As of November 9, 2026, public information shows that a wave of attacks on commercial refrigeration systems hit supermarkets across at least seven European countries in the early hours of 2 November, switching evaporators into defrost mode and pushing cabinet temperatures as high as 50°C. Retailers in Belgium, Luxembourg, the Netherlands, Sweden, Ireland, Estonia and Finland reported incidents, with more than 115 stores confirmed affected in the first two days. Ahold Delhaize counted roughly 40 stores in Belgium plus four in Luxembourg, Carrefour Belgium reported about 15 of its 700 stores, Colruyt said around five independently run Spar shops were hit, Intermarché Belgium reported about 15, Musgrave confirmed 13 SuperValu stores in Ireland, Coop Sweden confirmed seven of more than 800 stores, and IKEA's Mons store in Belgium was affected. For teams that manage on-shelf availability, the lesson is not about cyber security budgets. It is that availability can collapse overnight for reasons that never appear in a stock file.
What the incident log actually shows
The mechanics matter for availability planning. Defrost is a normal function: a controller periodically warms the evaporator to clear ice. Attackers abused that legitimate function rather than exploiting a novel flaw, which means conventional monitoring could not flag it as malicious. Alarms only fired once temperatures crossed thresholds, by which time chilled and frozen stock had already been compromised. Staff arriving for the morning shift found cabinets empty of safe product, not systems showing an intrusion.
Why the loss rate stayed low at some chains
The spread of damage was uneven, and the pattern is informative. Carrefour's 15 affected stores represent about 2.1% of its 700-plus estate; Coop's seven stores are under 1% of 800. Sabcobel said it knew of around 20 affected units out of the hundreds it manages in Belgium. A breach of central retail IT would plausibly reach every store at once. A footprint this thin and this scattered is consistent with attackers working through individual internet-exposed controllers rather than a chain-wide intrusion. For availability teams, that distinction changes the contingency plan: the risk is not one catastrophic event but many small, simultaneous local outages.
The supplier layer is the blind spot
Two of the affected sites were not attacked directly. France's blood service EFS said its refrigeration supplier was the target, and a Swedish online grocery warehouse was reached through an external refrigeration contractor. This is the part of the estate that rarely appears in a retailer's own availability dashboard. Third-party cold storage, delivery-route chillers and contractor-managed cabinets sit outside the core network, often on separate connectivity with default credentials. When they fail, the stock file still shows units as available.
Where availability breaks first
Availability failures of this kind follow a predictable sequence, and each stage has a different owner, which is why incidents tend to stall between teams rather than inside one. In most post-incident reviews, the temperature excursion is caught quickly and the withdrawal takes hours, while the online delisting and the lost-sales reconciliation drag on for weeks. The table below maps that sequence to observable signals so that monitoring can be assigned to a named owner instead of being assumed to sit with whoever notices first.
| Stage | What happens | Observable signal | Owner |
|---|---|---|---|
| Temperature excursion | Defrost runs continuously, cabinet warms | Controller alarm, sensor trend | Store operations |
| Product withdrawal | Chilled and frozen lines pulled from sale | Manual delisting count | Category management |
| Shelf gap | Facing empty, substitutes pulled forward | On-shelf availability audit | Store operations |
| Online delisting | E-commerce shows out of stock or hidden SKU | SKU coverage by postcode | Digital trading |
| Lost sales | Demand shifts to competitors | Basket substitution rate | Commercial finance |
Most retailers detect the first stage and react to the second. The third and fourth stages are where the customer experience is actually decided, and they are usually measured weekly rather than daily. During a multi-store incident, weekly measurement is too slow: by the time the audit lands, the shelves have been empty for days and the online assortment has already been trimmed.
Designing an availability check that survives an outage
Availability monitoring is usually built for steady state, where one store at a time is the exception. It needs to keep working when several stores lose stock in the same night, which means separating the data sources rather than trusting a single system to describe both what is in the building and what a shopper can see. The four sources below are cheap to run in parallel and each fails differently, which is the point: a divergence between them is more informative than any single reading.
| Data source | What it proves | Refresh | Blind spot |
|---|---|---|---|
| Stock file | What the system believes is on hand | Hourly | Cannot see withdrawn or spoiled stock |
| POS feed | What actually sold | Near real time | Silent when nothing sells |
| Shelf audit | What a shopper can see | Daily to weekly | Sampling error in small stores |
| E-commerce listing | What is orderable by postcode | Real time | Reflects listing rules, not shelf truth |
The useful discipline is to compare at least two sources every day and treat divergence as a signal, not an error. When the stock file says 40 units and the shelf audit finds none, the gap is either shrinkage, spoilage or a listing mistake, and all three matter commercially. Building that comparison before an incident is cheaper than reconstructing it afterwards.
What to change after this month
The practical response is not a security project handed to IT and closed at the next audit. It is a set of availability routines that assume local outages will happen without warning, at several sites at once, and at the worst possible hour. The five actions below are deliberately operational rather than technical, because the technical fix protects the controller while these protect the shelf, the listing and the margin that depends on both.
FAQ
Why does a refrigeration attack matter to availability teams?
Because the failure mode is invisible in stock data. Cabinets warm, product is withdrawn, and the stock file still shows units on hand. Availability collapses without any system reporting a shortage.
Is this an IT security problem rather than an operations one?
It is both. The entry point is technical, but the customer impact is availability. Operations owns the shelf, the listing and the substitution rules, which is where the loss is actually realised.
How quickly should online assortment react?
Within the same day. If e-commerce keeps selling a delisted line, orders fail at picking and the cost moves from lost sales to service recovery.
What is the single most useful control?
A daily comparison between the stock file and a shelf audit. Divergence between the two catches spoilage, shrinkage and listing errors before they become lost sales.
