By Noah CarterA coordinated wave of supermarket refrigeration cyberattacks has disrupted grocery stores across Belgium, Ireland, Luxembourg, and Sweden, forcing retailers to discard tons of spoiled perishable food. Attackers exploited vulnerable internet-connected cooling controllers to switch commercial evaporators into defrost mode, underscoring the growing physical risks facing unpatched industrial operational technology systems.
Retail operators confirmed between November 2 and November 3, 2026, that dozens of grocery locations experienced sudden, unauthorized temperature spikes inside their cold storage rooms and chilled display units. Affected retailers included roughly 40 Ahold Delhaize stores across Belgium and Luxembourg, 15 Belgian Carrefour locations, five Colruyt Group Spar shops, 13 SuperValu supermarkets operated by Musgrave in Ireland, and seven Coop stores in Sweden. In several instances, remote intruders altered thermal setpoints or triggered continuous defrost cycles that pushed internal cabinet temperatures up to 50 degrees Celsius.
This second wave of Technology disruptions follows an earlier October 2026 campaign that struck hundreds of supermarkets across France. Because European food safety regulations require strict cold-chain continuity for meat, fish, dairy, and chilled produce, affected stores had to empty compromised display cases and dispose of entire perishable inventories even when technicians restored cooling controls within hours. Additional isolated incidents were also investigated by retail refrigeration maintenance providers in the Netherlands, Finland, and Estonia.
How Exposed Cooling Controllers Enabled Remote Sabotage
Technical investigations into the supermarket refrigeration cyberattacks point to internet-facing industrial controllers used to manage commercial heating, ventilation, and cooling equipment. Specifically, many affected grocery locations relied on legacy Danfoss AK-SM 800A series system managers that had reached end-of-life status and no longer received automated firmware security patches. When third-party maintenance contractors connected these controllers directly to the public internet without virtual private networks or strict firewall rules, automated scanning tools could easily locate and compromise them.
Industrial cybersecurity researchers at Claroty had previously warned in August 2026 that thousands of refrigeration management interfaces remained exposed online with known authentication vulnerabilities. Once attackers gain administrative access to a store’s cooling controller, they can override compressor schedules, silence high-temperature alarms, and force heating elements to stay active overnight. Unlike traditional ransomware campaigns that encrypt back-office accounting servers, manipulating physical environmental controls causes immediate financial loss through ruined merchandise, temporary store closures, and emergency technician dispatches.
Securing Operational Technology in Retail Supply Chains
The cross-border incidents highlight a persistent governance gap between corporate information technology security teams and physical facility management contractors. Retail chains frequently outsource refrigeration monitoring to regional heating and cooling vendors who rely on open remote access ports to diagnose compressor faults and optimize store energy consumption. When legacy hardware reaches the end of its vendor support lifecycle, retail executives are often unaware that their store cooling infrastructure remains directly reachable from external networks.
Cybersecurity specialists recommend that grocery retailers immediately audit and isolate refrigeration and building management networks from public internet exposure. Implementing zero-trust remote access gateways, enforcing multifactor authentication for third-party maintenance technicians, segmenting store local area networks, and replacing end-of-life programmable logic controllers can prevent automated exploitation. As physical retail infrastructure becomes increasingly digitized, protecting cold-chain operational technology is now a vital component of food security and commercial resilience.
