Hackers heat supermarket freezers in 7 countries: what UK shoppers need

Supermarket refrigeration systems in seven European countries were hit by a suspected cyber-attack overnight into Monday 2 November 2026. Fridge and freezer temperatures were pushed up remotely, and stores in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland had to pull chilled and frozen food from sale. It is the second wave in three weeks, after hundreds of French supermarkets were hit in the same way on the night of 11 to 12 October.

No incidents have been reported in the UK, the BBC says. The National Cyber Security Centre (NCSC) said it was working with international partners and industry to understand the incident, and LBC reports that British retailers have been put on alert. UK research shared with The Grocer last month found more than 800 refrigeration and building controllers belonging to UK retailers that can be reached from the open internet. This article explains what happened, how exposed British supermarkets are, and what it means for the food in your basket in the run-up to Christmas.

What happened to supermarket freezers on 2 November?

Shop staff across northern and western Europe arrived on Monday morning to find refrigerated cabinets warm and freezers defrosting. According to the BBC, around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, with a smaller number of shops hit in Sweden, Ireland, the Netherlands, Estonia and Finland. Some units reportedly reached temperatures as high as 50°C.

Stephan Moelans, chief executive of Belgian refrigeration company Sabcobel, which operates systems for Delhaize, told the Belga news agency that the units’ evaporators had been switched into defrost mode. He described it as a cyber-attack and said it used what is believed to be the same method as the French incident in October. Euronews reports that Sabcobel knows of around twenty affected units out of the hundreds it manages.

Delhaize said it had identified an IT incident affecting the refrigeration systems in several dozen stores, Euronews reports. Carrefour said 15 of its roughly 700 Belgian stores were affected, and a spokesman, Mich Vergauwen, was quoted by The Journal as saying: “It’s a cyberattack, there is no other reason.” Colruyt Group, which runs Spar stores in Belgium under franchise, told Reuters that five shops had their fridge systems attacked.

Who has been hit so far

The list of affected chains comes from company statements and local media, and some counts differ between outlets. The table below sets out what has been reported by Monday afternoon UK time.

Country	Retailers affected	Reported scale	Source
Belgium and Luxembourg	Delhaize, Carrefour, Intermarché, Spar (Colruyt)	About 40 Delhaize stores, 15 Carrefour, 15 Intermarché, 5 Spar	BBC, Euronews citing Le Soir, Reuters
Ireland	SuperValu (Musgrave)	13 stores; chilled and frozen products removed from sale	Musgrave statement via The Journal, Irish Times
Sweden	ICA, Coop	A “small number” of ICA stores; seven of 800 Coop stores (Aftonbladet reported six)	BBC, LBC
Netherlands	Butchers and neighbourhood stores	At least 17 companies, according to Danfoss	NOS via BBC
Finland	K-stores (Kesko)	Malfunctions in some stores, under investigation	Helsingin Sanomat via BBC
Estonia	Selver	At least one store	ERR via BBC
United Kingdom	None reported	NCSC working with partners and industry	BBC, LBC

Exact losses have not been published, but early estimates are large for individual stores. A Delhaize branch in Hoeilaart, Flanders, told Het Laatste Nieuws it had lost €100,000 (about £83,500 at current rates) of produce, before counting the cost of closing the shop. The BBC says local media reported that millions of euros worth of food had to be thrown away across the affected countries, while Euronews put the figure at hundreds of thousands of euros.

Ahold Delhaize, the Dutch-Belgian owner of Delhaize, has already had a difficult autumn. It dealt with a separate security issue in October that took some websites offline, a story we covered in our analysis of why Ahold Delhaize is likely to hold its 2026 guidance after its cyberattack. The company said at the time that the October website incident was unrelated to the French refrigeration attacks.

How does a hacker turn a supermarket freezer into an oven?

Modern supermarket refrigeration is not a row of separate fridges. Each store usually has a central controller that manages every chilled cabinet, freezer and cold room on the shop floor, logging temperatures and running defrost cycles. Engineers log into a web page on that controller to check readings and change settings, often remotely.

If that login page sits on the open internet and the controller runs old software with a known flaw, an attacker can find it with automated scanning and change the settings. In both the French and the Belgian incidents, the reported method was to force the units into a continuous defrost cycle. Defrost mode deliberately warms the evaporator coils to melt ice, so leaving it running pushes cabinet temperatures far above safe levels.

The Danfoss and Copeland flaws

After the French attack, France’s national cyber-security agency said it was “aware of numerous compromises” involving remote control modules made by Danish manufacturer Danfoss and US-based Copeland, the Associated Press reported. Danfoss said most of the affected systems were older products that no longer received software or security updates. It said it had “long advised customers to keep supported systems updated with the latest firmware, as well as to operate behind a firewall”.

Copeland said a vulnerability had been identified in “a discontinued, end-of-life generation of controllers”. Security firm Claroty had flagged vulnerabilities in the Danfoss AK-SM 800A and Copeland XWeb Pro platforms in an August report, and its Team82 researchers demonstrated at the DEF CON 34 conference how a compromised controller could be used to change temperature thresholds and operating schedules, The Grocer reports. Both manufacturers had since released fixes, according to Claroty.

Sabcobel’s Moelans told Belga that his company had been working since the French attack to protect customers’ fridges, but that the units needed physical modifications rather than software updates alone. He said most of Sabcobel’s customers had moved to managing their fridges over a secure internet connection after the French incident. A Danfoss spokesperson told Belgian broadcaster VTM that the vulnerability lay primarily in outdated software, Euronews reports.

That leaves a gap that is common in retail technology: equipment that keeps working mechanically for many years after the manufacturer stops issuing security updates. A freezer cabinet can last well over a decade, but its controller software may have been out of support for years.

What happened in the French attack in October?

The first wave struck French supermarkets on the night of Sunday 11 October. French finance minister Roland Lescure told parliament that about 700 of the country’s 10,000 supermarkets were affected, the Associated Press reported. He said there was no risk to France’s food supplies but that the attack “touches the heart of our food security”.

Groupement Mousquetaires said 300 of its Intermarché and Netto stores were affected. Carrefour said fridges in 80 of its 6,000 stores were hacked and Monoprix said 5% of its 400-plus stores had been hit, according to Reuters reports cited by The Grocer. Figures for Coopérative U vary: chief executive Dominique Schelcher put the number at 80 of 2,000 stores in a post on X, while AFP reported more than 100 outlets. Schelcher called the attack “unprecedented, extremely serious, and unacceptable”.

The Paris prosecutor’s cybercrime unit opened an investigation that included spoiled food and reported fires. LBC reports losses ranged from tens of thousands of euros to more than €130,000 (about £109,000) per store, with two supermarkets in Alsace reporting combined losses of €270,000 (about £226,000).

Measure	French wave (11 to 12 October)	European wave (1 to 2 November)
Countries	France (with reports of others)	Seven: Belgium, Luxembourg, Sweden, Ireland, Netherlands, Estonia, Finland
Stores affected	About 700, per the French government	Dozens; roughly 75 in Belgium alone on reported counts
Method	Forced continuous defrost, temperatures up to 50°C	Evaporators switched to defrost mode, the same mechanism per Sabcobel
Equipment named	Danfoss and Copeland controllers	Danfoss software; units serviced by Sabcobel; “specific model” at SuperValu
Losses per store	Up to more than €130,000 (about £109,000)	€100,000 (about £83,500) at one Belgian store
Claim of responsibility	None	None
UK incidents	None reported	None reported

Nobody has claimed responsibility for either wave. Experts quoted by the Associated Press in October noted that there appeared to be no ransom demand and no data theft, which makes the attacks unusual: their only visible effect is physical damage to stock.

Who is behind the attacks?

Nobody knows yet. There has been no claim of responsibility for either the French or the wider European wave, according to the BBC and Euronews. Investigators in France and Belgium have opened criminal inquiries, and national cyber agencies in Belgium and Sweden are monitoring the situation.

The Journal notes it is not yet known whether the SuperValu incident is connected to the others, while Sabcobel’s chief executive said the Belgian attack used “exactly the same mechanism” as the French one, Euronews reports. Without a ransom note or data theft, the motive remains unclear, and officials have not commented on whether a state or criminal group is suspected.

Could the same thing happen in UK supermarkets?

The honest answer is that the risk is real but different in shape. Analysis by UK Cyber Defence, shared with The Grocer in October, found the web login pages of more than 800 UK retailer fridge and building controllers were “reachable by anyone on the internet who knows where to look”. That does not mean they are hacked or even vulnerable, but it means they are visible to anyone scanning for weaknesses.

Danfoss units are less common in UK grocery than in France. UK Cyber Defence found 15 Danfoss fridge controllers in the UK accessible on the open internet and said it was “highly unlikely that they have been patched”. By contrast, its analysis attributed roughly 2,967 internet-exposed Danfoss controllers to France alone, the largest such population in the world.

Peter Bassill, founder of UK Cyber Defence, told The Grocer that Britain “has over 800 refrigeration and building controllers of one make or another reachable from the public internet, usually put there by a maintenance contractor so they can dial in from the van”. He added: “The ingredients are the same here; only the brand on the box is different.”

The firm said most of the exposed UK controllers, from makers including Danfoss, Carel and Copeland, sat on consumer broadband, rural broadband and mobile data connections rather than on retailers’ corporate networks. “The retailer’s IT team frequently does not know the device exists,” Bassill said. That points to smaller stores, franchised convenience shops and independent butchers as more likely to be exposed than head-office-managed superstores, although no breakdown by retailer has been published.

What the NCSC has said

The NCSC, part of GCHQ, said it was working with international partners and industry to “fully understand details of an incident”, the BBC reports. LBC reports that the centre has alerted retailers and is working with them to guard against the threat. The BBC states that no incidents have been reported in the UK.

In Sweden, the head of the national cyber-security centre, John Billow, warned that many operational technology devices remain exposed and need patching or updating, according to LBC. Belgium’s federal prosecutor has opened an investigation, and the Belgian Centre for Cybersecurity said it was aware of an incident but had no further information, Euronews reports.

Why are UK retailers already on edge about cyber attacks?

British retail has had a bruising run of cyber incidents. In spring 2025, attacks on Marks & Spencer, the Co-op and Harrods disrupted online ordering, stock systems and customer data. M&S paused online orders for weeks, and the effect on its profits is still visible in comparisons, as our preview of the M&S half-year results due on 4 November sets out.

Those attacks targeted IT systems and data. The European fridge attacks are different in kind: they reach into operational technology, the equipment that physically runs a store. For a grocer, the most valuable thing in the building after its staff is the chilled and frozen stock, and a warm freezer has to be emptied regardless of whether the problem was a fault or an attack.

Retail security spending has traditionally focused on card payments, websites and customer databases. Refrigeration, lighting, heating and door controls are often installed and maintained by specialist contractors under separate contracts. That split is the gap UK Cyber Defence describes: devices that sit outside the retailer’s own security monitoring because the IT team never commissioned them.

Type of attack	Typical target	What shoppers notice	Recent example
Ransomware or IT intrusion	Ordering, stock and payment systems	Online orders paused, empty shelves, contactless or app problems	M&S and Co-op, spring 2025
Data theft	Customer records	Breach emails, phishing risk	Co-op member data, 2025
Website takedown	Online shop and apps	Websites offline, stores open	Ahold Delhaize brands, October 2026
Operational technology attack	Refrigeration controllers	Chilled and frozen aisles emptied, store closures	France (October) and seven countries (November 2026)

Is food from a hacked fridge safe to eat?

The safety risk comes from temperature, not from the hack itself. Food that has spent hours at high temperatures can allow harmful bacteria to grow, and frozen food that has thawed should not simply be refrozen. That is why the affected stores removed chilled and frozen products rather than leaving them on sale.

Musgrave said that “as a precaution, chilled and frozen products in the affected stores have been removed from sale, and all other products remain available as normal”, The Journal reports. The company said its monitoring systems alerted it to the problem and that “customer safety is our first priority”. It added that products still on sale had been stored at safe temperatures.

In England, Wales and Northern Ireland, food that needs to be kept chilled must by law be held at 8°C or below, and the Food Standards Agency recommends that fridges are set at 5°C or below. Frozen food is normally kept at around minus 18°C. Scotland’s rules require chilled food to be kept in a refrigerator or cool place without setting the same single figure, and Food Standards Scotland gives similar advice on 5°C or below.

Supermarkets log cabinet temperatures continuously, which is how the affected chains spotted the problem overnight. Any UK store whose refrigeration failed, for whatever reason, would be expected to remove affected stock under its food safety management system. If a product is withdrawn from sale more widely, the retailer or the Food Standards Agency publishes a notice, in the same way as a product recall such as the recent Arla Protein Pudding recall over a glass risk.

What are your rights if chilled food is spoiled?

No UK shopper has been affected by these attacks so far. But the same rights apply whatever causes food to be unsafe or not fit for purpose, whether a hacked controller, a power cut or an ordinary breakdown.

• Satisfactory quality: under the Consumer Rights Act 2015, food must be of satisfactory quality and fit for purpose. Food that has been stored at the wrong temperature and has spoiled before its use-by date does not meet that standard.
• Short-term right to reject: you normally have 30 days to reject faulty goods for a full refund, but for perishable goods that period is limited to the time the item could reasonably be expected to last.
• Online grocery orders: if chilled items arrive warm, reject them at the door or contact the retailer straight away with photos. The retailer is responsible for the goods until they are delivered to you.
• Keep evidence: receipts, order confirmations, photos of packaging and dates help, especially if you are claiming for food poisoning or other losses.

Use-by dates matter more than best-before dates in this situation. A use-by date is about safety and assumes the product has been kept at the correct temperature throughout; a chain of custody broken by a warm freezer makes that date unreliable.

What should UK shoppers do now?

For most people the practical advice is to carry on shopping as normal while keeping a closer eye on chilled and frozen items. The UK has no reported incidents, and supermarkets monitor their cabinets constantly.

1. Check the cabinet: frozen food should be hard to the touch. Packs that feel soft, or show heavy frost inside the bag that suggests thawing and refreezing, are worth leaving and pointing out to staff.
2. Look for signs in store: if a chilled aisle is taped off or empty, that is the store’s safety system working, not a reason to panic-buy.
3. Pack cold items together: use a cool bag for long journeys, and put chilled and frozen shopping away first when you get home.
4. Check home fridges: a fridge thermometer costs a few pounds and confirms whether yours is at 5°C or below.
5. Watch for scams: news stories about cyber attacks are often followed by fake “refund” or “compensation” emails and texts. Retailers do not ask for bank details by text.

Preparing for disruption does not need special kit. The government’s emergency preparedness advice, which drove the Be Ready checklist and the rush on wind-up radios, already suggests a small store of food that does not need refrigeration, which also covers a freezer failure at home.

Will this affect Christmas food shopping in the UK?

There is no sign so far that the European incidents will affect British supply. The attacks hit individual store controllers, not food manufacturers, distribution centres or the cross-border supply chain, and France’s finance minister said the October wave posed no risk to French food supplies.

Timing matters for retailers, though. The weeks before Christmas are the peak for chilled and frozen sales, and supermarkets are already opening their festive delivery calendars; Tesco’s slots open on 3 November, as listed in our guide to Christmas delivery slots at every major supermarket. A refrigeration failure in a busy store on 23 December would cost far more in lost turkey, meat, cheese and desserts than an ordinary weekday in November.

What UK retailers are likely to do

Based on the advice from UK Cyber Defence, Danfoss and Sabcobel, the steps for UK grocers are not complex: identify every refrigeration and building controller in their estate, check whether each is reachable from the internet, apply manufacturer updates, and move remote access behind a secure connection. Bassill described it to The Grocer as “housekeeping, not rocket science”.

The harder part is the long tail. Large chains have central engineering teams; franchised convenience stores, independent grocers, butchers and farm shops rely on local contractors. The Dutch incidents, where Danfoss said at least 17 companies were hit including butchers and small neighbourhood stores, show that smaller businesses are in the firing line.

What should independent shops and small grocers check?

Independent retailers with modern refrigeration should treat this as a prompt to talk to their maintenance contractor this week. The questions are short and practical, and none of them requires the shop owner to be a cyber-security expert.

• Who has remote access? Ask your refrigeration contractor whether your controller can be reached from the internet and how they log in.
• Is it supported? Ask for the controller make, model and software version, and whether the manufacturer still issues updates for it.
• Is the default password gone? Any controller still using a factory password should be changed immediately.
• Is there an alarm? Temperature alarms that text a manager when cabinets warm up limit losses whatever the cause.
• Is stock insured? Check whether your policy covers stock spoilage from equipment failure and from cyber incidents, which are often treated differently.

The NCSC publishes free guidance for small businesses on its website, including a small business guide that covers passwords, updates and protecting devices connected to the internet.

For UK shoppers, the immediate impact is nil and the advice is unchanged. For UK retailers, the question is whether the 800-plus controllers visible online will be secured before someone tests them.

Frequently asked questions

Have any UK supermarkets been hit by the fridge cyber attack?

No. The BBC reports that no incidents have been reported in the UK. The National Cyber Security Centre says it is working with international partners and industry to understand the incident.

Which countries were affected on 2 November 2026?

Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland. France was hit in a separate wave on 11 to 12 October, when about 700 supermarkets were affected according to the French government.

Were SuperValu stores in Northern Ireland affected?

Reports so far refer to 13 SuperValu stores in the Republic of Ireland, including Blanchardstown, Lucan and Waterford. None of the published statements mentions stores in Northern Ireland.

How did hackers change the freezer temperatures?

They reached the central controllers that manage store refrigeration and forced the units into defrost mode. Reports link the attacks to older Danfoss and Copeland controllers that were reachable from the internet and running outdated software.

Is food from an affected store safe?

Affected stores removed chilled and frozen products from sale as a precaution. Musgrave said products still on sale in SuperValu stores had been kept at safe temperatures. Chilled food in England, Wales and Northern Ireland must legally be kept at 8°C or below.

Can I get a refund if chilled food I bought has spoiled?

Yes, if it was not of satisfactory quality when you bought it. Under the Consumer Rights Act 2015 you can reject faulty goods for a refund, and for perishable food the time limit is the period the item could reasonably be expected to last.

How many UK fridges are at risk?

UK Cyber Defence told The Grocer that more than 800 UK retailer refrigeration and building controllers have login pages reachable from the internet, including 15 Danfoss units it believes are unlikely to be patched. Being visible does not mean they have been hacked.

Will the attacks cause food shortages before Christmas?

There is no sign of that. The attacks hit store-level refrigeration rather than manufacturers or distribution centres, and France’s finance minister said the October wave posed no risk to French food supplies.

What should a small shop do to protect its fridges?

Ask the refrigeration contractor whether the controller is reachable online, confirm it still receives updates, change any default password, fit temperature alarms and check whether insurance covers stock lost to a cyber incident.