Source: Associated Press
Three weeks after attackers took over refrigeration systems in hundreds of French supermarkets, a second wave of cyberattacks has hit grocery stores across Europe. Supermarkets in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden reported refrigeration failures overnight from 2 to 3 November 2026, with attackers raising temperatures and forcing retailers to discard spoiled food. No one has claimed responsibility for either wave.
What actually happened
The mechanics are simple and that is exactly the problem. Affected refrigeration controllers were connected directly to the internet, in many cases with default passwords, running outdated remote access modules. In one store in Sjobo in southern Sweden, attackers set fridges and freezers to 50 degrees Celsius. Carrefour Belgium reported disruption in about 15 of its more than 700 stores, while the Swedish Coop chain confirmed seven of its roughly 800 stores were hit and noted that the affected stores were still connected over an older 4G network rather than its updated 5G infrastructure. Swedish chain Ica said its affected stores all used an external refrigeration control system from Danish manufacturer Danfoss, the same supplier implicated in the 12 October attack on French retailers. In Sicily, a Coop director told Italian media that four of the group’s 300 stores were affected and the damage ran to several thousand euros per store.
The response has moved to the political level. Italy convened an emergency meeting of intelligence chiefs and the National Cybersecurity Agency, which issued technical advice for retailers. EU food and agriculture commissioner Christophe Hansen said the incidents are a deliberate attempt to disrupt Europe’s food supply chain and undermine consumer confidence in it.
The lesson for every European business
This is not a sophisticated supply chain compromise. It is unmanaged, internet connected operational technology doing exactly what it was designed to do, for someone else. Refrigeration units, building management systems, industrial controllers and IoT devices are all computers with credentials, and every connected device is an entry point that needs to be secured like any other IT system. Retailers with modern, patched and monitored systems largely escaped both waves, a point made by Italian retail representatives this week.
If your business runs connected devices that nobody owns in the security sense, now is the time to fix that. Contact the team at Excello Digital for a professional assessment of your internet facing systems and operational technology.