As of November 5, 2026, retailers in at least nine European countries have reported that refrigeration controllers were manipulated overnight on 2 November, pushing freezer setpoints towards 50 degrees Celsius and forcing stores to withdraw chilled and frozen stock from sale. The wave repeats a campaign that Paris prosecutors said hit about 700 French supermarkets in October, and for grocery operators it lands on the least visible part of the operation: whether a shelf can be trusted to be stocked, and whether anyone can prove it afterwards.
What happened between 2 and 9 November
The first confirmed accounts came from Ireland, where Musgrave said refrigeration at 13 of its 223 SuperValu stores was affected and limited to one model of equipment, with chilled and frozen products pulled from sale as a precaution. On the same day, Carrefour told ABC News that 15 of its 700 Belgian stores were affected and that all stores remained open, because the incident concerned only a few refrigeration units, mainly freezers. Delhaize described its own disruption as an IT incident and said its distribution centres and deliveries were not hit.
By 3 November the count had widened. Belgian media tallies put at least 76 retail outlets with refrigeration problems on the Monday, the Dutch broadcaster NOS reported 17 facilities using one supplier's controllers, and an Estonian chain confirmed a setpoint change that its technology supplier said was corrected within about ten minutes. Swedish grocers ICA and Coop both reported overnight incidents, and Coop put the share at seven of more than 800 stores while other accounts said six, a discrepancy that matters when the purpose is to size the exposure.
Nine countries, seven chains, one class of controller
| Market | Chain | Stores reported affected |
|---|---|---|
| Belgium | Carrefour | 15 of 700 |
| Belgium and Luxembourg | Delhaize | Several dozen |
| Ireland | SuperValu | 13 of 223 |
| Sweden | Coop | Six to seven of more than 800 |
| Netherlands | Sites using one supplier's controllers | 17 |
| France, October wave | Multiple chains | About 700 |
The common thread is not the retailer but the equipment. Cyber Insider reported that the affected systems regulate compressors, defrost cycles and temperature setpoints, and that remote administration exists so specialist contractors can monitor dispersed shops without driving to each one. The same design that makes maintenance cheap makes a setpoint reachable, and the October French case points to controllers whose web interfaces were reachable over the public internet.
That explains why the incidents cluster by supplier rather than by banner. A single contractor can serve hundreds of sites across several countries, so one exposed management interface can carry instructions to equipment in more than one market. It also explains why the affected chains kept trading: the attacker changed a setting, not a payment system, and a store can keep selling ambient goods while its freezers are emptied and repaired.
Why spoilage becomes a stockout, not just a write-off
The write-off is the smaller cost
A destroyed pallet has a known value and an insurance line. What is harder to book is the availability gap that follows, because the replacement stock has to travel through a chilled chain that is already loaded in the first week of November. A store that loses a day of frozen stock may restore facings within one delivery cycle, but a category with a longer cycle will show empty space for several days, and empty space is what a shopper remembers when she chooses where to buy next week.
Availability losses outlive the repair
There is a second effect that rarely appears in incident reports. Once stock is withdrawn, the store's own records and the platform's records disagree until the next stock count, because the same SKU is simultaneously unsaleable on shelf and still counted as inventory. Online orders placed against that inventory will be cancelled or substituted, and the cancellation rate is the number that reaches a marketplace scorecard. Availability monitoring has to treat the withdrawal as a stock event, not as an accounting entry.
For a network, the exposure is therefore measured in three layers: units destroyed, days of empty facing, and orders that could not be fulfilled. Only the first is usually reported. The second and third decide whether a customer experiences the incident at all, and they are the layers an operator can actually control, by re-routing the next delivery and by switching off online sale for the affected SKUs before the orders arrive.
The distribution centre that home delivery depends on
Axfood said freezers at a distribution centre near Gothenburg that handles home deliveries of groceries were compromised, which is a materially different risk from a store-level incident. A shop can substitute from its back room and keep trading; a delivery centre that cannot hold frozen stock has nothing to pick, so the failure reaches households that never entered a store. The distinction matters because grocery e-commerce in northern Europe is built on exactly this kind of node.
It also changes who owns the response. A store incident is handled by a duty manager with a thermometer and a disposal sheet; a distribution centre incident is handled by logistics, food safety and customer service at once, because the orders already promised have to be cancelled, moved or refunded within hours. Networks that rehearse the first scenario rarely rehearse the second, even though the second is the one that generates public complaints.
What a store can verify in the first 24 hours
The practical checklist is short and does not depend on knowing who attacked. Establish which SKUs exceeded their safe temperature and for how long, decide disposition per SKU with a named owner, then reconcile that decision against what the online channel is still promising. The reconciliation is the step most often skipped, and it is the one that prevents a bad day from becoming a service failure.
The second day is about the chain. The Dutch national cyber security centre advised businesses operating refrigeration systems to contact their equipment suppliers, update vulnerable systems, stop direct internet access to controllers, restrict remote access to trusted addresses and use strong passwords. Those are supplier and facilities actions rather than store actions, which is precisely why a store-level checklist alone cannot close the exposure. A network needs one owner for the installed base, and that owner needs a list of every controller and every contractor who can reach it.
FAQ
Did the attacks stop trading in the affected stores?
In most reported cases, no. Carrefour said all of its stores stayed open because the incident concerned only a few refrigeration units, mainly freezers, and SuperValu said it removed chilled and frozen products from sale as a precaution while other products remained available. The disruption therefore shows up as gaps in specific categories rather than as a closure, which is harder to see from the outside and easier to miss in a sales report.
Why does a temperature excursion create a stockout rather than only a write-off?
Because the stock that is destroyed has to be replaced through the same chilled supply chain that is already running close to capacity in early November. A store that loses a day of frozen stock can refill from the next delivery, but a store that loses stock in a category with a two-day replenishment cycle will show empty facings for at least that long. The write-off is a one-off cost; the availability gap repeats until the chain catches up.
What does a distribution centre failure change?
Axfood said freezers at a distribution centre near Gothenburg that handles home deliveries of groceries were compromised, which is a different risk from a store-level incident. A store can substitute from its own back room; a delivery centre that cannot hold frozen stock has nothing to pick, so the failure reaches customers who never entered a shop. Operators that treat cold chain as a store problem will under-count this exposure.
Which single control would have prevented most of these incidents?
Taking the refrigeration controller off the public internet and restricting remote access to named addresses, which is what the Dutch national cyber security centre advised businesses to do after the 2 November incidents. That control does not depend on the controller manufacturer or on a patch cycle, and it closes the route that let an outside party change a setpoint without ever entering the store.
