Cyberattacks Disrupt Supermarket Refrigeration Across Europe and UK

Cyberattacks targeting internet-connected refrigeration systems have disrupted supermarkets and food businesses across Europe and the United Kingdom, damaging fresh produce and frozen goods. The incidents, which spread across multiple countries on Monday, November 2, 2026, have prompted cybersecurity authorities to investigate vulnerabilities in industrial cooling equipment and warn businesses about potential threats to food supplies.

The UK's National Cyber Security Centre (NCSC) confirmed that some domestic organizations had also been affected. Its chief executive, Dr Richard Horne, said the agency had worked overnight to notify potentially vulnerable businesses.

"a couple of instances where vulnerable technology had been exploited in the UK." the NCSC said.

Horne said investigators had not yet established who was responsible for the attacks.

"too early to say" Horne said.

The cyber incidents affected retailers in Belgium, Sweden, Luxembourg, Finland, Ireland, the Netherlands and Estonia. According to the BBC, around 40 Delhaize supermarkets in Belgium and Luxembourg experienced disruptions, alongside smaller numbers of stores in other affected countries.

The Guardian reported that affected businesses included Carrefour, Intermarché, IKEA, Coop, ICA, Delhaize, Kesko and SuperValu. Some refrigeration units reportedly had their temperatures remotely increased to 50C (122F), causing substantial quantities of food to become unsafe for sale.

The European Union condemned the incident as a threat to food distribution and public confidence.

"a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it" the EU said.

Belgian refrigeration manufacturer Sabcobel said some affected units had their evaporators switched into defrost mode, causing temperatures to rise. The same technique was suspected in an earlier October 12 incident involving French supermarkets.

Mathieu Tilman, who manages a Delhaize supermarket in Belgium, described the financial and human impact of discarded food.

"truly distressing" Tilman told the BBC.

He also expressed frustration about food waste amid continuing food insecurity.

"There's so many people starving, people who don't have enough to eat. How can we end up throwing away so much food?" Tilman said.

"In moments like these, you just feel like quitting your job." Tilman added.

The British Association of Independent Meat Suppliers (AIMS) also reported that some of its more than 300 members had become unintended victims of the incident.

"collateral" AIMS described the affected businesses as.

Tony Goodger, head of communications at AIMS, confirmed that affected members had not lost meat but warned that the incident highlighted risks throughout the food supply chain.

"None who have been affected have lost any meat but once again this must act as a reminder to all in the food industry at whatever point in the supply chain they are that their businesses may be see by some as targets," Goodger said. "We urge our members and the wider industry to vigilant."

Graham Wynn, assistant director of regulatory affairs at the British Retail Consortium, said UK retailers were coordinating with national cybersecurity authorities.

"Retailers invest heavily in their cybersecurity and are currently working with the NCSC to ensure their fridges and freezers are secure as possible against potential attacks," Wynn said.

Earlier incidents provide additional context for the latest wave. In August, suspicious refrigeration failures affected commissaries at at least six US military bases, prompting a Pentagon investigation. French retailers also experienced widespread refrigeration disruptions in October.

Rafe Pilling, senior director for threat intelligence at Sophos, identified two possible explanations for the European incidents: a state-linked demonstration of cyber capabilities or an individual acting independently.

"The two most plausible attribution scenarios for me are some kind of state-based signalling and demonstration of capability or some kind of lone-wolf hacker that is conducting these attacks for their own personal reasons," Pilling said.

He also explained that the relatively straightforward nature of the intrusion could make identifying its perpetrators particularly difficult.

"wearing rubber gloves and messing with the switches" Pilling said, describing the apparent simplicity of the attack.

Nick Jackson, director of cyber-operations at Bitdefender, said outdated refrigeration software and delayed security updates could leave businesses exposed.

"don't think about that and it's not top of their agenda" Jackson said, describing how refrigeration operators might overlook cybersecurity maintenance.

Daniel dos Santos, vice president of research, said the available exposure data did not place the UK among the countries facing the highest immediate risk.

"I wouldn't say it's super-high right now for the UK specifically" dos Santos said.

The National Cyber Security Centre said it was cooperating internationally to assess the incidents. British cybersecurity officials have also warned that outdated equipment, insufficient network separation and unmaintained software create opportunities for attackers.

Dr Richard Horne highlighted the broader problem of inadequate investment in essential digital infrastructure.

"That technology base we rely on as a society has not been invested on to the extent it needs to be," Horne said.

He warned that artificial intelligence could make it easier for hostile actors to identify and exploit weaknesses in vulnerable systems.

"AI in the hands of our adversaries" Horne said, describing an emerging cybersecurity concern.

Horne also called on organizations to take responsibility for securing the technology supporting their operations.

"We do need all organisations to look at what they rely on, to invest in renewal," Horne said. "We intervene where we can. But, at the end of the day, it's your business.

It's your charity. It's your life. You need to make the choice and choose wisely."

Cybersecurity specialists have also documented earlier attacks against refrigeration infrastructure in Israel. Omri Segev Moyal, head of Israeli incident response company Profero, described a May attack on a food production facility that damaged industrial freezers, destroyed compressors and halted operations for more than a week.

"I do a lot of cyber incidents, but this is the kind of incident that I know will leave a mark on the people in charge," Moyal said.

Moyal attributed that incident to Iranian military hackers operating under the name Cyber Isnaad Front, citing forensic evidence and claims made by the attackers. The group has also been associated with influence operations targeting US elections in 2024.

The attackers reportedly manipulated industrial controllers, altered safety settings, opened gas pressure valves, changed access credentials and disabled warning systems. Moyal described the resulting equipment damage.

"eliminated," Moyal said, referring to the damaged compressors.

He explained that the machinery had suffered severe physical damage rather than an explosive attack.

"They were blown up … not like C4 exploding, but they got overused and there was smoke. They were not repairable." Moyal said.

Moyal also described how rapidly the attackers appeared to understand the refrigeration system's configuration.

"What we were able to see is they very rapidly were able to, almost like magic, go from initially playing with the system to fully understanding how the configuration works," Moyal said.

He said the attackers tested numerous configurations before causing the compressor failures.

"They tried the simple things … and then they started to bombard the system with different types of configurations until they destroyed the compressor. It wasn't human, the amount of configurations they were able to try in a short time span." Moyal said.

Josh Corman, a former cybersecurity official at the Cybersecurity and Infrastructure Security Agency, warned that connecting industrial equipment to the internet creates additional risks for critical infrastructure.

"With great connectivity comes great responsibility," Corman said.

He emphasized that refrigeration equipment is increasingly exposed to both technical failures and deliberate interference when connected to external networks.

"As we connect industrial refrigeration to the Internet, we expose it to accidents and adversaries," Corman said.

He also warned that similar vulnerabilities could affect other temperature-sensitive sectors.

"temperature sensitive drugs and laboratory materials." Corman said.

For businesses, the immediate priority remains updating vulnerable software, securing remote access and separating essential industrial systems from exposed internet connections.