As of November 8, 2026, supermarkets in seven European countries are still counting the cost of the night of 2 November, when networked refrigeration controllers were switched into forced defrost and freezer temperatures climbed as high as 50 degrees Celsius. Around 40 Delhaize stores in Belgium and Luxembourg were hit, alongside 15 Carrefour stores in Belgium, five Colruyt-operated Spar shops, 13 SuperValu stores in Ireland, seven of Coop's 800 Swedish outlets and a smaller number of ICA and Kesko sites. One Delhaize branch in Hoeilaart put its produce loss at EUR 100,000 before counting the cost of closing. For availability teams the incident is a reminder that write-off arithmetic and fill-rate arithmetic are the same calculation running in opposite directions.
What happened on the night of 2 November
The mechanics matter more than the temperature. Modern retail refrigeration runs on controllers that let a technician monitor and adjust hundreds of stores from a laptop, and the same remote access that makes maintenance cheap makes the setpoint reachable. Attackers did not need a new exploit: they triggered a function that normally runs for about two hours a day to clear ice and locked it on with the setpoint raised. The French wave targeted Danfoss AK-SM800 and AK-SC355 controllers, and the November incidents followed the same path.
The write-off arithmetic at store level
A chilled range lost overnight is not one loss but four. The product itself is the visible one. The labour to strip and clean the cabinets is the second. The sales that did not happen while the range was empty are the third, and they are usually understated because the store keeps trading. The fourth is the substitution effect: shoppers who cannot buy fresh buy something else or go elsewhere, and a share of them do not come back the same week.
| Case | Scale reported | Immediate loss | What it changes |
|---|---|---|---|
| Delhaize, Belgium and Luxembourg | About 40 stores | EUR 100,000 of produce at one branch | Full cold range reset, closure cost on top |
| Carrefour, Belgium | 15 stores | Not disclosed | Reopened with a reduced chilled range |
| Colruyt / Spar, Belgium | 5 stores | Not disclosed | Controller isolation, then manual checks |
| SuperValu, Ireland | 13 of 223 stores | Range withdrawn as a precaution | One controller model implicated |
| Coop, Sweden | 7 of 800 stores | Not disclosed | Contained within a day |
The reported figures are small against a national grocery market, which is exactly why they are worth reading carefully. A six-figure loss at a single branch is large enough to trigger an insurance claim and small enough to disappear inside a quarterly margin line. That asymmetry is the operational problem: the event is material at store level, immaterial at group level, so the fix has to be justified by something other than the write-off itself.
Why fill rate is the better argument
Fill rate makes the case that the write-off cannot. A store that loses its chilled range for a day also loses the trips that the range generates, and those trips carry the basket. Measured as on-shelf availability across the cold category, the incident looks like a category-wide stockout with a known cause and an unknown duration, which is the same shape as a supply failure and can be argued in the same language. Controllers, credentials and network segregation are then not an IT cost but an availability control, priced against the sales they protect rather than against the food they save.
Replenishment is the second loss
Restocking a cold range is harder than restocking an ambient one. Chilled and frozen supply runs on short lead times and tight temperature chains, and a store that dumps a full range needs product quickly from a network that was not planning for it. In the November incidents the constraint was not availability of goods but availability of safe cabinets: units had to be verified, and in some cases physically modified, before anything could be loaded back. That gap between having stock and being able to sell it is where the second loss accumulates.
The control layer becomes a commercial asset
Sabcobel's chief executive said the simplest fix is to manage fridges over a secure internet connection, and that most customers switched to that after the French attack; he also said the units need physical modifications, not only software updates. That sentence describes a capital decision hiding inside a security recommendation. For a chain, the question is which stores get the modification first, and the answer is the one availability teams already use for any scarce resource: rank stores by the sales a lost chilled day would destroy.
What availability teams should change
Three changes follow. First, treat controller exposure as an availability risk and map it to stores, so the ranking exists before an incident rather than after one. Second, rehearse the discard decision: who authorises a full range write-off at 3am, and what evidence is kept, because that record is what an insurer and a supplier will ask for. Third, measure the recovery rather than only the outage, since the days a store trades with a partial cold range are the days the customer notices.
The Belgian cyber security centre said all IT systems are potentially vulnerable, and the EU agriculture commissioner said the bloc is increasingly concerned. Both statements point the same way: the chilled cabinet has become a connected device, and a connected device that holds a week of margin is an availability asset with an attack surface attached.
FAQ
How did the attack actually work?
Attackers reached networked refrigeration controllers and switched the units into forced defrost with the setpoint raised to 50 degrees Celsius. The defrost function is a normal maintenance cycle; the attack locked it on rather than exploiting a new flaw.
Which retailers were affected?
Around 40 Delhaize stores in Belgium and Luxembourg, 15 Carrefour stores in Belgium, five Spar shops operated by Colruyt, 13 SuperValu stores in Ireland, seven Coop stores in Sweden and a smaller number of ICA and Kesko sites.
Why is fill rate a better argument than the write-off?
The write-off is material at store level and immaterial at group level. Fill rate connects the same event to the trips and baskets the chilled range generates, which is a number a finance team can price against a capital request.
What should a store do first when a cold range is compromised?
Disconnect the controller, verify cabinet temperature and authorise the discard with a documented record. That record is what insurers and suppliers ask for, and it is what makes the recovery measurable.
