Brussels, November 3, 2026 : A cyberattack no longer needs to steal bank details, shut down a government website or lock a company’s computers to cause serious disruption. It can now interfere with the systems that keep food fresh, manage airport operations and control industrial equipment.
That risk became visible across Europe on November 2, when supermarket refrigeration systems in at least seven countries were affected by suspected cyberattacks. Temperatures in some refrigerators and freezers reportedly climbed as high as 50°C, forcing retailers to remove potentially spoiled food from shelves and discard products that could no longer be considered safe for sale.
The incidents were reported in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden. Retailers and businesses affected included Carrefour, ICA, Coop and SuperValu, while other supermarket operators also reported refrigeration or IT problems.
The incidents have raised a wider question for governments and businesses: how vulnerable are the digital systems that control essential physical services?
Seven Countries Face Disruptions to Supermarket Refrigeration
The November 2 incidents affected multiple retailers across northern and western Europe. In Belgium, Carrefour reported problems in around 15 of its approximately 700 stores. The company said the impact was limited to certain refrigeration units and that stores remained open.
In Ireland, Musgrave Group confirmed that refrigeration systems in 13 SuperValu stores had been affected. The company removed chilled and frozen products from sale as a precaution and said the affected systems were subsequently addressed.
Swedish supermarket chains ICA and Coop also reported problems at some locations. In one Stockholm store, a manager told Reuters that freezer temperatures had reached 50°C. Coop reported disruptions at several of its outlets, ranging from partial problems to complete interruptions in cooling.
Reports also emerged from Estonia, Finland, Luxembourg and the Netherlands. In Estonia, a computer controlling a customer’s refrigeration system was reportedly accessed, while Finnish retailers also reported problems at some locations. In the Netherlands, refrigeration supplier Danfoss said several companies had experienced incidents affecting cooling systems.
The precise number of affected outlets and the full financial losses were not immediately established. The incidents also did not necessarily involve identical systems or a single coordinated operation.
No group had publicly claimed responsibility. Investigators had not established whether the November incidents and the earlier French attack were carried out by the same actors.
How Can Hackers Raise the Temperature of a Supermarket Freezer?
Modern supermarkets often operate large refrigeration networks through centralized digital management systems. Instead of checking every refrigerator and freezer separately, employees can monitor temperatures, receive alerts and adjust settings through connected control platforms.
These systems make store operations more efficient. But if an attacker gains unauthorized access to the management network, the same remote controls can become a route to disruption.
An intruder may be able to change temperature settings, interfere with cooling cycles or manipulate other connected functions. If the system’s safeguards and monitoring mechanisms are inadequate, staff may not immediately recognize that equipment has been altered.
In the European incidents, some refrigeration units reportedly reached temperatures as high as 50°C. Such conditions can make chilled and frozen food unsafe, depending on the product, exposure time and applicable food-safety requirements.
The consequences extend beyond the loss of stock. Retailers may have to close sections of stores, inspect equipment, arrange replacement deliveries, remove products and investigate whether other locations remain vulnerable.
The key concern is that an attacker may not need physical access to a supermarket. A weakness in a remotely accessible digital system could potentially be enough to affect equipment inside the store.
France Faced a Similar Attack in October
The November incidents followed a major disruption in France on October 12, 2026, when hundreds of supermarkets reported problems with refrigeration systems.
French retail groups, including Intermarché and Coopérative U, confirmed that their stores had been affected. Reports indicated that around 150 to 200 Intermarché outlets and nearly 100 Coopérative U stores experienced disruptions. Other retailers were also reported to have been affected.
Some refrigeration units were reportedly pushed into defrosting cycles, causing temperatures to rise sharply. Stores had to remove spoiled or potentially unsafe food, while authorities opened an investigation.
The similarities between the French incident and the latest European disruptions have increased concerns that weaknesses in connected refrigeration management systems could be exploited across different retail networks.
However, a similar method does not by itself prove that the incidents were conducted by the same hacking group. Investigators have yet to establish a common identity or confirm that all the reported events were part of one campaign.
Cyberattacks Are Increasingly Affecting the Physical World
The supermarket incidents are part of a broader pattern in which cyberattacks can disrupt services that people depend on every day.
In September 2023, MGM Resorts in the United States disclosed a cybersecurity incident that disrupted operations at some of its properties. The company shut down certain systems to contain the incident, affecting guest-facing services and business operations.
In February 2024, a ransomware attack on Change Healthcare caused widespread disruption across the US healthcare sector. Hospitals, pharmacies and medical providers faced difficulties with claims processing, payments and other essential administrative services. The US government acknowledged that the incident affected healthcare operations and, in some cases, people’s ability to obtain care or prescriptions.
In August 2024, the Port of Seattle experienced a ransomware attack that affected systems at Seattle-Tacoma International Airport. Disruptions included baggage services, check-in kiosks, ticketing, passenger information displays and other digital services. The Port later said that the attack had been carried out by the Rhysida criminal organization.
In 2025, the impact of cyber incidents spread into manufacturing and retail supply chains.
Jaguar Land Rover’s cyber incident disrupted production operations and affected suppliers across the automotive industry. On September 19, 2025, the UK Department for Business and Trade and industry representatives held a meeting to discuss the impact on the company and its wider supply chain.
British retailer Marks & Spencer also faced a major cyber incident in April 2025. The company temporarily paused online orders and later confirmed that some customer personal information had been taken. On May 13, it said the stolen information did not include usable payment card details or account passwords.
These cases involved different types of attacks and different technical systems. But they demonstrate a common risk: when a business depends on connected digital infrastructure, an attack on that infrastructure can quickly become a disruption to its physical operations and customers.
IT and OT: Understanding the Difference
The latest supermarket incidents highlight an important distinction in cybersecurity: the difference between Information Technology (IT) and Operational Technology (OT).
Information Technology (IT) generally covers systems used to process, store and communicate information. Examples include computers, servers, databases, websites, email platforms and business networks.
Operational Technology (OT) refers to programmable systems and devices that monitor or control physical equipment, processes and environments. The US National Institute of Standards and Technology (NIST) includes industrial control systems, building automation and transportation systems within this broad category.
In simple terms, IT helps an organization manage information, while OT helps it operate physical equipment and processes.
A cyberattack on an IT network may interrupt access to files, customer records or business applications. An attack on an OT environment can interfere with machinery, temperature controls, production lines, building systems or transportation operations.
The distinction is not always absolute. Modern businesses increasingly connect IT and OT networks so that information from physical equipment can be monitored and managed remotely. That integration can improve efficiency, but it can also create new routes through which attackers may reach operational systems.
Why Connected Refrigeration Systems Need Stronger Protection
Supermarket refrigeration may appear to be a routine part of retail operations, but it is essential to food quality, safety and supply-chain continuity.
A large store can have numerous refrigerators, freezers and cold-storage units connected to a common monitoring platform. If the platform is exposed to the internet or linked to a wider corporate network without adequate safeguards, a security weakness may have consequences far beyond a single computer.
The recent incidents underline several security priorities for retailers and equipment operators:
- Restrict remote access: Only authorized users and devices should be able to access refrigeration control systems.
- Use strong authentication: Remote access should be protected by robust passwords and multi-factor authentication wherever possible.
- Update software: Older software and unpatched systems can leave known security weaknesses exposed.
- Separate critical networks: Refrigeration controls should not have unrestricted access to ordinary office or customer-facing IT networks.
- Monitor unusual activity: Unexpected temperature changes, altered settings and unusual login attempts should trigger immediate alerts.
- Maintain manual safeguards: Staff should be able to check equipment locally and intervene if digital controls malfunction.
- Prepare recovery plans: Retailers need tested procedures for isolating affected systems, inspecting food and restoring safe operations.
These measures cannot guarantee that attacks will never occur, but they can reduce the likelihood of unauthorized access and limit the damage when an incident happens.
The Bigger Risk: Essential Services Are Becoming Digital Targets
The European supermarket incidents illustrate how the consequences of cybercrime are changing. A compromised system may affect more than data stored on a server. It can interfere with the physical processes that keep businesses and public services running.
The same broad concern applies to factories, airports, hospitals, power networks, water facilities and logistics operations. As more equipment becomes connected and remotely managed, cybersecurity must cover not only computers and databases but also the systems that control physical operations.
For supermarkets, the immediate challenge is to restore reliable refrigeration, protect food safety and determine how the unauthorized changes occurred. For investigators, the priority is to establish whether the incidents were connected and identify those responsible.
Bottom Line: The latest attacks on supermarket refrigeration systems show why cybersecurity is no longer just an IT issue. When digital controls are connected to physical equipment, a breach can affect food supplies, business operations and everyday life. Protecting the systems that control the real world is becoming just as important as protecting the data on our screens.
