Cooling failures spoil food across six European countries as cyberattack suspected

The disruption unfolded overnight into November 2, affecting retailers in Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia. Several businesses and suppliers describe malicious interference with cooling controls. Sabcobel, which operates Delhaize’s refrigeration systems and manufactures some affected equipment, calls its incident a cyberattack. But a single operation connecting all six countries has not been demonstrated.⁠1⁠2

The physical damage is more firmly established than the digital explanation. Food has been removed from sale, workers face the cleanup, and some shops have closed temporarily. Others have stayed open or reopened. There is still no complete account of the lost stock, no confirmed restoration timetable for every affected site and no identified attacker.⁠1⁠2

The Hoeilaart estimate came from the branch’s manager, speaking to Belgian news outlet Het Laatste Nieuws, according to the BBC. It covers discarded produce at one store in Belgium’s Flanders region, not an audited national loss. Local-media reports put wider food losses in the millions of euros, but no reliable combined total or tonnage has been established. The branch estimate cannot simply be added to those broader claims: the same losses may already be included.⁠1

Around 40 Delhaize supermarkets were affected across Belgium and Luxembourg combined—not 40 in each country. Carrefour reported disruption at 15 Belgian stores and said immediate measures kept all its shops open. Colruyt Group, which operates Belgian Spar stores through franchises, said five shops had their refrigeration systems attacked. These are retailer-specific accounts, not a reconciled census of every affected premises.⁠1

In the Netherlands, the reported victims included butchers and small neighbourhood shops. A Danfoss spokesperson told Dutch broadcaster NOS that refrigeration and freezer temperatures had been altered overnight at at least 17 businesses. That is a count of businesses, not 17 supermarket branches. It also shows why the consequences extend beyond the largest grocery chains.⁠6

Ireland’s SuperValu reported affected refrigeration systems at 13 supermarkets. Owner Musgrave Group described a cyber incident limited to a “specific model” of refrigerator. That qualification matters: it does not mean every cooling unit at those stores failed, or that the entire SuperValu estate was affected. No verified Irish loss total or complete restoration time has been established.⁠1

The cost is therefore not just whatever food was inside a failed freezer. A shop can also lose trading time while staff remove stock and restore operations. The Hoeilaart manager’s estimate captures that distinction plainly: the food bill was already substantial, and the closure was a further loss.

In Sjöbo, southern Sweden, an ICA branch said someone had set its refrigerators and freezers to 50°C, equivalent to 122°F. That is an account of a changed controller setting—not proof that the cabinets or their contents actually reached that temperature. The branch closed earlier and subsequently reopened. ICA said the incident affected a small number of stores operating outside its central network and that it was supporting them. It did not report a compromise of the central network itself.⁠1

Another branch, ICA Baronen in Stockholm, posted a notice saying all its freezers were broken because of a cyberattack. Its sales manager placed the incident at 2 a.m. local time and discovery at 5:30 a.m. Those times describe one store’s experience, not a confirmed start and detection time for the wider European disruption.⁠2

The reported Swedish Coop count rose between accounts published on November 2: The Independent’s earlier report carried six affected stores; the BBC’s later account put the number at seven out of 800. The later figure supersedes the earlier count, although the reason for the change has not been explained. Coop told the BBC the situation was “currently contained and under control”—a narrower claim than confirmation that every cabinet was back in service and all discarded stock replaced.⁠2⁠1

Estonian broadcaster ERR identified a Selver supermarket as affected. Supplier Kitman Coldtech also described an affected supermarket-chain client and settings changed to +50°C, without naming the chain in that account. Those reports do not establish two separate victims, and the setting again should not be mistaken for a measured food temperature.⁠21⁠2

The most specific explanation of how cooling was interrupted comes from Sabcobel. It said evaporators—the parts of the refrigeration system that help provide cooling—were switched into defrost mode, causing units to warm. Chief executive Stephan Moelans told Belga that this was a cyberattack and described an active effort to isolate equipment.⁠1

Moelans said protection work had begun after the earlier French attacks and that affected units needed physical modifications, not software changes alone. He recommended managing refrigerators over a secure internet connection and said most Sabcobel customers had switched after France. Those are the supplier’s account of its response and its recommended protection—not evidence that every vulnerable unit had been modified or that the remaining exposure had been eliminated.⁠1

On October 14, we reported that hundreds of French supermarkets had discarded fresh and frozen food after attackers remotely manipulated refrigeration controls. The November defrost-mode account resembles that earlier mechanism. What has changed is the reported geographic reach of cooling disruption; what has not emerged is forensic evidence connecting the French attacks to all of these new incidents.

Ahold Delhaize also reported suspicious activity in its infrastructure to police in October. No demonstrated connection links that activity to the November cooling failures. Similar timing and effects across retailers are grounds for investigation, not proof of one perpetrator, one compromised platform or one route into the equipment.⁠2

Belgium’s and Sweden’s national cybersecurity agencies are monitoring the incident. The UK’s National Cyber Security Centre said it was working with international partners and industry to understand what happened; no affected UK incidents had been reported. Those responses do not establish a common cause across the six countries.⁠1

For retailers, the test is now practical as well as forensic: reliable cooling, replacement stock and no repeat interruption. Reopening a door or disconnecting a controller is progress. It is not yet a final account of either the food lost or the failure secured.