Cyberattack on Supermarkets Spreads Across 10 European Countries, Freezers Reach 55°C: Hundreds of Thousands of Euros’ Worth of Food Destroyed as Investigations Extend to the US

A widespread wave of cyberattacks targeting refrigeration systems in supermarkets and food businesses has swept across Europe, causing temperatures in refrigerators and freezers to rise as high as 55 degrees Celsius, destroying large quantities of food and resulting in substantial financial losses. The latest attacks began overnight between November 1 and 2, 2026, with further incidents confirmed in Germany on November 3. Reports of attacks or similar disruptions have emerged from Belgium, Sweden, Luxembourg, Ireland, the Netherlands, Estonia, Finland, Portugal, Italy and Germany. Just three weeks earlier, on October 12, hundreds of supermarkets had been targeted in France, bringing the number of European countries reporting incidents of this kind within less than a month to 11.

More than 100 stores and businesses were identified as affected in initial reports, although the overall toll continues to rise as new information emerges. In Belgium, three businesses have reported combined food losses of at least €175,000, while in Sweden, the manager of a supermarket in Sjöbo estimated that products requiring disposal could be worth up to one million Swedish kronor. In Bavaria, an Edeka supermarket was forced to discard large quantities of food, while in Ireland, 13 affected SuperValu stores had returned to normal operations by Monday evening.

Investigations and technical analyses have highlighted vulnerabilities in electronic refrigeration controllers, including equipment manufactured by Danish company Danfoss and other industrial systems. Attackers remotely manipulated equipment settings, activating defrost mode or changing programmed temperatures. France’s cybersecurity authority had warned about the risk as early as October 12, yet similar incidents occurred again. Meanwhile, US authorities are investigating whether refrigeration malfunctions at several American military bases in August could be linked to the European incidents. No group has claimed responsibility, and there is still no publicly available evidence attributing the attacks to any particular state or organisation.

What initially appeared to be a technical malfunction in supermarket refrigerators has developed into a broader cybersecurity issue involving the protection of Europe’s food infrastructure.

In several countries, attackers managed to manipulate equipment normally controlled remotely by maintenance companies over the internet. Instead of maintaining the low temperatures necessary to preserve meat, fish, dairy products and frozen food, refrigerators suddenly began heating up, while some systems switched into their automatic defrost cycles.

In individual cases, reported temperatures reached 50–55 degrees Celsius, although this does not mean that every food product inside the affected units reached the same temperature.

Photographs and television footage from Sweden and Belgium show employees emptying shelves, shopping trolleys filled with food destined for disposal, and supermarkets struggling to restore normal supplies.

In Belgium, one supermarket operator reported losses of €100,000, another reported at least €60,000, and the owner of a meat business estimated losses of approximately €15,000. In Germany, supermarket owners described the painful necessity of throwing away enormous quantities of food.

Authorities are investigating whether the successive incidents constitute a coordinated campaign or separate attacks exploiting known vulnerabilities in industrial equipment. In some countries, cyber interference has been confirmed by the companies involved, while elsewhere investigations into the precise causes remain ongoing.

How the New Wave of Attacks Began on November 2

The first indications of the incidents emerged overnight between Sunday, November 1, and Monday, November 2, 2026.

According to information published by Dutch broadcaster NOS, Danish supplier Danfoss received its first notifications of unusual temperature increases at approximately 2:00 a.m.

In Belgium, Delhaize sent warnings to store managers at around 4:00 a.m., after monitoring systems detected that refrigerators and freezers were no longer maintaining their designated temperatures.

In some Belgian stores, temperatures rose to 15 degrees Celsius, while at a meat business in Hove they reached 18 degrees.

In Sweden, an ICA supermarket in Stockholm reported that the interference had begun at approximately 2:00 a.m., but employees did not discover the problem until around 5:30 a.m.

By Monday morning, reports were emerging from an increasing number of stores in Belgium, Sweden, Luxembourg and Ireland. These were followed by reports from the Netherlands, Estonia, Finland, Portugal and Italy.

Further incidents in Germany were confirmed during Monday and on Tuesday morning, extending the geographical reach of the new wave.

Germany: Edeka Supermarket in Bavaria Attacked as Refrigerators Reach 50°C

In Reisbach, in the Dingolfing-Landau district of Lower Bavaria, an Edeka supermarket reported that its refrigeration systems had been remotely manipulated.

According to German public broadcaster Bayerischer Rundfunk, the affected business was Edeka Ernst, where refrigeration equipment was reportedly set to temperatures as high as 50 degrees Celsius.

As a result, large quantities of food became unsuitable for sale.

The owners posted a statement on Facebook condemning the damage and the resulting food waste.

“The sad consequence: Enormous quantities of food had to end up in the bin,” the statement said.

However, some products that could still be used were collected by Foodsharing, an organisation involved in rescuing and redistributing food.

“Foodsharing collected everything that could somehow still be saved at short notice,” the supermarket announced.

Most chilled and frozen products nevertheless had to be discarded. According to management, shelves were expected to be restocked with fresh products on Tuesday, November 3.

A final financial assessment of the damage has not been published.

Lower Bavarian police confirmed that an investigation had been launched and announced that information would be exchanged with authorities in other countries affected by the attacks.

North Rhine-Westphalia: Problems in Wuppertal, Wetter and Raesfeld

The German incidents were not confined to Bavaria.

According to public broadcaster Westdeutscher Rundfunk (WDR) and German news outlet Tagesschau, refrigeration problems were also reported at several stores in North Rhine-Westphalia.

A CAP supermarket in Wuppertal announced on Facebook that external interference over the weekend had caused refrigeration and freezing equipment to heat up.

The store reported that food requiring refrigeration had to be discarded.

Another CAP store in Volmarstein, part of the town of Wetter (Ruhr), reported refrigeration system disruptions over the weekend.

A similar case was reported at a supermarket in Raesfeld, in the Münsterland region.

WDR stressed that the total number of affected stores in North Rhine-Westphalia and the financial damage remained unknown.

The German cases were reported in the context of the broader European attacks, but the precise mechanism of each incident and any possible connection to cases in other countries still need to be established.

Sweden: Sjöbo Supermarket Faces Potential Losses of Up to One Million Kronor

In Sweden, one of the most serious cases was recorded at the ICA Kvantum supermarket in Sjöbo, in the Skåne region.

Store manager Rickard Nilsson told public broadcaster SVT that the value of products requiring disposal could reach one million Swedish kronor.

He described the incident as “a form of terrorism,” referring to the deliberate destruction of large quantities of food.

This was the supermarket manager’s characterisation and does not constitute a legal classification of the incident by Swedish authorities.

The store announced on social media that its refrigerators and freezers had been manipulated overnight and that temperatures had been set to 50 degrees Celsius.

Employees immediately began emptying the equipment and removing products.

Footage published by SVT showed shopping trolleys filled with thawed food and employees attempting to clean the refrigerators.

The store temporarily closed before reopening to customers.

On the Island of Öland, Freezer Temperature Reaches 55°C

Another serious incident occurred in Böda, on the Swedish island of Öland.

ICA store owner Mats Olsson told SVT that when he arrived at the supermarket, he discovered a puddle of water on the floor.

According to Olsson, the freezer had reached 55 degrees Celsius after the system was switched into defrost mode.

This is the highest temperature reported in the materials reviewed concerning the November wave of attacks.

In Sankt Olof, another ICA store manager, Dennis Vidal, said employees were emptying refrigerators and freezers.

“Right now we’re emptying the freezers. There isn’t much else we can do. They’re starting to get cold again, but everything is destroyed,” he said.

In Hammenhög, supermarket manager Hanna Lindén also described the incident as disturbing and difficult to comprehend.

According to SVT, affected stores were identified in Skåne, Öland, Värmland and Stockholm, as well as other parts of Sweden.

In Stockholm, Attack Discovered Three and a Half Hours After It Began

At the ICA Baronen supermarket, on Odengatan in Stockholm, the interference reportedly began at approximately 2:00 a.m. on Monday.

Employees did not discover the problem until around 5:30 a.m.

Sales manager Engla Ingwall told Reuters that freezer temperatures had risen to 50 degrees Celsius.

“There has been a cyberattack and all our freezers have reached 50 degrees Celsius. Everything is destroyed,” she said.

A notice was placed at the supermarket entrance informing customers that the freezers were out of operation.

ICA confirmed that a limited number of stores had been affected, all using external refrigeration control systems outside the company’s central IT network.

ICA did not conclusively confirm the cyber-related nature of every incident reported at its stores.

Coop Confirms Seven Stores Affected, Axfood Also Impacted

Swedish supermarket chain Coop, which operates approximately 800 stores, confirmed to the BBC and Reuters that seven stores had been affected.

Initial reports from some Swedish media mentioned six stores, mainly in the Gävle area, while the company’s later figure was seven.

Coop described the incidents as unauthorised manipulation of refrigeration systems and announced that the situation had been brought under control.

Meanwhile, Axfood Group reported disruption to home grocery delivery operations in Gothenburg.

According to Swedish business outlet EFN, the problem affected a home-delivery warehouse in Västra Frölunda, which used an external refrigeration technology supplier.

This disrupted deliveries for orders placed through the Hemköp and Willys chains, while their physical stores were not reported as directly affected by the same incident.

Sweden’s National Cyber Security Centre, associated with the FRA intelligence agency, became involved in monitoring the cases.

Its director, John Billow, confirmed to SVT that the institution was maintaining contact with affected businesses, gathering information and providing technical support.

Belgium: Dozens of Supermarkets Hit, Alarm Raised at 4:00 a.m.

Belgium was among the countries most heavily affected by the November 2 attacks.

According to Belgian public broadcaster VRT NWS, Delhaize issued a warning at approximately 4:00 a.m. about unusual temperature increases in its refrigeration systems.

In some refrigerators and freezers, temperatures reached 15 degrees Celsius, forcing stores to assess food safety.

Approximately 40 Delhaize stores reported problems in Flanders and Wallonia.

Among the locations identified by VRT NWS were stores in Boortmeerbeek and Sint-Truiden, as well as Proxy Delhaize outlets in Grootzand in Dendermonde, Sint-Amandsberg, Hoepertingen and Kouter in Ghent.

Problems were also reported at a Delhaize store in Overijse, according to RTL Info.

Carrefour Belgium confirmed that refrigeration systems at 15 of its approximately 700 stores had been affected.

Spokesperson Mich Vergauwen said the incident was a cyberattack.

“It’s a cyberattack, there is no other reason,” he said.

Carrefour clarified that none of its hypermarkets had been affected and that the problems mainly involved a limited number of refrigeration units.

All its stores remained open.

Colruyt Group also confirmed interference with refrigeration systems at five Spar stores operated through franchises.

Meanwhile, approximately 15 Intermarché stores reported technical problems. The company did not confirm that every disruption originated from a cyberattack.

An Intermarché spokesperson explained that in some cases only one refrigerator was affected, meaning the overall impact was relatively limited.

According to Euronews, the number of affected retail locations in Belgium reached approximately 75, including an IKEA store in Mons.

IKEA confirmed that the interference had caused freezer temperatures to rise at the store. The company explained that this location used a different refrigeration service provider from its other Belgian stores.

Three Belgian Businesses Report at Least €175,000 in Losses

The financial consequences of the attacks were particularly evident at several Belgian businesses.

In Hoeilaart, the manager of a Delhaize supermarket told Het Laatste Nieuws that food products worth approximately €100,000 had been damaged.

According to the manager, that figure did not include additional losses resulting from the store’s temporary closure.

In Hoepertingen, in the municipality of Tongeren-Borgloon, another Proxy Delhaize supermarket reported losses of at least €60,000.

In Hove, near Antwerp, meat business De Laet & Van Haver was forced to discard products worth approximately €15,000.

Business owner Luc De Laet told Reuters that he had been awakened at 3:30 a.m. by an employee calling to report problems with the refrigerators.

When he arrived at the store, he discovered that the temperature had reached 18 degrees Celsius.

“It’s very scary. They are hacking the system that is doing the registration of the temperature, and they can program it at a distance,” De Laet said.

He expressed his suspicion that the perpetrators were attempting to destabilise European economies, although this remains his personal assessment rather than a conclusion reached by investigators.

“I only have two words for them: Wake up, please, because there’s something going on,” he added.

Together, these three businesses reported at least €175,000 in losses, excluding damage suffered by dozens of other stores.

In some cases, rapid intervention by technicians limited the damage.

At a Proxy Delhaize store in the Dendermonde area, management managed to restore the refrigeration system within a short period after receiving an overnight alert.

However, at other stores, products were removed from sale even after refrigerators began operating again, because checks were needed to determine whether safe food temperatures had been maintained.

Luxembourg: Four Delhaize Stores Affected, Deliveries Uninterrupted

In Luxembourg, four supermarkets belonging to the Belgian Delhaize chain were affected.

The company confirmed the incident to L’essentiel, describing it as an IT problem that had affected refrigeration systems.

“We immediately took the necessary measures to keep our stores operational and allow customers to continue shopping as normal,” the company said.

Delhaize confirmed that the range of fresh and frozen products available at affected stores had been temporarily reduced.

However, distribution centres and deliveries continued to operate normally.

The company did not publish a financial assessment of the damage at the four Luxembourg stores or identify every affected location.

Preventive measures were also taken to protect ordering systems.

Ireland: Thirteen SuperValu Stores Affected, Problem Fully Resolved

In Ireland, the incident affected refrigeration systems at 13 SuperValu supermarkets.

The chain’s owner, Musgrave Group, confirmed that the interference was limited to a particular model of refrigeration equipment.

According to the company, its monitoring systems detected the problem and immediate action was taken.

As a precaution, chilled and frozen products were removed from sale, while other products remained available.

Several stores, including SuperValu in Bray, County Wicklow, did not open at their usual time on Monday.

Other affected stores included branches in Lucan, Blanchardstown and Ranelagh in Dublin, as well as a supermarket in Waterford.

However, by Monday evening, November 2, Musgrave confirmed to Irish public broadcaster RTÉ that the problem had been fully resolved.

“All stores are now operating as normal,” the company announced.

It added that restocking of chilled and frozen products was underway.

Musgrave stressed that customers could be confident that products remaining on sale had been stored at safe temperatures.

Irish Justice Minister Jim O’Callaghan was briefed on the situation, while the National Cyber Security Centre monitored developments.

Netherlands: At Least 17 Businesses Affected as Danfoss Points to Default Passwords

In the Netherlands, Danish manufacturer Danfoss confirmed to public broadcaster NOS that refrigeration systems at at least 17 companies had been affected.

These were mainly butchers and small food shops.

According to the EFE news agency, the temperature in one frozen-food warehouse rose from approximately minus 20 to minus 10 degrees Celsius.

Danfoss said some affected systems were not connected to secure networks and were still using default passwords.

The company had warned customers during October and recommended disconnecting equipment from the internet or allowing access only through secure connections.

According to Danfoss, following these recommendations could have prevented some of the incidents.

Separately, Ahold Delhaize Group, owner of the Delhaize and Albert Heijn chains, had detected suspicious activity in its IT infrastructure during October and notified Dutch police.

However, no connection has been confirmed between that incident and the latest attacks on refrigeration systems.

Estonia: Intervention Stopped Within Minutes, Major Damage Avoided

In Estonia, a supermarket belonging to the Selver chain reported interference with its electronic refrigeration control system.

According to public broadcaster ERR, an unauthorised person had gained access to the computer controlling the refrigeration equipment.

Jann Mutso, chief executive of refrigeration technology company Kitman Coldtech, confirmed the incident.

He explained that the interference had been identified and stopped within a very short period, approximately ten minutes.

According to technical reports, the temperature of products in the Estonian case rose by only about 2–3 degrees, avoiding significant damage.

This detail is important in distinguishing the temperature programmed into a system from the temperature food products actually reach during an attack.

However, authorities have not established whether the perpetrators responsible for the Estonian incident were the same individuals behind attacks in other countries.

Finland: Problems at Kesko Group Stores

In Finland, several smaller stores belonging to Kesko Group, known for its K Group retail network, reported unusual temperatures in refrigeration systems.

According to Helsingin Sanomat, the company’s security specialists launched an investigation to determine the cause.

Kesko management did not rule out the possibility of cyber interference.

However, as of reports published on November 3, it had not been conclusively confirmed that all technical problems at Finnish stores were caused by hackers.

Portugal: Seven Intermarché Stores Report Incidents

In Portugal, Os Mosqueteiros Group, which operates the Intermarché network, confirmed refrigeration system problems at seven stores.

The incidents were included in international reports by cybersecurity publications, including SecurityWeek and The Hacker News.

The reports did not provide a complete assessment of damaged products or financial losses at the seven Portuguese stores.

Nor were sufficient technical details published to establish whether the interference used the same mechanism as in Belgium and Sweden.

Italy: Incidents Reported at at Least Four Coop Stores in Sicily

In Italy, the operator of several Coop supermarkets in Sicily reported problems with refrigeration systems.

According to specialist media reports, the incidents affected at least four stores.

The relevant operator notified Italian cybersecurity authorities.

Reports available as of November 3 did not include a final assessment of the damage or a verified technical explanation of how the interference occurred.

For this reason, the Italian cases should be distinguished from incidents confirmed in greater detail in Belgium, Sweden and Ireland.

How the Attacks Worked: Refrigerators Were Instructed to Heat Instead of Cool

One of the most significant characteristics of these incidents is that many units were not simply switched off. Instead, their operating settings were altered remotely.

Industrial refrigeration systems use electronic controllers to manage temperature, compressors, fans and defrost cycles.

For maintenance purposes, many can be monitored and controlled by external companies over the internet.

Stephan Moelans, chief executive of Belgian refrigeration company Sabcobel, confirmed to the Belga news agency that attackers had activated the evaporators’ defrost mode during the Belgian incidents.

This function is a normal part of refrigerator operation, but prolonged or unauthorised activation can cause the equipment to heat up.

Kiran Cluckers, a specialist at Belgian company Airclima, explained to VRT NWS that freezers contain cooling components as well as electrical elements used to remove ice.

“If you switch off the cooling elements and leave the defrost elements running continuously, together with the fans, the temperature can easily reach 30 or 40 degrees,” he explained.

Even higher settings were reported in some incidents, including 50 degrees in Sjöbo and 55 degrees in Böda, Sweden.

How Can Attackers Gain Access to Control Systems?

Patrick Hauspie, a cybersecurity expert at the Flemish agency VLAIO, explained to VRT NWS that many refrigeration systems are managed by external maintenance companies.

These companies can monitor temperatures, perform updates and respond to technical alarms without physically visiting the store.

However, if an unauthorised person obtains the credentials of an administrative account, they may gain the ability to change equipment settings.

“If you get hold of the password of the administrator who performs the maintenance, you can do a great deal of harm,” Hauspie explained.

According to him, some systems still use default or unchanged passwords.

Other potential methods of access include devices exposed directly to the internet, outdated software and compromised maintenance accounts.

However, these are possible entry methods. It has not been established that the same mechanism was used in every November incident.

Sabcobel’s chief executive said that, in the Belgian cases, attackers had accessed individual stores’ systems rather than necessarily compromising the central infrastructure of maintenance companies.

Therefore, the fact that many stores use similar technology does not automatically prove that a single central system was compromised.

Danfoss, Copeland and Dixell: France’s Official Cybersecurity Warning

Investigators have focused their attention on several families of industrial refrigeration controllers.

Following the October 12 attacks in France, CERT-FR, the French national computer security incident response team, issued official alert CERTFR-2026-ALE-012.

The document, initially published on October 12 and updated on October 13 and 16, 2026, confirmed numerous compromises involving refrigeration controllers.

The alert identified equipment including:

• Danfoss, AK-SM and AK-SC series;
• Copeland xweb;
• Dixell xweb.

Older models mentioned in technical reporting include Danfoss AK-SM 800 and AK-SC 355.

The French authority stressed that exposing management interfaces directly to the internet is contrary to recommended security practices.

CERT-FR recommended removing direct internet access, checking equipment settings and restoring remote connections only through secure networks, including VPNs.

For Danfoss equipment, recommendations also included updating firmware, enabling the strictest security level and changing default passwords.

The alert contained another important warning: restoring a device to its factory settings is insufficient if it remains exposed to the internet and no longer receives security updates.

Under these conditions, the equipment may be compromised again.

The French document warned that campaigns targeting such systems were likely to continue.

The recurrence of incidents in November demonstrated the significance of that warning.

Not All Affected Equipment Was Manufactured by Danfoss

Although Danfoss products were mentioned in many reports, it would be misleading to suggest that every incident involved the same manufacturer.

According to information reported by NOS, Belgian meat business De Laet & Van Haver used Copeland systems at some of the affected locations.

In Ireland, Musgrave confirmed that the problem involved a specific refrigeration equipment model but did not disclose its manufacturer.

In Luxembourg, the exact model of the affected equipment had not been made public.

These differences demonstrate that vulnerabilities in refrigeration systems cannot automatically be attributed to a single manufacturer.

France: October 12 Attack Caused Millions of Euros in Damage

The November wave followed a major attack that struck France overnight between October 11 and 12, 2026.

At the time, hackers remotely manipulated refrigeration systems at hundreds of supermarkets and food businesses.

Affected retail networks reportedly included E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U.

According to reports citing French authorities, as many as 700 retail outlets may have been affected.

In some units, reported temperatures reached 50 degrees Celsius or higher.

The incidents resulted in the disposal of large quantities of food, while fires linked to overheating equipment were also reported at some locations.

Financial losses were estimated in the millions of euros.

Dominique Schelcher, chief executive of Coopérative U, described the attack on food preservation systems as unprecedented and unacceptable.

Although the October and November attacks share technical similarities, it has not yet been established that they were carried out by the same perpetrators.

United States: Refrigeration Incidents at Military Bases Under Investigation

Another development reported by the BBC and Axios concerns investigations in the United States.

American authorities are examining refrigeration problems reported during August 2026 at several US military bases.

According to Axios, the investigation involves refrigerator and freezer malfunctions at at least six food-supply outlets associated with military bases.

US authorities are cooperating with their French counterparts to examine whether the incidents could be connected.

However, it has not been confirmed that the problems at American military bases were caused by cyberattacks.

There is also no publicly available evidence directly connecting the American incidents to the attacks on European supermarkets.

When Must Food Be Removed from Sale?

A rise in refrigerator temperature does not automatically mean that every product has spoiled, but supermarkets are required to monitor storage conditions.

Hélène Bonte, a representative of the Belgian Federal Agency for the Safety of the Food Chain (FAVV), explained to VRT NWS that a maximum temperature of 7 degrees Celsius generally applies to many chilled products.

For more sensitive foods, such as meat and fish, the limit may be 4 degrees Celsius, depending on the product category.

For frozen products, the required temperature is generally minus 18 degrees Celsius.

In the case of frozen food, the assessment takes into account the temperature at the centre of the product rather than merely the air temperature inside the freezer.

For that reason, interference detected within minutes may have considerably less serious consequences than a disruption lasting several hours.

When stores cannot guarantee that products have been kept within the required temperature limits, they must remove them from sale.

This explains why large quantities of food were discarded even at stores where refrigeration systems were repaired on the same day.

Why Are Attackers Targeting Supermarkets?

Tom Hegel, a researcher at cybersecurity company SentinelOne, explained to Reuters that supermarket chains use large numbers of electronic devices connected to IT systems.

These include refrigeration controllers, building management systems, door-access equipment and payment terminals.

According to Hegel, the food sector is particularly vulnerable because products can spoil within hours and profit margins are relatively narrow.

An attack targeting refrigeration systems can cause financial damage without disrupting payment systems or shutting down the supermarket’s entire operation.

For attackers, this can create opportunities for extortion, economic pressure or sabotage.

However, the specific motive behind the latest incidents has not been established.

Experts Warn of Extortion and Hybrid Threats

Patrick Hauspie, from VLAIO, explained to VRT NWS that cyberattacks are often carried out for financial gain.

In such a scenario, attackers may place businesses under pressure by threatening to continue interfering with their systems unless a payment is made.

But Hauspie also raised the possibility of attacks aimed at destabilising the economy or creating uncertainty in society.

Such operations could fall into the category of hybrid threats.

However, as of November 3, no specific ransom demand by those responsible for the refrigeration attacks had been publicly reported.

Experts emphasise that the absence of financial demands may be an indicator worth investigating, but does not automatically prove that the incidents constitute state-sponsored sabotage.

No authority has presented public evidence attributing the attacks to Russia or any other state.

Irish Expert Warns of the “Weaponisation of Food”

Conor Flynn, a cybersecurity expert and managing director of Security Solutions at Waystone, described the development as a potential form of “the weaponisation of food”.

In an interview with RTÉ, he warned that future targets might include not only supermarkets but also major distribution warehouses, emergency food reserves and infrastructure supporting food security.

He noted that operational technology has also been targeted in other sectors, including water supplies, sewage systems, electricity, gas and oil.

According to Flynn, businesses need to examine not only their own systems but also the security of equipment and services supplied by external contractors.

He cited the European NIS2 Directive as an important instrument for strengthening infrastructure and supply-chain cybersecurity.

European Commission: Food Supply Security Is Part of Europe’s Wider Security

European Commissioner for Agriculture and Food Christophe Hansen responded to the wave of incidents, expressing concern about their recurrence.

He characterised the attacks as deliberate interference that damages supply chains and undermines consumer confidence.

“The repeated occurrence of these cyberattacks is deeply concerning,” Hansen said.

Nevertheless, he emphasised that the overall security of food supplies in the European Union is not currently at risk.

A European Commission spokesperson told RTÉ that empty shelves in affected supermarkets demonstrated the importance of protecting the food system.

“These incidents show that cyberattacks can disrupt services, affect businesses and directly affect citizens’ daily lives,” the spokesperson said.

The European Commission pointed to several legal instruments designed to strengthen cybersecurity, including the Cyber Resilience Act, the Cyber Solidarity Act and the NIS2 Directive.

Belgian Federal Prosecutor Opens Criminal Investigation as Authorities Cooperate Across Borders

Belgium’s Federal Prosecutor’s Office has opened a criminal investigation into the incidents, according to confirmation reported by VRT NWS and Euronews.

The Belgian Centre for Cybersecurity (CCB) also confirmed that it was monitoring the situation.

Spokesperson Katrien Eggers said there was no confirmed information concerning the identity of the perpetrators.

She warned that identifying those responsible could prove extremely difficult.

In Sweden, the National Cyber Security Centre is exchanging information with partner institutions.

In Germany, Bavarian regional police have confirmed that they will cooperate with authorities in other countries.

The United Kingdom’s National Cyber Security Centre (NCSC) also announced that it was working with international partners and industry to understand the incidents.

As of reports published on November 3, no similar incidents had been confirmed in the United Kingdom.

Warnings Had Already Been Issued in October

One issue drawing criticism is that the risk had been identified several weeks before the latest wave.

The CERT-FR document, published on October 12 and updated through October 16, explicitly warned that further attacks targeting refrigeration systems could continue.

In Sweden, Fredrik Blix, a cybersecurity researcher at Stockholm University, criticised equipment suppliers for what he considered an insufficient response.

“This is somewhat of a failure on the part of refrigeration suppliers. They should have taken this more seriously,” he told SVT.

Other Swedish researchers also stressed that vulnerabilities in internet-connected industrial equipment have been known for years.

According to them, these incidents demonstrate the need for stronger security controls, particularly in systems that directly affect physical processes.

However, the attacks did not exclusively affect old equipment. In Alvesta, Sweden, managers of an ICA supermarket said an older refrigeration system may have helped their store avoid the interference.

This illustrates that the age of equipment alone does not determine its security. Network connections, configuration, maintenance and internet exposure are also important.

Financial Damage and Provisional Toll

The overall impact of the attacks remains incomplete.

More than 100 stores and businesses were identified in initial Reuters reports and specialist media coverage, before every new case had been included.

In Belgium, just three businesses reported losses of at least €175,000.

In Sweden, an ICA supermarket in Sjöbo estimated that potential losses involving food products could reach one million kronor.

In Germany, the Edeka supermarket in Reisbach was forced to discard large quantities of food, while problems were also reported at several stores in North Rhine-Westphalia.

In Ireland, 13 SuperValu stores were affected, but Musgrave confirmed that normal operations had been fully restored by Monday evening.

Incidents were reported at several stores in Portugal and Italy, although financial losses have not yet been established.

In France, where the first wave was recorded on October 12, damage was estimated in the millions of euros.

These figures do not represent a unified European assessment. They include company estimates, confirmed product losses and provisional reports that may change as investigations proceed.

Who Is Behind the Attacks, and What Remains Unanswered?

As of November 3, 2026, no group has publicly claimed responsibility for the wave of attacks on European refrigeration systems.

Investigators have not confirmed whether the incidents in different countries were carried out by the same perpetrators.

Several fundamental questions remain unanswered: whether attackers used compromised credentials, software vulnerabilities, internet-exposed devices or combinations of these methods; whether the October and November attacks are connected; and whether the motive was financial, sabotage-related or something else.

Another unresolved issue is whether affected companies had implemented the warnings issued after the attacks in France.

Despite the damage, there is no evidence that Europe’s overall food supply has been disrupted or that widespread food shortages have occurred.

The incidents affected a limited proportion of stores within each retail network, and in many cases deliveries continued normally.

Nevertheless, the recurrence of attacks within three weeks has shown that food infrastructure can suffer substantial damage even when payment systems, central warehouses and main IT networks continue operating.

From France in October to Germany, Sweden, Belgium and other countries in November, the attacks have exposed a shared vulnerability in the modern economy: equipment responsible for preserving food increasingly depends on digital systems, and interference with those systems can destroy products within hours.

For European authorities, the challenge is not merely to identify those responsible for the current incidents, but also to protect refrigeration systems and other critical infrastructure before similar interference causes even greater damage.

(BBC, Associated Press, AFP, dpa, SVT, VRT NWS, RTÉ, NOS, EFE, Euronews, SecurityWeek, The Hacker News, The Guardian, The Independent, Bayerischer Rundfunk, WDR, Deutschlandfunk, Tagesschau, L’essentiel, Belga, ERR, Helsingin Sanomat, Axios, CERT-FR, October 12–November 3, 2026)