cost in discarded products and “temporarily somewhat limited” fresh and frozen ranges, in the words of Delhaize spokesperson Sarah De Meester. Musgrave pulled chilled and frozen products from 13 SuperValu stores as a precaution, which is the correct food-safety response but also a direct loss.
The Access Path Runs Through the Service Relationship
The most revealing detail came from Estonia. Kitman Coldtech chief executive Jann Mutso said attackers accessed a computer controlling a client’s refrigeration system. Commercial refrigeration is commonly installed, monitored and maintained by specialist contractors, often remotely. The access that lets a technician adjust a system without driving to site is also a path an attacker can use. Separately, the earlier French attacks appeared to target old systems. That fits a familiar operational-technology problem: controllers installed for a decade or more, built before network security was a design requirement, and rarely updated.
For operators, the lesson is that the attack surface includes every party with a remote connection into the plant, not just the operator’s own network. Inventorying those connections is unglamorous work, and these incidents suggest it is overdue. That means knowing which vendors can log in, through what software, with what credentials, and whether a change of setpoint triggers an alarm.
Why Data Center Operators Should Read This as Their Story
Data centers run on the same category of equipment: chillers, air handlers, pumps and, increasingly, liquid-cooling loops, all supervised by building management systems and often serviced remotely by vendors. Dense AI computing raises the stakes. High-power servers generate heat quickly, so the window between a cooling fault and thermal shutdown is short. An attacker would not need to touch a single server to take capacity offline. Manipulating the cooling would be enough.
Nothing in Monday’s reporting involved a data center, and it would be wrong to suggest otherwise. But the attack technique is not specific to freezers. The Estonian response, addressed within minutes with no significant damage per Kitman, shows what good looks like. Someone noticed the anomaly fast and acted before heat caused loss. For thermal plant of any kind, detecting an unexpected setpoint change quickly matters as much as preventing unauthorized access.
Contained Incidents, Unanswered Pattern
Taken individually, the retailers’ statements are reassuring and appear credible. Carrefour’s 15 affected stores are about 2% of its Belgian estate. Delhaize said deliveries continued uninterrupted. Musgrave declared its incident resolved within the day. These are measured responses, and none of the companies overstated the damage.
The open question is the pattern. Hundreds of French stores were hit last month, and Monday brought incidents in five more countries, plus a separately reported cybersecurity incident in the Netherlands. No company has said whether the incidents share a vendor, a software platform or an attacker. Until that is known, each chain’s “limited” impact describes its own exposure, not the sector’s.
Background
Commercial refrigeration in supermarkets is run by electronic controllers that manage compressors, defrost cycles and display-case temperatures. Many are linked to central monitoring software so retailers and specialist service contractors can track performance and respond to faults remotely. This equipment belongs to a broader category called operational technology: computers that control physical processes, as distinct from office IT. Security researchers have long warned that operational technology is often older and less protected than corporate networks.
The retailers involved span much of Northern and Western Europe. ICA Group and Coop operate supermarkets in Sweden. Delhaize, part of Ahold Delhaize, and France’s Carrefour both run large Belgian store networks. Musgrave Group owns the SuperValu chain in Ireland, and Selver is an Estonian supermarket chain. Kitman Coldtech is an Estonian refrigeration technology company that services client systems. The incidents followed attacks on refrigeration systems at hundreds of French stores in October 2026. Source: Supermarket freezers in several European countries hit by apparent cyberattacks (AP News): reporting on refrigeration-system cyber incidents at supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia.Sources