Do Son 
Commercial cooling appliances across Northern Europe recently experienced sudden thermal surges. Specifically, a suspected supermarket freezer hack altered refrigeration settings to fifty degrees Celsius overnight. Grocery chains in Sweden, Belgium, Luxembourg, and Estonia discovered compromised freezers on the morning of November 2, 2026. Consequently, multiple retail locations closed temporarily to discard spoiled groceries and reset cooling infrastructure.
Overnight Disruptions Across Major European Chains
Major Scandinavian grocery retailers ICA and Coop confirmed widespread equipment anomalies in Sweden. In Sjobo, an ICA Kvantum store halted operations after unauthorized actors manipulated refrigeration settings. Similarly, Coop identified temperature tampering across six individual branches. As detailed in the Reuters report on soaring Swedish grocery store freezer temperatures, staff discovered heating elements activated inside ice cream cases.
Furthermore, the anomalous heating incidents extended rapidly across national borders. Retail conglomerate Ahold Delhaize launched an investigation after Delhaize branches in Belgium and Luxembourg suffered identical temperature surges. Concurrently, Belgian retail chain Colruyt detected unauthorized modifications in its regional warehouses. In Estonia, technicians discovered several store refrigeration units set to fifty degrees Celsius.
Targeting Industrial Cooling Infrastructure
This widespread disruption mirrors an extensive wave of supermarket cyberattacks in France last month. During those earlier incidents, intruders remotely triggered automated defrost cycles across hundreds of grocery stores. Consequently, vulnerable perishables spoiled over several hours, and some cooling compressors ignited fires.
Exposed Controllers and Insecure Protocols
Forensic investigations into the French incidents identified internet-exposed industrial refrigeration controllers. Facilities utilize centralized controllers from manufacturers like Danfoss, Copeland, and Dixell to manage defrost schedules and compressor speeds. However, technicians often deploy these systems with outdated firmware or without adequate network segmentation. When remote management portals face the public internet, malicious actors can easily alter thermal thresholds.
Meanwhile, defense authorities are evaluating potential parallels with prior military disruptions. In August, United States defense officials investigated similar refrigeration failures inside military commissary stores. Although investigators have not linked the incidents conclusively, the synchronized European events highlight fragile retail operations. Therefore, grocery operators must isolate industrial control networks and enforce robust authentication. Ultimately, securing physical operational technology remains vital to protecting international food supply chains.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
