Key takeaway: On November 2, 2026, suspected hackers took over refrigeration controls at supermarkets in at least nine European countries. They warmed fridges and freezers overnight, forcing stores to throw away food. This came three weeks after a similar attack on hundreds of French supermarkets. Beyond the security story, the incidents show a growing climate and ESG risk: when cold chains fail, the emissions already spent producing that food are wasted, and companies need to plan and disclose for that.
What happened on November 2
According to AFP, supermarkets in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden reported refrigeration problems after temperatures rose overnight. Some retailers had to discard stock. No one has claimed responsibility for this attack or for the earlier one in France.
| Country | Reported impact (AFP unless noted) |
|---|---|
| Belgium | Dozens of stores across several chains. Carrefour Belgium reported disruption at about 15 of its 700 stores, and Delhaize, Colruyt and Intermarché also had problems. IKEA said freezers at its Mons store warmed up. Federal prosecutors opened an investigation. |
| Luxembourg | Four Delhaize stores. |
| Ireland | Musgrave reported a cyber incident at 13 SuperValu stores. |
| Portugal | Seven Intermarché stores, linked to an external refrigeration service provider. |
| Sweden | Six of Coop’s roughly 800 stores. Ica reported a limited number of stores affected. |
| Italy | At least four Coop supermarkets in Sicily (hit at 4 a.m., per ANSA) and one business in Tuscany. |
| Finland, Estonia, Netherlands | Irregular temperatures at some smaller stores. In Estonia, ERR reported fridge units raised to 50°C. |
A second wave after France
In mid-October, attackers took over cooling units at hundreds of French supermarkets. Stock spoiled, and some stores reported fires (Reuters; AFP). Investigators had not identified the attackers when the November wave hit. EU food and agriculture commissioner Christophe Hansen called the incidents “a deliberate attempt to disrupt our food supply chain.” Italy convened a cybersecurity meeting with its intelligence services.
Why are supermarket fridges connected to the internet?
A modern store runs dozens of chillers and freezers from a central controller. Refrigeration contractors monitor these remotely so they can spot faults, adjust temperatures and cut energy use without visiting each store. Researchers cited by Euronews found nearly 13,000 refrigeration controls reachable on the open internet across 99 countries, at sites ranging from supermarkets to hospitals and farms.
The details reported so far point to old equipment and outsourced access as the weak spots:
- Coop Sweden said the affected stores were connected over an older 4G link rather than its updated 5G system, which made them “more exposed.”
- Ica said its affected stores used an external refrigeration control system from Danfoss, the supplier involved in the French incident. Danfoss had not commented when AFP published.
- Belgian refrigeration firm Sabcobel said it had started securing installations after the French attack, but some systems had not yet been upgraded.
The climate cost of a cyberattack
When frozen food spoils, the loss goes well beyond the price on the shelf. Every discarded product carries the emissions already spent on farming, processing, packaging and transport. Restocking then uses more energy and logistics, and failing refrigeration systems can leak refrigerants, many of which are powerful greenhouse gases. No one has yet published an estimate of the food lost or the emissions involved in these incidents, so we do not give a figure here.
For companies reporting under sustainability rules, this is a real operational and supply-chain risk:
- IFRS S2 / ISSB: climate-related risks that could disrupt operations and value chains belong in risk management and scenario disclosures.
- CSRD / ESRS E1: food loss, refrigerant leaks and energy use feed into Scope 1 and Scope 3 reporting.
- California SB 253: Scope 1 and 2 reporting from 2026 and Scope 3 from 2027 apply to companies with more than $1 billion in revenue that do business in California.
Our audit-ready Scope 1-2-3 GHG inventory checklist covers refrigerant leaks and cold-chain energy. The SB 253 and SB 261 compliance guide explains the reporting timelines, and our LCA guide shows how to quantify the embodied emissions in food products.
Five practical steps for grocers and cold-chain operators
- Take refrigeration controllers off the open internet. Allow remote access only through a VPN or a vendor gateway.
- Require multi-factor login for every contractor, and review who holds remote access.
- Patch or replace legacy controllers and old mobile links. Ask your refrigeration vendor for its security update status.
- Add independent local temperature alarms that do not depend on the networked controller.
- Prepare a stock-loss plan: who decides what to discard, how losses are documented for insurers, and how the event is recorded for ESG reporting.
These are general good practices that national cyber agencies recommend for internet-connected operational technology. They are not specific to any vendor.
See it in 60 seconds: Supermarket Fridge Cyberattacks web story.
Sources
- AFP, “Fridge cyberattack hits supermarkets across Europe,” Nov 3, 2026. afp.com
- Reuters, “Investigators hunt French supermarket fridge hackers, no claim of responsibility,” Oct 13, 2026.
- Euronews, “Supermarket hacks across Europe: why are fridges connected to the internet?”, Nov 2026.
- ANSA (Italy) and ERR (Estonia), as cited by AFP.
This is a developing story. Details reflect reporting as of November 3, 2026.