Overnight on Sunday, 1–2 November 2026, hackers remotely took control of refrigeration systems in supermarkets across at least six European countries — Sweden, Belgium, Luxembourg, Ireland, Finland, Estonia and the Netherlands — and cranked the temperature of fridges and freezers up to around 50–55°C, in some cases as high as 80°C.
The food inside spoiled. Stores had to throw it away. And no UK supermarket has been hit yet — but the same connected equipment sits in British shops, food producers and cold stores. If your business uses any connected device, this story is about you.
1. What happened on Sunday night
Overnight on Sunday, 1–2 November 2026, hackers remotely took control of refrigeration systems in supermarkets across at least six European countries — Sweden, Belgium, Luxembourg, Ireland, Finland, Estonia and the Netherlands — and raised the temperature of fridges and freezers to around 50–55°C, in some cases as high as 80°C.
The food inside spoiled. Stores had to throw it away.
The chains affected include ICA and Coop in Sweden, around 40 Ahold Delhaize supermarkets in Belgium and Luxembourg, Carrefour, Intermarché and Spar stores in Belgium, 13 SuperValu stores in Ireland, Kesko in Finland, and shops in Estonia. In Ireland, the owner of SuperValu, Musgrave, said its monitoring systems raised the alert and it took “immediate action”. In Belgium, Delhaize confirmed an overnight “IT incident” and Carrefour confirmed the cause as a cyber attack.
This was not a data breach. Nobody’s customer list was stolen and no ransom demand has been reported. The attackers went after the physical equipment that keeps food cold — and they did it from a distance, through the internet.
2. This was the second wave — France was hit three weeks earlier
The November attack was a repeat of an incident on the night of 11–12 October 2026, when refrigeration controllers at hundreds of French supermarkets were remotely told to start a defrost cycle — with the food still inside.
The French stores included Carrefour, Intermarché, Netto, Coopérative U and Monoprix. Food worth millions of euros was spoiled. The controllers in that attack were supplied by Danish engineering company Danfoss, which also supplies refrigeration equipment to British chains including Tesco and Sainsbury’s.
After the French attack, some refrigeration suppliers and retailers started patching their systems. According to the Belgian refrigeration group Sabcobel, that patching is one reason Monday’s attack was not far worse than it was.
The pattern matters more than any single incident. The same method, the same type of equipment, three weeks apart, in a different set of countries. Whoever is behind this has a working playbook — and they are using it again.
3. How the hackers got in
The attackers did not break into a supermarket’s head office or steal an employee’s password to reach the tills. They reached the refrigeration controllers themselves.
Many modern refrigeration systems are managed remotely. A controller in a store talks to a supplier’s or retailer’s management platform over the internet, so temperatures can be monitored and adjusted without sending an engineer. That convenience is also the opening: researchers say large numbers of these systems are exposed on the public internet, and attackers who find them can issue commands — including the command to raise the temperature or trigger a defrost.
No politically motivated group has claimed responsibility, and no ransomware gang has tried to use the vulnerability to demand payment. The European Union condemned the attacks as “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”.
That is the part business owners should sit with. The motive here looks like disruption, not theft. A business does not have to hold valuable data to be a target — it only has to depend on something connected.
4. Why the UK is on alert even though no supermarket was hit
No UK supermarket has been affected — the National Cyber Security Centre (NCSC), part of GCHQ, says it is not aware of any UK impact, and is “working with its international partners and industry to fully understand details of an incident.”
But the UK is not insulated from this:
- The same equipment is installed here. Danfoss refrigeration controllers — the equipment targeted in France — are used by British chains. The same kind of equipment is installed in UK shops, food producers, cold stores and kitchens.
- UK food businesses have already been touched. Several UK meat processors have reported problems, with one supplier saying its fridges had been set to defrost every hour and another reporting fridges set to 100°F.
- Exposed systems exist in the UK too. Researchers from UK Cyber Defence have identified more than 800 refrigeration and building-control interfaces associated with British retailers that can be accessed over the public internet. That does not necessarily mean they can be hacked — but it leaves them exposed to attackers exploiting weak passwords or software vulnerabilities.
- The UK has been here before. In April and May 2025, M&S and the Co-op were hit by ransomware attacks. M&S has said its attack cost it around £300 million, and Co-op customers saw empty shelves for days. Those were conventional IT attacks — but they showed how quickly a cyber incident becomes a trading problem.
The British Retail Consortium says it is in contact with domestic retailers, and that “retailers invest heavily in their cyber security and are currently working with the National Cyber Security Centre to ensure their fridges and freezers are secure as possible against potential attacks.” The NCSC has urged UK retailers to keep an accurate, up-to-date record of their operational technology and to make sure all devices and controllers are running the latest software.
The risk for the UK right now is described as real but not the highest in Europe — cybersecurity firm Forescout notes that internet-exposed supermarket refrigeration systems are most common in France, Italy, Greece and Belgium, and the UK is not in the top 10. That is reassuring, and it is also exactly the kind of comfort that makes a business skip the patching.
5. The real lesson: your business runs on connected devices too
You may not own a supermarket fridge. But almost every small business now depends on connected equipment it rarely thinks about as a security risk:
- The router and Wi-Fi access points your whole office runs on
- CCTV cameras and smart door locks
- Printers, scanners and network storage
- Smart thermostats, lighting and heating controls
- Point-of-sale terminals and card machines
- The website, the chatbot and the booking system your customers use
- Any “smart” appliance a supplier installed and connected to the internet
Each one is a small computer with a password, a software version and a network connection. Most of them were set up once — by a supplier, an installer or a well-meaning member of staff — and never reviewed again. That is precisely the profile of the equipment the supermarket attackers exploited: internet-connected, remotely manageable, and running software nobody had patched.
Former NCSC chief executive Ciaran Martin has said manufacturers need to do more to make connected devices secure. Since April 2024, UK law has required manufacturers of certain consumer smart devices to meet minimum cyber security standards, including rules around passwords and security updates. But the law covers new consumer devices — it does not patch the equipment already sitting in your premises.
The supermarket attack is a warning about operational technology, not just office IT. Your customer data can be perfectly protected while a connected device quietly gives an attacker a way in — or, as Europe just learned, a way to switch something off. If you run a website, a chatbot or any system that talks to your customers online, that infrastructure deserves the same attention as the devices in your building. Our website security and cloud and DevOps services cover exactly this kind of review.
6. Seven security checks to run this week
You do not need a security team to do this. You need an afternoon, a list, and the willingness to ask your suppliers awkward questions.
- Make an inventory of everything connected. Walk the premises and list every device that connects to the internet or to your network: routers, cameras, printers, thermostats, card machines, smart appliances, even the coffee machine if it has Wi-Fi. If you cannot list it, you cannot protect it. The NCSC’s advice to retailers after this attack starts with exactly this: keep an accurate, up-to-date record of your operational technology.
- Change every default password. If a device still uses the password it shipped with — or a password your installer chose and never changed — change it now. Use a unique password for each device and store them in a password manager, not on a sticky note or a shared spreadsheet.
- Patch everything, including the boring stuff. Check for software or firmware updates on every device on your list, and install them. The supermarket story shows patching works: systems patched after the French attack in October limited the damage in November. Ask your suppliers which of your devices they patch for you, and which ones are your responsibility.
- Put connected devices on their own network. If your CCTV cameras, printers and smart thermostat share the same network as the computers holding your customer data, one compromised device can reach everything. Ask your IT provider about network segmentation — in plain terms, a separate Wi-Fi network or VLAN for operational devices, kept apart from your business data.
- Turn on monitoring and alerts. The Irish SuperValu stores caught the attack because their monitoring systems raised the alert. Make sure your systems can tell you when something changes unexpectedly — a temperature spike, a device going offline, a login at 3 a.m. — and that the alert reaches a person who will act on it.
- Ask your suppliers three questions. For every supplier that installed connected equipment in your business: What software version is it running? Who is responsible for patching it? How do you access it remotely, and can that access be restricted? If a supplier cannot answer, that is an answer.
- Back up what matters, and test the restore. Backups will not stop a fridge from warming up, but they are what lets a business keep trading after an attack on its IT. Keep backups off the main network, and actually test restoring from them. A backup you have never tested is a hope, not a plan. The same discipline applies to your website and customer systems — see our guide on automating lead follow-up for how your customer-facing systems should keep working even when something goes wrong.
7. If something looks wrong: what to do in the first hour
If a connected system starts behaving strangely — temperatures drifting, devices switching themselves off, settings changing without explanation — treat it as an incident, not a glitch.
- Isolate first. Disconnect the affected device from the network. Do not just switch it off and hope — unplug its network connection so it cannot be reached or used to reach anything else.
- Do not pay anything to anyone. No ransom has been demanded in the supermarket attacks, and paying a ransom is no guarantee of anything. If a demand appears, get professional advice before responding.
- Preserve the evidence. Note the time, take photos of screens and settings, and keep logs. Do not factory-reset the device before someone who understands the incident has looked at it.
- Report it. In the UK, report cyber incidents to the NCSC and, for fraud or extortion, to Action Fraud. If customer data may be involved, you may also have obligations to the Information Commissioner’s Office.
- Tell the people who need to know. Staff, your IT provider, and — if customers are affected — your customers. The retailers that handled the supermarket attacks best were the ones whose monitoring and communication worked quickly.
8. The bottom line
Hackers turned supermarket fridges up to 80°C from somewhere on the internet, spoiled food across six countries, and walked away without stealing a single record. The attack worked because the equipment was connected, remotely manageable, and — in too many cases — unpatched and exposed.
Your business almost certainly has equipment with the same profile. It does not have to be a fridge. It could be a camera, a thermostat, a printer or a point-of-sale terminal. The question is not whether your business is big enough to be a target. The question is whether the devices you depend on are patched, password-protected, monitored and on a network of their own.
Run the seven checks this week. The supermarkets that patched after October were the ones that limited the damage in November.
If you are not sure where your business stands, we can help. Book a free consultation and we will review your website, your connected systems and your security setup — and give you a clear, prioritised list of what to fix first.
Sources: The Grocer (2 November 2026), Food Navigator (2 November 2026), LADbible (2 November 2026), Brit Brief (2 November 2026), Sentrixa (2 November 2026), BBC News reporting on NCSC and UK Cyber Defence research. Figures and quotations are as reported by those outlets on 2 November 2026; this is a developing story and details may change.