Retailers in several European countries have been forced to throw away food after refrigeration systems were disrupted, with reports of remotely changed temperature settings and activated defrost functions. The incidents turn a normally quiet part of store infrastructure into an immediate operational problem.
AFP reported on November 2 that grocery stores in at least seven countries were affected. Carrefour Belgium told the agency that about 15 stores had experienced disruption and that the problem had been resolved. Other retailers described more limited incidents; ICA told AFP it could not confirm a cyberattack as the cause of its stores’ problems.
A connected controller can affect physical stock
BleepingComputer’s reporting documented problems across multiple chains and independent shops, including stores in Sweden, Belgium, Luxembourg, Ireland and Estonia. Its account describes attackers changing settings or triggering defrost cycles, with stores losing refrigerated or frozen goods.
The reporting also points to an important distinction: some affected shops use independently operated refrigeration installations. A problem at those sites does not automatically mean that a retailer’s central corporate network has been breached.
The link between incidents is still unproven
A Dataminr assessment says similar interference occurred across several countries overnight on November 1–2. The researchers see internet-accessible control systems as a likely route in, but say the technology targeted in the latest incidents was still unclear. They also caution that there is insufficient evidence to attribute all the events to a single actor.
The latest reports follow refrigeration attacks in France during October. Similar timing and effects are useful investigative leads, but they are not enough to establish a shared operator or identical vulnerability.
The immediate question is remote access
Dataminr recommends identifying exposed control systems, restricting unnecessary internet access, applying patches, changing default credentials and watching remote authentication for unusual activity. For operators, the work starts with finding who can reach each controller and who is responsible for maintaining it.
The practical impact is already visible in discarded stock. The broader scope, entry points and responsibility still need to be established. This report draws on AFP, BleepingComputer and Dataminr’s analysis, all published November 2, 2026.
Image: AI-generated editorial illustration created for DaySec, not a photograph of the incident.
