"We can't have anything worse in our line of work," said Diego Louwers, a Proxy Delhaize store manager in Overijse, after attackers remotely switched refrigeration units into defrost and raised temperatures to highs of 50ºC (122°F).
Delhaize: around 40 stores forced to discard fresh and frozen stock
Belgium’s Delhaize reported that about 40 of its stores were hit when attackers reportedly switched fridges and freezers into defrost mode overnight, between Sunday and Monday. A Delhaize spokesperson said, "On Monday, 2 November, we identified an IT incident affecting the refrigeration systems in several dozen of our stores." The company said it "immediately took the necessary measures to keep our stores operational and ensure that our customers can continue to do their shopping as usual," while acknowledging that in affected locations "the range of fresh and frozen products is temporarily somewhat limited."
Store manager Diego Louwers described the consequences as "catastrophic," saying his store had to throw out the entirety of its fresh and frozen products and that the loss was "both heartbreaking and very complicated operationally." Delhaize added that its distribution centres were operating normally and deliveries to stores had not been disrupted.
ICA and Coop in Sweden: local stores outside central networks hit, some freezers at 55°C
Swedish grocery chain ICA confirmed attacks on a "small number of stores" operating outside ICA’s central network. An ICA spokesperson said the incident "impacted the stores’ refrigeration and freezer systems" and that the company was "supporting the affected stores in managing the situation." ICA did not disclose the scale of food wastage or when normal operations would resume.
One affected outlet, ICA Nära in Böda on Öland, posted on social media: "Unfortunately, we are one of the stores whose refrigerators and freezers have been hacked. We are open as usual, but unfortunately we have no refrigerators and freezers to sell." Store manager Mats Olsson told SVT he found a puddle of water and freezers set to 55 degrees C when he arrived on Monday morning—conditions echoed by other managers around the country. Coop also reported six locations in central Sweden experiencing fridge-freezer issues.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleBelgian, Irish and other European retailers report losses: Carrefour, Intermarché, SuperValue and more
Belgian outlets beyond Delhaize were affected as well: around 15 Carrefour stores, Intermarché, Spar, and Shop & Go stores located at Q8 service stations reported refrigeration problems. Belgium’s De Laet & Van Haver chain of butcher shops said it saw temperature rises in its appliances but later stated there was no impact on its produce and that all stores remained open.
In Ireland, parent company Musgrave told RTE that at least 13 SuperValue stores were affected and that fresh and frozen food had been thrown out. Across these incidents, companies declined to attribute the intrusions; none of the firms that spoke to The Register answered questions about who was behind the attacks.
Danfoss controllers and the October French incidents: a technical thread, but no confirmed link
The fresh wave of disruptions comes less than a month after mid-October attacks in France forced retailers including Carrefour, Coopérative U, Intermarché and Monoprix to discard large quantities of produce after appliances were remotely defrosted. At least some of the French stores were running outdated firmware on Danfoss refrigeration controllers, and CERT-FR published an alert related to compromises of Danfoss AK-SM and AK-SC controllers.
However, the register cautioned that it remains unclear whether the latest attacks across Belgium, Ireland, Luxembourg and Sweden used the same methods as those that disrupted French retailers in October. Some French retailers impacted in October confirmed they were not Danfoss customers, underscoring a mixed technical picture.
What this means for technologists, affected retailers, and the public
- Technologists and security teams: will be watching controller firmware and alerts such as CERT-FR’s notification on Danfoss AK-SM and AK-SC compromises, and will need to determine whether the intrusion vectors seen in October reappeared in these November incidents.
- Affected retailers and procurement leaders: must manage immediate spoilage, maintain supply from distribution centres (Delhaize said its centres were operating normally), and assess whether operational systems such as refrigeration controllers run outdated firmware or are exposed to remote manipulation.
- End users and local communities: face temporary limits on fresh and frozen products in affected stores; some stores remain open but without refrigerated items (ICA Nära Böda reported open trading "but unfortunately we have no refrigerators and freezers to sell").
Across multiple countries, the record is clear about impact—widespread spoilage, emptied frozen aisles, and retail chains scrambling to restock—but murky on attribution and technical commonality. Retailers and national response teams have acknowledged incidents and the presence of prior alerts (CERT-FR on Danfoss controllers), yet it "remains unclear" whether the new incidents used the same methods as the October attacks in France. The practical consequence for shoppers is immediate and visible: some stores are open but unable to sell frozen and fresh goods, while retailers sort losses and check controls that keep cold chains cold.
Read the original report: https://www.theregister.com/cyber-crime/2026/11/02/frozen-part-ii-hackers-remotely-defrost-produce-in-euro-supermarkets-again/5306924
