European Supermarket Cyberattacks Expose Risks to Connected Business Systems

Cyberattacks targeting supermarket refrigeration systems have disrupted more than 100 stores across Europe, forcing retailers to discard food after attackers reportedly manipulated cooling equipment remotely.

The incidents, reported on 2 November 2026, affected supermarkets and other retailers in several European countries, including Belgium, Sweden, Ireland, Luxembourg, Estonia and the Netherlands.

In some locations, refrigeration temperatures reportedly increased to as high as 50°C, damaging fresh and frozen products and requiring staff to remove affected stock from sale.

The disruption follows similar attacks against hundreds of French supermarkets in October, raising concerns about the security of internet-connected equipment used in essential business operations.

Unlike conventional cyber incidents involving stolen customer information or ransomware, these attacks demonstrate how unauthorised access to operational systems can directly affect physical equipment, stock and commercial activity.

What Happened in the European Supermarket Cyberattacks?

According to reporting by Reuters, The Guardian and BleepingComputer, attackers gained access to systems controlling refrigeration equipment at numerous retail locations.

Affected supermarket chains included Carrefour, Delhaize, ICA, Coop and SuperValu, alongside other retailers.

In Belgium, Carrefour confirmed that approximately 15 stores experienced refrigeration problems, while Delhaize reported disruption across dozens of locations.

Swedish retailer ICA also acknowledged incidents affecting refrigeration and freezer systems, with one store reporting temperatures reaching 50°C overnight.

In Ireland, supermarket operator Musgrave confirmed that 13 SuperValu stores had experienced a cyber incident affecting refrigeration equipment.

The company removed affected chilled and frozen products from sale as a precaution.

Some businesses were able to restore normal operations relatively quickly, while others faced stock losses and additional disruption.

The precise number of affected locations continues to be assessed, with reports identifying incidents across at least nine European countries.

Authorities have not established who was responsible or whether all the incidents formed part of a single coordinated campaign.

Why Were Refrigeration Systems Targeted?

Modern commercial refrigeration equipment increasingly relies on connected monitoring and control systems.

These technologies allow businesses and maintenance providers to monitor temperatures, identify faults and adjust settings remotely.

For retailers managing large numbers of refrigeration units, remote access can provide significant operational benefits.

However, equipment connected to wider networks or accessible through the internet can introduce additional Cyber Security risks.

If unauthorised individuals gain access to a control interface, they may be able to change operational settings without physically entering the premises.

In the European supermarket incidents, attackers reportedly manipulated temperature controls and, in some cases, activated defrosting functions.

This caused refrigeration equipment to operate outside its intended settings, resulting in food spoilage and commercial disruption.

The incidents highlight how technology designed to improve efficiency can become a vulnerability when remote access is insufficiently protected.

What Is Operational Technology?

Operational Technology, commonly referred to as OT, describes hardware and software used to monitor or control physical equipment and processes.

Unlike traditional Information Technology (IT), which generally focuses on processing, storing and communicating information, OT directly influences how physical systems operate.

Examples include:

• Industrial machinery and automated production equipment.
• Commercial refrigeration and heating systems.
• Building management and ventilation controls.
• Manufacturing production lines.
• Water treatment and utility infrastructure.
• Automated warehouse and logistics equipment.

Many organisations rely on these technologies without necessarily treating them as part of their wider Cyber Security environment.

As operational equipment becomes increasingly connected to corporate networks and remote monitoring services, the distinction between IT and OT security becomes less clear.

A compromise affecting an operational controller may not involve the theft of personal information, but it can still cause substantial financial losses or interrupt essential services.

The Connection to Earlier Attacks in France

The November incidents follow a significant cyberattack against refrigeration systems in France on 12 October 2026.

That earlier attack affected hundreds of supermarkets, with attackers reportedly gaining remote access to temperature-control equipment.

Retailers experienced substantial losses after refrigeration settings were altered and food became unsuitable for sale.

Some individual stores reportedly suffered losses exceeding €100,000.

According to subsequent reporting, the incidents involved vulnerabilities affecting commercial refrigeration controllers, including equipment supplied by Danish manufacturer Danfoss.

The manufacturer stated that it had previously identified security weaknesses and recommended that customers install relevant updates.

However, the existence of vulnerable or outdated equipment does not establish that every affected retailer experienced the same technical compromise.

Investigators are continuing to examine the relationship between the October and November incidents.

The repeated disruption raises important questions about how organisations identify and manage security weaknesses in equipment that may remain operational for many years.

Why Connected Business Equipment Creates Security Risks

Businesses often invest considerable resources in securing employee computers, servers, cloud platforms and customer databases.

However, connected operational equipment may receive less attention.

Commercial systems can remain in service for extended periods, sometimes relying on older software or equipment that cannot easily be updated.

External maintenance contractors may also require remote access to diagnose problems or adjust settings.

These arrangements can create additional exposure if access is not appropriately controlled.

Potential weaknesses may include:

• Equipment accessible directly from the internet.
• Default or inadequately protected administrator credentials.
• Outdated software and unpatched vulnerabilities.
• Remote access arrangements that are no longer required.
• Insufficient separation between operational and corporate networks.
• Limited monitoring of changes to equipment settings.
• Unclear responsibility for maintaining security controls.

Not every connected device presents the same level of risk.

However, organisations need to understand which systems are accessible remotely and what consequences could follow if those systems were compromised.

The Role of Third-Party Suppliers

Commercial refrigeration systems are frequently installed, maintained and monitored by specialist external providers.

These suppliers may require access to multiple customer sites, creating operational efficiencies but also introducing potential security dependencies.

The European incidents illustrate why businesses should understand how third parties access and manage connected equipment.

Relevant questions include whether remote access is restricted, how credentials are protected and who is responsible for applying security updates.

Organisations should also establish whether suppliers can identify unusual activity and respond promptly when operational systems behave unexpectedly.

Independent supplier assessments and technical security reviews can help identify arrangements requiring additional attention.

Conflict International previously examined related issues in its article on Cyber Attacks on UK Manufacturers, which explored how interconnected systems and external suppliers can contribute to business disruption.

The supermarket incidents provide a more specific example of Cyber Security threats affecting physical equipment rather than conventional business information systems.

How Businesses Can Reduce Operational Cyber Risks

The attacks demonstrate the importance of including connected operational equipment within broader Cyber Security and Risk Management arrangements.

Businesses should first understand which systems they operate and how those systems communicate with external networks.

An assessment may identify equipment that requires remote access, unnecessary connections or security controls that have not been reviewed recently.

Appropriate protective measures may include:

• Maintaining an accurate inventory of connected operational equipment.
• Restricting unnecessary internet access to control systems.
• Applying available firmware and security updates following appropriate testing.
• Using strong authentication for remote administration.
• Separating operational networks from general business systems where practical.
• Monitoring unusual changes to equipment settings.
• Establishing clear responsibilities with external maintenance providers.
• Developing incident response procedures for operational disruption.

Security controls should reflect the nature of the equipment and the potential consequences of interruption.

In some environments, changes to operational systems must also be carefully managed to avoid affecting safety or essential processes.

Conflict International provides Cyber Security and Incident Response Services to organisations seeking to identify vulnerabilities, assess security incidents and strengthen their response capabilities.

Our services include vulnerability assessments, penetration testing, Cyber Threat Intelligence and support with suspected system compromises, with specialist operational-system expertise coordinated where required.

Cyberattacks Are No Longer Limited to Data Theft

The European supermarket incidents demonstrate that the consequences of a cyberattack can extend far beyond compromised information.

By interfering with refrigeration controls, attackers reportedly caused physical disruption that resulted in spoiled stock, interrupted operations and financial losses.

For retailers and other businesses dependent on connected equipment, the implications are significant.

A cyber incident affecting machinery, building controls or operational infrastructure may create immediate problems even where customer information and payment systems remain unaffected.

As businesses continue to adopt connected technologies, understanding how those systems are protected is becoming an increasingly important part of organisational resilience.

Conflict International supports UK businesses through Cyber Security, Digital Forensics, Risk Management and specialist investigative services.

Our team can assist organisations in reviewing potential vulnerabilities, examining suspected cyber incidents and developing proportionate responses to identified risks.

To discuss a Cyber Security assessment or suspected operational security incident, contact Conflict International in confidence.